Coldcard Users Hit by New Wave of Coordinated Thefts Worth 448.7 BTC

A new wave of coordinated thefts has targeted Coldcard users' Bitcoin hardware wallets, affecting hundreds of potential victims just days after the first wave of attacks on Thursday. According to Galaxy research head Alex Thorn, there have been hundreds of transactions impacting 709 possible victim addresses, moving around 448.7 BTC.

The activity averages 13.8 sweeps per block, significantly higher than the pre-incident control window. Most transfers create a new destination for each victim rather than converging on a central collection wallet. Some funds have already been swept into second-hop addresses.

Affected users who control the relevant keys may be able to broadcast a conflicting transaction with a higher fee to move their funds to a secure wallet before the attacker's transaction is confirmed, Thorn said. The researcher believes these transactions are likely Coldcard victims due to matching vulnerabilities in utxos and an elevated transaction pattern.

This activity follows the disclosure of a previously undetected Coldcard firmware flaw that has caused affected devices to generate wallet seeds with less entropy than intended. The latest estimates suggest thousands of wallets have been impacted, with over $90 million in BTC stolen.