Coldcard Users Hit by Second Wave of Coordinated Thefts and Wallet Hacks

Coldcard users are facing another wave of coordinated thefts, just days after the first attack on Thursday. This new wave has seen an estimated 389 Bitcoin stolen from victims, with over 462 addresses impacted in the last few hours.

According to Galaxy research head Alex Thorn, this activity averages 13.8 sweeps per block, a rate significantly higher than observed before the incident. Most transfers have created fresh destination wallets for each victim, rather than converging on a central collection wallet.

Thorn warns that affected users may be able to broadcast a conflicting transaction with a higher fee to move their funds to a secure wallet before the attacker's transaction is confirmed. However, some funds have already been swept into second hop addresses.

The latest attacks follow the disclosure of a previously undetected Coldcard firmware flaw that has caused affected devices to generate wallet seeds with less entropy than intended. Estimates suggest that thousands of wallets have been impacted, with over $90 million in Bitcoin stolen so far.