Coldcard Wallets Hit by Fourth Wave of Sweeps Worth $114 Million

A fourth wave of sweeps targeting Bitcoin addresses generated by Coldcard wallets began early Monday, pushing observed losses towards $114 million. The attacks, which started on July 30, have removed over 1,816 BTC from more than 5,200 addresses.

The attackers enabled replace-by-fee on their pending transfers, allowing them to override unconfirmed theft transactions by paying a higher fee. This has created a narrow rescue window for victims, who can move their coins first and then raise transaction fees to protect against further losses.

Alex Thorn, Galaxy Research's head of firmwide research, flagged the active wave while transactions remained in Bitcoin's mempool. He urged users to check balances, remove funds from affected devices, and raise transaction fees.