Fourth Wave of Coldcard Wallet Attack: Users Urged to Act Quickly

A likely fourth wave of the Coldcard wallet attack has been identified by Alex Thorn, Galaxy Digital's Managing Director and Head of Firmwide Research. This new wave moved approximately $24.4 million in Bitcoin, with some unconfirmed transactions still allowing users to redirect their funds.

The cluster, which occurred on August 3, 2026, contained 218 transactions involving 462 suspected victim addresses and 216 previously unused destination addresses. Thorn's onchain analysis covered Bitcoin blocks 960,778 through 960,792, spanning approximately two and a half hours of activity.

Somewhat similar to the earlier Coldcard incident, Thorn found that almost every transaction sent funds to a separate, newly created address. The sharp increase in sweeps, matching input history, and repeated use of fresh destinations led him to attribute the activity to another wave of Coldcard victims.