Alex Thorn, Galaxy Digital’s Managing Director and Head of Firmwide Research, has identified what he believes is a fourth organized wave of attacks targeting Coldcard wallet users. The onchain activity, spanning Bitcoin blocks 960,778 through 960,792, involved 218 transactions that moved approximately 388.92748828 BTC—worth around $24.4 million at the time of writing, with Bitcoin trading near $62,700.
Thorn observed a sweep rate of roughly 13.8 transactions per block during the incident, about 45 times higher than normal. The input history, destination patterns, and fresh addresses used matched earlier Coldcard-related attacks. Unlike previous waves, many transactions remained unconfirmed in the mempool, and the confirmed ones signaled Replace-by-Fee (RBF) opt-in, offering a potential recovery window for some victims.
Users with pending unauthorized transfers may still be able to replace them by broadcasting a higher-fee transaction to a secure wallet, provided they control the private keys and act before confirmation. However, second-hop transfers—moving BTC from the initial destination to new addresses—close this window entirely, as those funds have already been confirmed on the blockchain. Thorn urged affected users to move remaining funds off Coldcard devices immediately, create new wallets with fresh security credentials, and never share seed phrases or private keys with anyone offering recovery help.
The investigation is based on Thorn’s onchain analysis and has not been confirmed by Coinkite or law enforcement.
