Coldcard Wallet Attacks Enter Fourth Wave, Putting 449 BTC at Risk

Victims with pending transactions may still have a brief chance to outbid attackers using Bitcoin's Replace-by-Fee feature. A suspected fourth wave of attacks targeting vulnerable Coldcard-generated Bitcoin wallets may already be underway, with blockchain researcher Alex Thorn warning on August 3 that almost 449 BTC had been swept from hundreds of addresses in about two and a half hours. The latest activity, which was still unfolding as Thorn posted, follows three earlier waves that researchers have linked to the same weak-entropy vulnerability affecting certain Coldcard firmware versions. New Sweeps Continue Thorn said his latest analysis had identified 218 transactions affecting 462 suspected victim addresses between Bitcoin blocks 960778 and 969792. The transactions moved 388.93 BTC, valued at about $24.4 million at current rates, into 216 destination addresses, almost all of which had been just created and had no past transaction history. “These are LIKELY Coldcard victims — they match the shape of coldcard vulnerable utxos and the elevated transaction pattern gives me high confidence they are another wave of attack,” he wrote. The analyst stressed that he had no direct confirm...