Close to 449 Bitcoin, worth millions, have been moved from over 700 possibly compromised Coldcard wallets during a fresh, coordinated assault on August 3. This latest wave pushes the running tally of affected funds to roughly 1,816 BTC, spread across more than 5,200 addresses since the attacks began late last month.
Spike in Attack Intensity
Alex Thorn, head of Galaxy Research, highlighted a dramatic increase in exploit activity with an average of 13.8 sweeping transactions per block during the August 3 attack. This figure dwarfs the previous rate of just 0.3 sweeps per block measured during control periods, indicating an intensified breach campaign. These transactions didn't funnel funds into a single collection wallet as might be expected; instead, stolen BTC moved into fresh, diversified addresses, complicating tracking efforts. Some coins have already been shuffled into secondary hops, further obscuring their trail.
Ongoing Risks Despite Firmware Updates
Coinkite, the Coldcard manufacturer, has released firmware patches designed to shield newly generated seeds from vulnerabilities exploited in these waves. However, millions of BTC in wallets with pre-existing seeds remain exposed, requiring full wallet migrations for security restoration. Galaxy's analysis, relying purely on blockchain data rather than device records or law enforcement confirmation, labels the addresses involved as "likely Coldcard victims" due to their transaction patterns and unspent outputs matching those seen in earlier breaches.
Before this wave, three prior attack surges accounted for about 1,367 BTC lost from more than 4,500 addresses, including a significant first wave that moved over 1,082 BTC within 40 minutes on July 30. The expanded total with the fourth wave raises concern about the scale of these intrusions over a short span.
This information is provided for context and does not constitute financial advice.
