A fourth wave of sweeps targeting Bitcoin addresses generated by Coldcard wallets began early Monday, pushing observed losses toward 1,816 BTC, or about $114 million. Researchers said replace-by-fee created a narrow rescue window because victims could override unconfirmed theft transactions by paying a higher fee.
Alex Thorn, Galaxy Research’s head of firmwide research, flagged the active wave while transactions remained in Bitcoin’s mempool. He said the attackers enabled replace-by-fee on their pending transfers. That feature lets another transaction replace an unconfirmed payment when the new transfer offers miners a higher fee. Victims who detect a targeted address can therefore move their coins first.
Could fast mempool monitoring now decide whether some users keep or lose their Bitcoin? Thorn urged users to check balances, remove funds from affected devices, and raise transaction fees.
Thorn had no direct victim report when he published the warning. Instead, he relied on matching transaction patterns and chose speed while users still had time to respond.
The first sweep began July 30 and removed 1,083 BTC from 1,196 addresses within 41 minutes. Two weekend waves raised observed losses to 1,367 BTC across 4,585 addresses. The fourth wave lifted the possible total to about 1,816 BTC from more than 5,200 addresses. Thorn tracked activity across blocks 960,778 through 960,792.
Researchers counted 218 transactions that targeted 462 victim addresses. The wave averaged about 14 sweeps per block, compared with 0.3 during a pre-incident control period. The flaw traces to a March 2021 firmware build. That software sent seed generation to a predictable software randomizer rather than to the wallet chip’s hardware randomizer.
As a result, anyone who identifies the relevant range can reproduce affected keys offline. Coinkite released emergency firmware for all affected models after the flaw was discovered. The manufacturer also told users who created seeds with the flawed software to move funds. They must use wallet addresses generated from fresh seeds.
Also Read: Ethereum Fees Drop 51% as Transactions and Staking Hit Records
Every spent coin arrived after the Coldcard firmware boundary was identified by researchers. The attackers also sent each victim’s funds to a fresh destination with no previous transaction history. Unlike earlier waves, the fourth used one destination per victim instead of shared collector addresses. That change made the new activity harder to map through common destinations.
None of the first three waves reached multisignature setups, matching a flaw tied to single-key seeds. Researchers also removed six old destination addresses as attacker-generated addresses should lack earlier activity. According to CryptoQuant Research Head Julio Moreno, small Bitcoin holders moved 39,600 BTC on July 31. Transfers under 1 BTC reached about $2.5 billion that day.
The last comparable total reached 39,900 BTC on November 16, 2022, days after FTX failed. Daily active addresses also climbed from 645,000 to almost one million.
That reading marked the highest level since December 2024. The increase centered on sending addresses rather than receiving addresses as news of the Coldcard flaw spread.
Four Coldcard-linked sweeps may have taken about 1,816 BTC from more than 5,200 addresses. Replace-by-fee gives users a narrow chance to override pending thefts. Anyone who created a seed with affected firmware should check funds, move coins to a fresh-seed wallet, and raise fees when necessary.