Galaxy Research head Alex Thorn identified a suspected fourth coordinated Coldcard attack wave on Aug. 3, with his running estimate later rising to 448.7 Bitcoin moved from 709 potential victim addresses.
Summary
- 448.7 BTC moved from 709 suspected victim addresses during a fourth coordinated Coldcard attack wave.
- Galaxy measured 13.8 sweeps per block, roughly 45 times its earlier control-window rate across blocks.
- Fixed firmware protects newly generated seeds, but existing vulnerable seeds still require complete wallet migration.
Thorn described the addresses as “LIKELY Coldcard victims,” saying their unspent outputs and transaction behavior matched the vulnerable-wallet pattern. The wording matters.
Galaxy’s findings come from blockchain analysis, not device records or a final law-enforcement attribution. Coinkite had not separately confirmed the fourth-wave total in its latest public advisory.
Coldcard attack activity rose 45 times above baseline
Thorn’s first snapshot covered blocks 960,778 through 960,792. It identified 218 transactions involving 462 possible victim addresses and about 388.9 BTC. His updated estimate later expanded the event to hundreds of transactions affecting 709 addresses and moving 448.7 BTC.
Galaxy measured 13.8 sweeps per block, compared with 0.3 during a pre-incident control period. Most transactions sent each victim’s funds to a fresh destination rather than one shared collection wallet. Some funds had already moved to second-hop addresses, making the flow harder to follow.
Before the latest activity, Galaxy had mapped three suspected waves involving 1,367.05 BTC across 4,585 addresses.As crypto.news reported, the first wave alone moved 1,082.65 BTC from 1,196 addresses during a 41-minute period on July 30.
Adding the fourth-wave estimate would bring the observed total to about 1,815.75 BTC across 5,294 addresses, assuming the groups do not overlap. That figure is an arithmetic estimate, not a loss total confirmed by Coinkite, police or every wallet owner. Galaxy has also said blockchain data cannot prove whether one operator conducted every wave.
Unconfirmed transactions may offer a narrow escape
Thorn said similar transactions remained in Bitcoin’s mempool awaiting confirmation. A user who still controls the affected keys may be able to broadcast a conflicting transaction that pays a higher fee and sends the funds to a secure wallet.
Bitcoin Core documentation says opt-in Replace-by-Fee transactions can be replaced while they remain unconfirmed. That option disappears once a transaction enters a block. A replacement is also “not guaranteed” to win, so the warning applies only to users who can identify an unconfirmed spend and act before miners confirm it.
Coldcard users still need completely new seeds
Coinkite traced the problem to an RNG integration error introduced during a March 2021 firmware change. The company estimates that affected Mk2 and Mk3 seeds may have about 40 bits of effective entropy. Seeds generated on affected Mk4, Mk5 and Q releases may have about 72 bits rather than the intended 128.
Block’s engineering team independently found that the firmware called a deterministic MicroPython fallback instead of the intended hardware random-number generator. Block cautioned that it had “not done full empirical testing to confirm exploitability,” while saying active theft reports justified early disclosure.
Coinkite has released fixed firmware: version 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q, and 6.6.0X or 6.6.0QX for Edge releases. Updating alone does not repair an existing vulnerable seed. Users must generate a new seed on fixed firmware, verify a receiving address, send a small test and then migrate the balance.
The company says seeds created with at least 50 fair, private dice rolls are not considered exposed by this RNG issue alone. A strong, unique BIP-39 passphrase adds another barrier, but Coinkite still recommends migration. TAPSIGNER, OPENDIME and SATSCARD use different codebases and are not covered by the advisory.
In related coverage, crypto.news detailed the migration steps after Galaxy’s prior estimate reached $88.6 million. The next verified updates will come from Galaxy’s address mapping, Coinkite’s promised technical review and any public action by exchanges or law enforcement.
