A fourth wave of automated sweeps targeting bitcoin held in Coldcard-generated addresses is underway, with researchers estimating that an attacker has moved approximately 1,816 bitcoin — roughly $114 million — from more than 5,200 addresses since July 30.

Coldcard, manufactured by Toronto-based Coinkite, is a popular air-gapped hardware wallet among Bitcoin self-custody users who value its reliance on physical SD-card and NFC communication rather than USB or network connections. The device's security model, like all cryptocurrency hardware wallets, depends fundamentally on generating private keys from an unpredictable random seed — the starting entropy from which all of a user's keys and addresses are mathematically derived.

Unlike the previous three waves, the latest transactions appear to use Bitcoin's replace-by-fee (RBF) feature, meaning victims who identify their address in the mempool may still have a brief window to outbid the attacker by paying a higher transaction fee and moving their funds first.

Alex Thorn, head of firmwide research at Galaxy Research, flagged the active fourth wave, noting that the attackers opted into replace-by-fee — a Bitcoin mechanism that allows a pending transaction to be overwritten by a subsequent one carrying a higher fee. Until a transaction is confirmed, any victim who discovers their address in the mempool, the queue of unconfirmed transactions, can submit a competing transaction with a greater fee to relocate their coins ahead of the attacker.

The fourth wave began early Monday and was still running hours later. Thorn said he published his findings based on pattern matching alone, without a direct victim report, choosing speed over confirmation to give users a chance to act while the transactions remained unconfirmed. He advised users to check their funds, move anything off an affected device, and bid the fee up.

The pattern spanned blocks 960,778 to 960,792, encompassing 218 transactions across 462 victim addresses at a rate of approximately 14 sweeps per block, compared with 0.3 per block in a pre-incident control window — roughly 45 times the normal rate.

Timeline of the Attack

The campaign began on July 30, when the first sweep extracted 1,083 bitcoin from 1,196 addresses in just 41 minutes. Two additional waves over the following weekend brought observed losses to 1,367 bitcoin across 4,585 addresses. If the fourth wave estimates hold, the running total across all four waves would reach approximately 1,816 bitcoin — near $114 million — from more than 5,200 addresses since July 30.

The Underlying Vulnerability

The flaw enabling the exploit traces back to a March 2021 Coldcard firmware build that routed seed generation to a predictable software-based random number generator rather than the device's hardware randomizer. This made the resulting private keys reproducible offline by anyone capable of determining the output range. In cryptographic systems, random number generation failures of this kind are among the most severe classes of vulnerabilities, as they collapse the computational infeasibility that private-key security relies on.

Coldcard manufacturer Coinkite released emergency firmware for every affected model and instructed users who had generated a seed using the flawed software to immediately move funds to a wallet address created with a fresh seed.

Patterns and Destination Addresses

Each of the spent coins in the latest wave originated from addresses generated after the Coldcard firmware boundary. The attacker routed funds to fresh destination addresses with no prior transaction history — one per victim — rather than the shared collector addresses that made the first two waves comparatively easy to map.

None of the first three waves affected multisignature setups, which is consistent with the vulnerability being limited to single-key seeds. Multisignature wallets require multiple independent keys to authorize a transaction, meaning a single compromised seed alone is insufficient to move funds — a structural protection that single-key setups lack.

Thorn also noted that six destination addresses with years of prior activity appeared in the data, which would be inconsistent with a freshly generated attacker address, since such an address cannot have a history.

Source: CoinDesk