{"id":725,"date":"2026-08-03T09:57:40","date_gmt":"2026-08-03T01:57:40","guid":{"rendered":"https:\/\/www.btcethdata.com\/?btc_ct_news=suspected-4th-coldcard-attack-wave-sweeps-448-bitcoin-galaxys-thorn"},"modified":"2026-08-03T17:15:49","modified_gmt":"2026-08-03T09:15:49","slug":"suspected-4th-coldcard-attack-wave-sweeps-448-bitcoin-galaxys-thorn","status":"publish","type":"btc_ct_news","link":"https:\/\/www.btcethdata.com\/?btc_ct_news=suspected-4th-coldcard-attack-wave-sweeps-448-bitcoin-galaxys-thorn","title":{"rendered":"Suspected 4th Coldcard attack wave sweeps 448 Bitcoin: Galaxy\u2019s Thorn"},"content":{"rendered":"

Update (Aug. 3 at 4:19 am UTC): This article has been updated with the latest estimated number of affected addresses and Bitcoin from Galaxy\u2019s Alex Thorn. <\/em><\/p>\n

Coldcard users are being warned of a new wave of coordinated thefts targeting their Bitcoin hardware wallets, coming just days after the first wave of attacks on Thursday. <\/p>\n

In an X post on Monday, Galaxy research head Alex Thorn flagged<\/a> hundreds of transactions impacting 709 potential victim addresses, moving 448.7 Bitcoin (BTC).<\/p>\n

Thorn said the activity averaged 13.8 sweeps per block, around 45 times the rate observed in a pre-incident control window. Most transfers have seen a fresh destination created for each victim rather than converging on a central collection wallet. <\/p>\n

Some funds have already been swept into second-hop addresses, he said. <\/p>\n

<\/p>\n

Related: Coldcard Bitcoin loss estimate rises to $70M after Galaxy analysis<\/strong><\/em><\/p>\n

<\/a><\/p>\n

\u201cThese are LIKELY Coldcard victims \u2014 they match the shape of coldcard vulnerable utxos and the elevated transaction pattern gives me high confidence they are another wave of attacks,\u201d said Thorn. <\/p>\n

The researcher said there are similar transactions in the mempool waiting to be confirmed. Affected users who control the relevant keys may be able to broadcast a conflicting transaction with a higher fee to move their funds to a secure wallet before the attacker\u2019s transaction is confirmed. <\/p>\n

The activity follows the disclosure of a previously undetected Coldcard firmware flaw that has caused affected devices to generate wallet seeds with less entropy than intended. The latest estimates suggest that thousands of wallets have been impacted, with over $90 million in Bitcoin stolen. <\/p>\n

Related:<\/strong> Bitcoin price<\/a> \u00b7 BTC live chart<\/a> \u00b7 Ethereum price<\/a> \u00b7 ETH gas fee<\/a> \u00b7 Bitcoin price today<\/a> \u00b7 Top 10 cryptocurrencies<\/a><\/p>\n

Source: Cointelegraph<\/a> \/ Felix Ng<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Galaxy research head Alex Thorn warned that unconfirmed transactions may give some Coldcard users a narrow opportunity to save their funds.<\/p>\n","protected":false},"featured_media":726,"template":"","btc_ct_section":[7],"class_list":["post-725","btc_ct_news","type-btc_ct_news","status-publish","has-post-thumbnail","hentry","btc_ct_section-latest"],"_links":{"self":[{"href":"https:\/\/www.btcethdata.com\/index.php?rest_route=\/wp\/v2\/btc_ct_news\/725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.btcethdata.com\/index.php?rest_route=\/wp\/v2\/btc_ct_news"}],"about":[{"href":"https:\/\/www.btcethdata.com\/index.php?rest_route=\/wp\/v2\/types\/btc_ct_news"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.btcethdata.com\/index.php?rest_route=\/wp\/v2\/media\/726"}],"wp:attachment":[{"href":"https:\/\/www.btcethdata.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=725"}],"wp:term":[{"taxonomy":"btc_ct_section","embeddable":true,"href":"https:\/\/www.btcethdata.com\/index.php?rest_route=%2Fwp%2Fv2%2Fbtc_ct_section&post=725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}