{"id":36144,"date":"2026-08-03T05:04:57","date_gmt":"2026-08-03T05:04:57","guid":{"rendered":"https:\/\/bitunikey.com\/news\/coldcard-losses-rise-as-fourth-attack-wave-sweeps-448-btc\/"},"modified":"2026-08-03T05:05:27","modified_gmt":"2026-08-03T05:05:27","slug":"coldcard-losses-rise-as-fourth-attack-wave-sweeps-448-btc","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/coldcard-losses-rise-as-fourth-attack-wave-sweeps-448-btc\/","title":{"rendered":"Coldcard losses rise as fourth attack wave sweeps 448 BTC"},"content":{"rendered":"<p><\/p>\n<div class=\"post-detail__content blocks\">\n<p class=\"is-style-lead\">Galaxy Research head Alex Thorn identified a suspected fourth coordinated Coldcard attack wave on Aug. 3, with his running estimate later rising to 448.7 Bitcoin moved from 709 potential victim addresses.<\/p>\n<div id=\"cn-block-summary-block_3f0fc2969cc051aa1f1d5325bf63a28b\" class=\"cn-block-summary\">\n<div class=\"cn-block-summary__nav tabs\">\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/div>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>448.7 BTC moved from 709 suspected victim addresses during a fourth coordinated Coldcard attack wave.<\/li>\n<li>Galaxy measured 13.8 sweeps per block, roughly 45 times its earlier control-window rate across blocks.<\/li>\n<li>Fixed firmware protects newly generated seeds, but existing vulnerable seeds still require complete wallet migration.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>Thorn described the addresses as \u201cLIKELY Coldcard victims,\u201d saying their unspent outputs and transaction behavior matched the vulnerable-wallet pattern. The wording matters. <\/p>\n<p>Galaxy\u2019s findings come from blockchain analysis, not device records or a final law-enforcement attribution. Coinkite had not separately confirmed the fourth-wave total in its latest public advisory.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<h2 class=\"wp-block-heading\"><strong>Coldcard attack activity rose 45 times above baseline<\/strong><\/h2>\n<p>Thorn\u2019s first snapshot covered blocks 960,778 through 960,792. It identified 218 transactions involving 462 possible victim addresses and about 388.9 BTC. His updated estimate later expanded the event to hundreds of transactions affecting 709 addresses and moving 448.7 BTC.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8 LIKELY 4TH ORGANIZED WAVE COLDCARD ATTACK OCCURRING RIGHT NOW<\/p>\n<p>THERE ARE STILL SIMILAR TXS IN THE MEMPOOL WAITING TO BE CONFIRMED AND THE PREVIOUSLY-CONFIRMED TXS SIGNAL RBF OPT-IN, CHECK YOUR FUNDS AND YOU MAY BE ABLE TO RBF YOUR WAY OUT OF THIS<\/p>\n<p>pattern identified:<br \/>blocks\u2026<\/p>\n<p>\u2014 Alex Thorn (@intangiblecoins) <a rel=\"nofollow\" target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/x.com\/intangiblecoins\/status\/2084079706320646300?ref_src=twsrc%5Etfw\">August 3, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>Galaxy measured 13.8 sweeps per block, compared with 0.3 during a pre-incident control period. Most transactions sent each victim\u2019s funds to a fresh destination rather than one shared collection wallet. Some funds had already moved to second-hop addresses, making the flow harder to follow.<\/p>\n<p>Before the latest activity, Galaxy had mapped three suspected waves involving 1,367.05 BTC across 4,585 addresses.As crypto.news reported, the first wave alone moved 1,082.65 BTC from 1,196 addresses during a 41-minute period on July 30.<\/p>\n<p>Adding the fourth-wave estimate would bring the observed total to about 1,815.75 BTC across 5,294 addresses, assuming the groups do not overlap. That figure is an arithmetic estimate, not a loss total confirmed by Coinkite, police or every wallet owner. Galaxy has also said blockchain data cannot prove whether one operator conducted every wave.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Unconfirmed transactions may offer a narrow escape<\/strong><\/h2>\n<p>Thorn said similar transactions remained in Bitcoin\u2019s mempool awaiting confirmation. A user who still controls the affected keys may be able to broadcast a conflicting transaction that pays a higher fee and sends the funds to a secure wallet.<\/p>\n<p><a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/bitcoincore.org\/en\/faq\/optin_rbf\/\" target=\"_blank\" rel=\"nofollow\">Bitcoin Core documentation<\/a> says opt-in Replace-by-Fee transactions can be replaced while they remain unconfirmed. That option disappears once a transaction enters a block. A replacement is also \u201cnot guaranteed\u201d to win, so the warning applies only to users who can identify an unconfirmed spend and act before miners confirm it.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Coldcard users still need completely new seeds<\/strong><\/h2>\n<p>Coinkite traced the problem to an RNG integration error introduced during a March 2021 firmware change. The company estimates that affected Mk2 and Mk3 seeds may have about 40 bits of effective entropy. Seeds generated on affected Mk4, Mk5 and Q releases may have about 72 bits rather than the intended 128.<\/p>\n<p><a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/engineering.block.xyz\/blog\/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware\" target=\"_blank\" rel=\"nofollow\">Block\u2019s engineering team<\/a> independently found that the firmware called a deterministic MicroPython fallback instead of the intended hardware random-number generator. Block cautioned that it had \u201cnot done full empirical testing to confirm exploitability,\u201d while saying active theft reports justified early disclosure.<\/p>\n<p>Coinkite has released fixed firmware: version 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q, and 6.6.0X or 6.6.0QX for Edge releases. Updating alone does not repair an existing vulnerable seed. Users must generate a new seed on fixed firmware, verify a receiving address, send a small test and then migrate the balance.<\/p>\n<p>The company says seeds created with at least 50 fair, private dice rolls are not considered exposed by this RNG issue alone. A strong, unique BIP-39 passphrase adds another barrier, but Coinkite still recommends migration. TAPSIGNER, OPENDIME and SATSCARD use different codebases and are not covered by the advisory.<\/p>\n<p>In related coverage, crypto.news detailed the migration steps after Galaxy\u2019s prior estimate reached $88.6 million. The next verified updates will come from Galaxy\u2019s address mapping, Coinkite\u2019s promised technical review and any public action by exchanges or law enforcement.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Galaxy Research head Alex Thorn identified a suspected fourth coordinated Coldcard attack wave on Aug. 3, with his running estimate later rising to 448.7 Bitcoin moved from 709 potential victim&hellip;<\/p>\n","protected":false},"author":1,"featured_media":33247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-36144","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/36144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=36144"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/36144\/revisions"}],"predecessor-version":[{"id":36145,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/36144\/revisions\/36145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/33247"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=36144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=36144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=36144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}