Users of Coldcard, a hardware wallet brand designed for Bitcoin storage, are facing a significant increase in thefts after a fresh wave of coordinated attacks targeted their devices this week.
Hundreds of addresses swept in latest attacks
Alex Thorn, head of research at Galaxy, reported that attackers have targeted 462 potential victim addresses within the most recent surge, executing 218 transactions and moving a total of 388.9 Bitcoin. He highlighted that the frequency of these thefts had spiked dramatically, with the latest activity averaging 13.8 sweeps per block, which is approximately 45 times higher than what had been observed during a control period before the incident.
Each transfer typically saw stolen funds moved directly to a newly created wallet instead of being funneled to a single collecting address, complicating efforts to track the total losses or consolidate affected funds. Thorn also indicated that a portion of the compromised assets have already been transferred to additional addresses, known as “second hop” wallets, making the trail more difficult to follow.
Mini dictionary: Coldcard, a Bitcoin hardware wallet developed by Coinkite, is known for its security features and offline key management aimed at protecting users’ cryptocurrency from online threats.
Many of these transactions have yet to be confirmed on the Bitcoin blockchain, and similar activity is still visible in the network’s mempool, which holds unconfirmed transactions. The pattern of these thefts shows clear hallmarks tied to Coldcard wallets, based on unique technical traces and frequency.
| Metric | Latest attack wave | Pre-attack control period |
|---|---|---|
| Addresses affected | 462 | Not specified |
| Transactions | 218 | Significantly lower |
| BTC moved | 388.9 BTC | Minimal |
| Sweeps per block | 13.8 | Approx. 0.3 |
Potential for further losses and recommended actions
Thorn commented that affected users might still have an opportunity to protect their funds if their transaction has not yet been confirmed. He suggested that those victims who retain control over their keys could attempt to broadcast a higher-fee replacement transaction, effectively moving their Bitcoin to a safe wallet before the criminal’s attempted transaction is mined into a block.
“These are likely Coldcard victims — they match the shape of Coldcard vulnerable UTXOs and the elevated transaction pattern gives me high confidence they are another wave of attacks,” Thorn stated.
The ongoing thefts follow a previous wave that began last Thursday, and analysts warn that the risk remains high for users with uncompromised keys still held in vulnerable wallet setups. Some recent estimates have placed total losses related to Coldcard vulnerabilities as high as $70 million.
