Fourth Coldcard attack wave drains over 448 BTC

Alex Thorn, head of research at Galaxy, identified the latest wave on August 3 by monitoring transaction patterns that match known vulnerabilities in older device firmware. While blockchain analysis reveals the movement of funds, it remains unclear if a single operator is behind the entire sequence. Prior to this event, Galaxy had mapped three distinct waves involving 1,367 BTC across thousands of addresses, bringing the potential cumulative impact to approximately 1,815 BTC.

For those currently targeted, an immediate "Replace-by-Fee" (RBF) strategy may offer a narrow window of escape. Users who identify an unconfirmed transaction in the mempool can potentially broadcast a conflicting transfer with a higher fee to redirect funds to a secure wallet before miners finalize the block. Once a transaction is confirmed, however, this recovery path closes.

Coinkite, the manufacturer of Coldcard, traced the underlying issue to a firmware error introduced in March 2021, which caused devices to use a deterministic fallback instead of a hardware random-number generator. This flaw limits the entropy of generated seeds, making them susceptible to discovery. While the company has released patched firmware versions for the Mk2, Mk3, Mk4, Mk5, Q, and Edge models, an update is insufficient on its own. Users must generate entirely new seeds and manually migrate their balances to ensure safety. The vulnerability does not affect devices that used dice rolls for entropy or those running on different codebases, such as TAPSIGNER or OPENDIME.