Home›Crypto›Market Structure›Coldcard wallets face fourth Bitcoin theft wave near $…

Coldcard wallets face fourth Bitcoin theft wave near $114 million

Attackers have drained about 1,816 BTC since Thursday, with Monday’s sweeps using replace-by-fee so victims may have a short window to override pending transactions.

Reported · Written up by our desk · Market Structure

Attackers began a fourth wave of Bitcoin sweeps targeting funds held in Coldcard hardware wallets on Monday, pushing estimated losses to roughly $114 million since Thursday, The Defiant reported. The latest transactions were still replaceable while unconfirmed in the mempool, giving some victims a brief window to move coins before the thefts confirm.

The thefts trace back to a firmware bug that shipped in March 2021 and remained unnoticed for more than five years, undermining the hardware wallet promise that keys generated on-device cannot be guessed. Coldcard maker Coinkite said it released emergency firmware for every affected model, halted shipments, and instructed users to move funds to freshly generated seeds.

Galaxy’s Alex Thorn highlighted the speed and scale of the new wave, counting 448.7 BTC swept from 709 potential victim addresses at a rate of 13.8 sweeps per block, about 45 times the rate in a pre-incident control window. That adds to earlier waves in which 1,367 BTC were taken from 4,585 addresses, bringing the estimated total to about 1,816 BTC from more than 5,200 addresses.

Thorn said Monday’s sweeps opted into Bitcoin’s replace-by-fee feature, which allows an unconfirmed transaction to be overwritten by a later one that pays a higher fee. Until the attacker’s transaction confirms, a victim who spots their address in the mempool can broadcast a conflicting higher-fee transfer to move coins to a safe wallet, though the window lasts only while the attacker’s transaction remains unconfirmed.

Latest closeBitcoin $63,780.28 ▲0.5%

More like this

Sources