Galaxy

Waves

2026

Core

Bitcoin

<p>Galaxy Research head Alex Thorn has hinted that Coldcard was hit by a fourth wave of attacks on August 3, estimating that the attackers moved 448.7 <a class="thirstylink" href="https://coinstats.app/coins/bitcoin/" rel="noopener noreferrer nofollow">BTC</a> from 709 wallets belonging to victims.</p><p>Thorn based his findings on blockchain analysis rather than device records, describing the addresses as “likely Coldcard victims.”</p><h2 id="a-fourth-wave">A Fourth Wave?</h2><p>Thorn described the addresses hit by the suspected attack as “likely Coldcard victims,” adding that the unspent outputs and transactions matched the vulnerable wallet pattern. Galaxy’s initial snapshot covered blocks 960,778 through 960,792, identifying 218 transactions involving 388.9 <a class="thirstylink" href="https://coinstats.app/coins/bitcoin/" rel="noopener noreferrer nofollow">BTC</a> and 462 potential victim addresses. The updated estimate expanded the figures to hundreds of transactions involving 448.7 BTC and 709 potential victim addresses.</p><p>Thorn posted the findings on X:</p><div class="ose-x ose-uid-9fa6c56b5cb935dd191e55629df860cc ose-embedpress-responsive" style="width: 100%; height:550px; max-height:550px; max-width:100%; display:inline-block;"><blockquote class="twitter-tweet"><p><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> LIKELY 4TH ORGANIZED WAVE COLDCARD ATTACK OCCURRING RIGHT NOW<br><br>THERE ARE STILL SIMILAR TXS IN THE MEMPOOL WAITING TO BE CONFIRMED AND THE PREVIOUSLY-CONFIRMED TXS SIGNAL RBF OPT-IN, CHECK YOUR FUNDS AND YOU MAY BE ABLE TO RBF YOUR WAY OUT OF THIS<br><br>pattern identified:<br>blocks…</p>— Alex Thorn (@intangiblecoins) <a href="https://x.com/intangiblecoins/status/2084079706320646300?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">August 3, 2026</a></blockquote></div><p>“LIKELY 4TH ORGANIZED WAVE COLDCARD ATTACK OCCURING RIGHT NOW THERE ARE STILL SIMILAR TXS IN THE MEMPOOL WAITING TO BE CONFIRMED AND THE PREVIOUSLY-CONFIRMED TXS SIGNAL RBF OPT-IN, CHECK YOUR FUNDS, AND YOU MAY BE ABLE TO RBF YOUR WAY OUT OF THIS.”</p><p>According to Thorn, Galaxy measured 13.8 sweeps per block, a 45x increase compared to 0.3 sweeps per block measured during a pre-incident control period. The siphoned funds were sent to a new address instead of a shared wallet. Some of the stolen funds were subsequently moved to new addresses, making them difficult to track.</p><h2 id="previous-waves">Previous Waves</h2><p>Galaxy has already mapped three prior waves that siphoned 1,367.05 BTC from 4,585 addresses, with the first wave targeting 1,082.05 BTC across 1,196 addresses. The latest wave brings the total figures to 1,815.75 BTC across 5,294 addresses. However, the figures are yet to be confirmed by authorities, Coinkite, or the wallet owners. Additionally, it isn’t clear whether one entity was responsible for all four waves.</p><p>Thorn also added that there were transactions awaiting approval in <a class="thirstylink" href="https://coinstats.app/coins/bitcoin/" rel="noopener noreferrer nofollow">Bitcoin</a>’s mempool, giving holders an escape route. According to Thorn, <a class="thirstylink" href="https://coinstats.app/coins/bitcoin/" rel="noopener noreferrer nofollow">Bitcoin</a> Core documentation states that unconfirmed opt-in Replace-by-fee transactions can be replaced. This means a user still in control of an affected key could broadcast a conflicting transaction with a higher fee and send the funds to a secure wallet. However, it cannot be replaced once it enters the block, and a replacement is not guaranteed to succeed.</p><h2 id="coldcard-users-must-generate-new-seeds">Coldcard Users Must Generate New Seeds</h2><p>The ongoing issue arises from an RNG integration error that occurred during a March 2021 firmware change. Coinkite estimates that the affected Mk2 and Mk3 seeds have around 40 bits of effective entropy, while seeds generated on affected Mk4, Mk5, and Q releases have 72 bits instead of 128.</p><p>Additionally, an engineering team from Block discovered that the firmware called a deterministic MicroPython fallback instead of the hardware random-number generator. However, the Block team clarified they could not confirm exploitability without full empirical testing.</p><p>Meanwhile, Coinkite has released version 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q, and 6.6.0X or 6.6.0QX for Edge releases. However, simply updating the existing firmware does not fully address the vulnerability. Once updated, users must generate a new seed and verify the receiving address. Once verified, they must send a test transaction before migrating the complete balance.</p><p>Coinkite also clarified that seeds created using a minimum of 50 fair, private dice rolls are not considered at risk, and that a unique BIP-39 passphrase could serve as a second line of defense. However, it recommended that users complete the migration. The advisory does not cover TAPSIGNER, OPENDIME, and SATSCARD because they use separate codebases.</p><p><i>Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.</i></p><p>This article was originally published as <a href="https://www.cryptobreaking.com/coldcard-hit-by-suspected-fourth/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Coldcard Hit By Suspected Fourth Attack Wave As Losses Mount</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.</p>

Coldcard Hit By Suspected Fourth Attack Wave As Losses Mount

Table of Contents

Crypto Breaking News

Other articles published on Aug 3, 2026

Little Pepe Presale Ends This Weak: LILPEPE Launch or Stage 14 Next?

Coldcard exploit sparks call for independent audits: Kraken CSO

Binance Earn August Dual Investment Leaderboard Offers Up to 5,888 USDC in Rewards

ZeroStack Flags Survival Risk After $82.5M Crypto Treasury Loss

CLARITY Act Misses Monday Senate Schedule Before Recess

Alchemy Pay adds Michigan, its 19th US money transmitter license

Join our free newsletter for daily crypto updates!