A suspected Coldcard Attack has entered a fourth wave after approximately 448.7 Bitcoin (BTC) moved through hundreds of suspicious transactions, only days after the first attacks were reported. The research head at Galaxy Research, Alex Thorn, has revealed that approximately 448.7 BTC was moved across several hundred transactions, suggesting a fourth organized attack on the wallets that have been generated using Coldcard firmware that was found to be compromised.
As explained by Alex Thorn, the recent Coldcard Attack has involved 709 potential victim addresses, with attackers sweeping 13.8 wallets per Bitcoin block, which was 45 times higher than any activity that was observed before this incident. Instead of consolidating funds in a single wallet, the majority of the transactions create a new destination address for each victim. Some of the Bitcoin that was stolen has been sent to second-hop addresses to hinder any recovery attempt.
Also Read | Stellar (XLM) Eyes Bullish Breakout to $1.50 as Stablecoin Supply Nears $1B
Coldcard Attack Prompts Immediate Security Measures
Thorn said additional suspicious transactions remain in Bitcoin’s mempool awaiting confirmation. However, users who have control over the affected private keys might be able to broadcast conflicting transactions with a higher fee using Replace-by-Fee (RBF).
The latest transactions observed by Galaxy Research are also similar to the transactions witnessed in previous Coldcard attacks, and therefore, the firm has a high level of confidence that the transactions are indeed related to the same vulnerability. Alex Thorn explained that affected wallets are likely to be Coldcard victims based on the transaction pattern and high coordination of spending.
Blockchain investigators have mapped the flow of funds linked to the recent Coldcard vulnerability, revealing that 1,196 Bitcoin addresses were completely drained of 1,082.65 BTC, worth about $70.2 million, in just 41 minutes on July 30. The coordinated theft occurred between 01:10:20 UTC and 01:51:26 UTC across Bitcoin blocks 960,183–960,191, approximately 30 hours before the hardware wallet vendor issued its public security advisory.
Firmware Flaw Linked to Millions in Bitcoin Losses
The Coldcard Attack has been associated with a previously unknown vulnerability within firmware that resulted in Coldcard devices producing wallet recovery seeds with less entropy than required. Estimates of the number of affected wallets now show that it is in the thousands, with more than $90 million worth of Bitcoin having been stolen during the series of attacks.
Coldcard manufacturer Coinkite has suspended shipments of any device affected by the aforementioned firmware version. Affected users have been asked to generate a new recovery seed and move their Bitcoin to new wallets using an updated version of the software.
The current Coldcard Attack also highlights the significance of keeping your firmware up-to-date and monitoring your wallet security as theft campaigns become more advanced.
Also Read | CLARITY Act Update: Digital Chamber CEO Reveals Next Moves
