Early Monday, a fourth wave of sweeping attacks targeted Bitcoin addresses generated by Coldcard wallets, pushing observed losses to approximately 1,816 BTC—worth around $114 million. Researchers have identified a narrow rescue window enabled by replace-by-fee (RBF), which allows victims to override unconfirmed theft transactions by paying a higher fee.
Narrow Rescue Window
Galaxy Research’s Alex Thorn flagged the active wave while transactions remained in Bitcoin’s mempool. He noted that attackers enabled replace-by-fee on their pending transfers, meaning victims who detect a targeted address can move their coins first by offering miners a higher fee. Thorn urged users to check balances, remove funds from affected devices, and raise transaction fees promptly.
Thorn had no direct victim report when he published the warning. Instead, he relied on matching transaction patterns and chose speed while users still had time to respond.
Predictable Seed Generation
The first sweep began July 30, removing 1,083 BTC from 1,196 addresses within 41 minutes. Two weekend waves raised observed losses to 1,367 BTC across 4,585 addresses. The fourth wave lifted the possible total to about 1,816 BTC from more than 5,200 addresses. Thorn tracked activity across blocks 960,778 through 960,792.
Researchers counted 218 transactions that targeted 462 victim addresses. The wave averaged about 14 sweeps per block, compared with 0.3 during a pre-incident control period. The flaw traces to a March 2021 firmware build that sent seed generation to a predictable software randomizer rather than the wallet chip’s hardware randomizer. As a result, anyone who identifies the relevant range can reproduce affected keys offline.
Coinkite released emergency firmware for all affected models after the flaw was discovered. The manufacturer also instructed users who created seeds with the flawed software to move funds and use wallet addresses generated from fresh seeds.
Transaction Patterns
Every spent coin arrived after the Coldcard firmware boundary was identified by researchers. The attackers also sent each victim’s funds to a fresh destination with no previous transaction history. Unlike earlier waves, the fourth used one destination per victim instead of shared collector addresses, making the new activity harder to map through common destinations.
None of the first three waves reached multisignature setups, matching a flaw tied to single-key seeds. Researchers also removed six old destination addresses as attacker-generated addresses should lack earlier activity. According to CryptoQuant Research Head Julio Moreno, small Bitcoin holders moved 39,600 BTC on July 31—transfers under 1 BTC reached about $2.5 billion that day. The last comparable total reached 39,900 BTC on November 16, 2022, days after FTX failed. Daily active addresses also climbed from 645,000 to almost one million, marking the highest level since December 2024. The increase centered on sending addresses rather than receiving addresses as news of the Coldcard flaw spread.
Brief Roundup
Four Coldcard-linked sweeps may have taken about 1,816 BTC from more than 5,200 addresses. Replace-by-fee gives users a narrow chance to override pending thefts. Anyone who created a seed with affected firmware should check funds, move coins to a fresh-seed wallet, and raise fees when necessary.