4th Coldcard Wave Hits 389 BTC in 2.5 Hours-Galaxy Warns the Sweep Is Still Opening

Coldcard attack activity is still active, not behind us

BTC vanished in roughly 2.5 hours, and Galaxy says the Coldcard drain is still open. In the last last ~2.5 hours, on-chain observers flagged 388.92748828 BTC moved in 218 transactions across 462 victim addresses and 216 fresh destinations. This looks like an active exit flow, not a closed headline.

The pace is the key point. The wave ran at 13.8 sweeps per block versus 0.3 per block in the control window, about a 45x increase. That is far above normal residual traffic. For exposed holders, the decision window still appears to be live, and the data suggests delay can still cost funds.

The running loss tally now stands at 1,367.05 BTC, affecting 4,585 addresses and worth about $88.6 million. The bigger takeaway is not just the size of the loss, but the fact that the attack is still generating fresh outflows. Until that changes, this is better read as ongoing risk than as a fully settled incident.

Waiting can still be costly because not all exits have settled. Similar transactions were still reported in the mempool, and confirmed transactions signaled RBF opt-in. That means exposed users may still be in a race against faster, higher-fee sweeps.

Galaxy warns the attacker base is fragmenting into smaller sweeps

One important change is the move away from a handful of large coordinated drains. Galaxy said the third wave already showed targeting smaller balances and a different onchain collection pattern, and the latest update points to more small-scale attackers and imitators hunting remaining weak mnemonic phrases. That suggests a wider attacker base, not one that has burned out.

Sub-1 BTC transfer activity has widened

The clearest sign is in transfer size. 39,600 BTC was moved in sub-1-BTC transfers, the highest daily level of that flow type since the FTX collapse window. That does not prove a single major actor disappeared, but it does suggest the activity is spreading across many smaller transfers and exit paths.

Fragmented flows can be harder to contain. A single collector address is easier to track and freeze than dozens of small transfers. Even if you view this as attackers moving on to smaller targets, the data still shows a broad pool of exploitable material rather than a neatly cleaned-up attack surface.

Response windows appear to be narrowing

The Duel-related drainage is a sharper warning. Galaxy said funds were pulled before they could be frozen on Duel, and that this drain was unrelated to the previous attack waves. In practice, that means response windows may be shrinking: some funds can still be saved, but the margin for slow action is getting smaller.

That is why the loss tally matters qualitatively as well as numerically. This is no longer just about the roughly 1,367.05 BTC already tracked. It is also about the fact that new victim and attacker addresses have continued to appear after the major waves.

Bitcoin self-custody debate is back, but the immediate read is defensive

This incident has reignited the broader debate over Bitcoin self-custody. the incident has become a broader test for Bitcoin self-custody, with users and analysts reassessing whether direct key control is still the safest default or whether more convenience-led models deserve more trust.

For now, the more useful market stance is defensive rather than dramatic: stay cautious while the exit flow continues, then reassess once the activity clearly cools.

What to avoid now

• Do not treat this as a clean, durable "buy custody fear" trade for platforms or ETFs. The event is still still going, so sentiment can stay elevated for a while but may also fade quickly once transfers slow.
• Do not use platform exposure as a proxy for "saved BTC." Galaxy said funds were pulled before they could be frozen on Duel, and that drain was unrelated to previous attack waves.

What to watch

• The small-transfer stream matters. 39,600 BTC moved in sub-1-BTC transfers, the highest daily level of that flow since the FTX collapse window. If that metric remains elevated, the attack still has traction.
• Watch for fewer fresh destination clusters and a slowdown in small sweeps. The earlier wave ran at 13.8 sweeps per block versus about 0.3 per block normally; a move back toward normal pace would matter more than another round of headline loss tallies.

What would weaken the cautious view

• No new large sweeps and a clear fade in panic-level small-BTC movement.
• Fewer confirmable drain patterns from small-scale attackers and imitators.
• Market attention shifting away from custody fear and back toward normal risk pricing.