Coldcard's 4th Wave Just Hit 462 Addresses-389 BTC Still Moving Fast

Coldcard fourth wave: 462 addresses and 389 BTC still moving

This is not a Bitcoin protocol failure. It is a live overhang tied to weak Coldcard wallets.

A suspected fourth wave hit today, with 462 addresses involved in 2.5 hours. The attacker moved 388.92748828 BTC through 216 new destination addresses, adding to visible onchain flow while the incident is still unfolding.

The pace is unusual. Sweeping reached 13.8 per block, versus a 0.3 per block baseline - a 45-fold increase. All transactions used RBF and had no inputs older than the Coldcard firmware boundary, which points to a coordinated sweep rather than normal holder behavior.

The root cause is still a five-year-old bug in Coldcard's random number generator that let attackers reconstruct private keys offline. The current wave is draining previously created weak wallets, not breaking Bitcoin itself.

For Coldcard users, this is immediate risk, not theory. Coinkite released patched firmware, but that update does not fix seeds already generated under the old bug. As the German clarification put it: a update alone does not repair an old seed.

If more weak addresses are still being emptied, each new sweep can add to short-term sell pressure.

Why the pressure may keep building: smaller balances and faster collection

The risk is no longer just one big headline drain. Galaxy says the operator is targeting smaller balances and changing how funds are collected onchain. That matters because smaller balances can be easier to miss in real time, and a more efficient collection path can keep the overhang visible for longer.

Earlier sweeps already showed high throughput

On July 30, the attacker swept 1,196 Bitcoin addresses in 41 minutes and took 1,082.65 BTC, worth about $70.2 million at the time. That showed the incident was not limited to a handful of obvious whale wallets.

Subsequent tracking broadened the scope to roughly 1,367 BTC across 4,585 addresses. That does not mean all of those coins will hit the market at once. It does mean the remaining vulnerable pool is large enough to matter if coins keep moving.

The key question: consolidation or ongoing supply?

There is still a live debate. If the operator keeps aggregating coins differently, supply can arrive in bursts. But moved coins do not automatically become instant spot selling; some sweeps may simply reflect consolidation by whoever controls the funds.

What matters now is whether activity keeps broadening and becomes harder to ignore. Key signals include:

• new sweeps spreading to more addresses
• funds moving beyond first-hop destinations
• clearer signs that moved coins are reaching market channels rather than staying trapped in consolidation paths

How to read this as a market event

Treat this as a selective BTC sell-pressure event, not a break in Bitcoin itself. The issue is still tied to a five-year-old bug in Coldcard's random number generator, not protocol damage, and a update alone does not repair an old seed.

If vulnerable coins stay mobile, BTC can feel heavier in short bursts. The operator is already targeting smaller balances, today's wave involved 216 new destination addresses, and some funds have moved into second-hop addresses. That suggests pressure can arrive in waves rather than in one obvious exchange deposit.

The practical stance is to treat this as supply-flow risk that can sharpen spikes, rather than as a macro regime shift. If moved funds remain trapped in consolidation paths, the urgency fades. If they keep reaching tradable channels, the overhang matters more.