Coldcard Crisis Deepens: Galaxy Flags 4th Attack Wave After 389 BTC Swept

Galaxy's latest warning centers on fresh sweeps, not a closed loss

Galaxy has flagged a likely fourth wave of attacks after approximately 389 BTC was reportedly swept. The key issue is no longer just the historical damage; it is that the attack sequence may still produce new transfers. For the market, that means fresh supply can keep showing up rather than the incident being fully behind Bitcoin.

Galaxy is tracking 709 potential victim addresses and 448.7 BTC from Galaxy-linked victims, while the broader campaign has involved over $90 million in Bitcoin stolen. Even if only part of that inventory moves toward liquidity, it can still weigh on sentiment while the market absorbs the story.

Why the attack keeps finding new wallets

The driver is reduced seed entropy, not repeated code exploits

Coldcard's firmware flaw cut seed entropy from the intended 128 bits to roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q. That reduces the problem from cryptographic guessing to a much smaller offline search: reconstruct candidate seeds, derive addresses, and compare them with public blockchain data, as Block described.

Once an attacker has mapped thousands of vulnerable outputs, later waves do not need a new vulnerability. They can simply keep enumerating the same small seed space and sweeping newly identified balances.

The attacker is also changing collection behavior

The latest activity averaged 13.8 sweeps per block, which helps explain why the damage has compounded so quickly. Galaxy also said most transfers have used a fresh destination for each victim instead of converging on a single collection wallet, making the campaign harder to block at the address level.

That pattern fits earlier reporting describing changing how funds are collected onchain and the attacker expanding toward smaller balances. A broader set of targets can prolong the episode even after the first major headline fades.

What matters most for market flow

Confirmed stolen coins remain the clearest overhang

The latest approximately 389 BTC reportedly swept in a likely fourth wave, on top of the broader over $90 million in Bitcoin stolen, represents coins already out of user control. That is the clearest supply overhang because those funds can potentially be liquidated.

Pending transactions are the faster near-term risk

The more immediate question is whether similar transactions in the mempool keep confirming. Galaxy said similar transactions were waiting in the mempool, and if those sweeps finalize, Bitcoin could absorb another visible supply shock before sentiment resets.

User-led moves are a different flow from forced selling

Coinkite told affected users to generate a new one on patched firmware and move their coins. That is owner-led relocation of untouched balances, not forced selling of stolen inventory, so it should be weighted less heavily in the near term.

What would reduce the pressure

Watch four indicators as the episode develops:

• Mempool activity: fewer pending sweeps would suggest the damage sequence is slowing.
• Address growth: a plateau in potential victim addresses would imply the campaign is narrowing.
• Destination behavior: if stolen funds keep using fresh per-victim destinations instead of moving toward exchanges or custodial deposits, immediate liquidity pressure may be less direct.
• Second-hop movement: increased obfuscation could signal that stolen coins are being routed toward liquidity over time.

The next repricing risk is therefore straightforward: confirmations, new address growth, and evidence that stolen coins are moving toward liquid channels.