Coldcard Wave 4 May Have Hit 462 Wallets-389 BTC Still in Play

Wave 4 looks active, not historical

Galaxy Research says the fourth Coldcard wave is still running. In roughly the last 2.5 hours, 388.93 BTC was moved across 218 transactions from 462 victim addresses into 216 new addresses. That suggests the exploit is still finding fresh targets rather than simply shuffling old stolen coins.

Why the timing matters

Earlier waves left much of the stolen BTC sitting in attacker wallets, with the stolen Bitcoin involved remains at the attackers' addresses and has not been moved reported for the first three waves. Wave 4 looks different because the same research said the transaction frequency was also about 45 times higher than before the incident, making further attacks more likely.

There is also a narrow operational opening. Galaxy said some transactions are still in the mempool, so users may still be able to outbid them with RBF at a higher fee before they confirm.

The broader exposure is larger than the fresh bleed alone. Prior waves already involved up to 1,367.05 BTC, and Galaxy said single-signature wallet addresses generated by Coldcard after the March 2021 firmware upgrade are all potentially at risk. That keeps the risk broader than a one-time headline loss.

Why the attack is still spreading

Weak randomness is the core flaw

Galaxy said the exploited UTXOs were all created with defective Coldcard firmware. Block's advisory said a coding mistake in certain Coldcard versions may have weakened a key security feature, which is consistent with a software flaw may have allowed attackers to steal roughly $70 million worth of bitcoin in less than an hour. In practical terms, that turns a hardware wallet into a device that may produce weaker secrets.

Because the weakness relates to address generation, new wallets made on vulnerable firmware can remain exposed, not just old coins sitting around. Galaxy said single-signature wallet addresses generated after the March 2021 firmware upgrade are all potentially at risk.

Automation increases the target pool

Wave 4 looks less like a one-off break-in and more like scripted scanning. Galaxy said the latest pattern showed the transaction frequency was also about 45 times higher than before the incident, making further attacks more likely, and that earlier waves showed clear programmatic characteristics.

That changes the dynamic. A manual attacker may focus on large, obvious targets. A script can scan for any address that looks vulnerable and act quickly. That helps explain how 462 addresses were touched in such a short window.

Cashier routes are widening

The biggest practical change is in money movement. Earlier waves left stolen BTC mostly untouched in attacker wallets, but Galaxy said smaller-scale attackers have begun exploiting the vulnerability to steal funds and move them through peeling chains, cross-chain services, and other methods. Chaincatcher reported that 17 BTC were split and converted into ETH via THORChain before reaching Duel.com. That does not prove every attacker can exit quickly, but it does show the exit path is getting broader.

What Coldcard users should check now

Start with scope, not assumptions

If you use Coldcard, the cautious approach is to verify exposure before assuming a wallet is safe. Galaxy said single-signature wallet addresses generated after the March 2021 firmware upgrade are all potentially at risk. Users should check three things:

• the exact Coldcard model
• the firmware version
• whether addresses were generated on the device rather than imported from an outside seed

Prioritize dormant single-sig outputs

The attacked outputs were often long idle. Galaxy said the average dormancy period of the stolen BTC before being stolen was 3.18 years, with a median of 3.55 years. That suggests old dormant single-sig outputs can be as important as recently active ones.

• Treat old dormant single-sig outputs created on potentially vulnerable Coldcard setups as highest priority.
• If there is any doubt about the device, firmware, or address-generation path, prepare to move funds.

Use RBF only while the transaction is still pending

This is the time-sensitive part. Galaxy said some transactions are still in the mempool and that users may still be able to use RBF with a higher fee to protect funds.

• If you spot a pending send tied to a potentially exposed UTXO, do not assume it is safe just because it has not confirmed yet.
• If your wallet supports it, try RBF with a higher fee immediately.
• If the transaction confirms first, that rescue window is likely gone.

What would reduce the urgency