Suspected 4th Coldcard Wave Hits 389 BTC - Galaxy's Thorn Says the Sweep Isn't Over

The Coldcard drain is still active, not a closed breach story

This is still an active drain. A blockchain analyst flagged a suspected 4th organized wave happening in real time, including a fresh 388.92748828 BTC sweep in the latest burst. Galaxy's count stood at roughly 1,367 BTC across 4,585 addresses as of Aug. 2.

Earlier estimates were much smaller-about 594 BTC from approximately 500 addresses-before Galaxy's later review more than doubled that figure. That reset matters because a rising tally can make a threat look smaller than it is. By early August, the incident was clearly larger than initially understood and still potentially expanding.

Why the timing matters now

The key point is that this was not just history sitting in past blocks. The Aug. 2 alert said similar transactions were still in the mempool and that earlier confirmed transactions appeared to use RBF-opt-in, which could let the attacker speed through pending sweeps if victims do not act quickly.

The analyst also warned that some funds have already been swept into 2nd hop addresses. Once stolen coins start moving beyond the first receiver, tracking and recovery become harder.

Watch three signals over the next few hours: - fresh mempool activity matching the earlier pattern - confirmation of more 1:1 sweep transactions - continued movement of funds beyond first-hop addresses

If those signals persist, this should still be read as a live self-custody risk rather than a closed breach story.

The vulnerability is old, but the attack pattern changed

How the exploit worked

The underlying issue is old: a March 2021 firmware integration error left some Coldcards using a software PRNG fallback instead of full hardware entropy. In practice, the device did not gather enough fresh randomness after initialization, making generated keys guessable rather than unknowable.

That flaw is how Galaxy tied the July 30 burst-a 1,196 addresses in 41 minutes drain of 1,082.65 BTC-to a Coldcard firmware defect.

What changed in the latest wave

The bigger shift is behavioral. In the latest burst, the pattern was 1:1 - one fresh destination per victim, with only one destination receiving two sweeps. That is a clear break from the earlier concentrated-funnel model, where most outputs were routed through a small set of collector addresses.

The intensity was still extreme: 13.8 sweeps/block versus 0.3/block in a pre-incident control window, roughly a 45x elevation. For investors, that is the important signal-this was still a high-velocity liquidation event, just structured differently.

Why fragmentation matters more than the headline size

A cleaner topology is harder to monitor and easier for other attackers to replicate. Thorn said there are an increasing number of smaller attackers and imitators now targeting remaining vulnerable phrases, and Galaxy also highlighted a confirmed incident that appeared unrelated to the earlier waves. That makes the risk broader, not smaller.

The key watchpoint is no longer just total BTC moved. It is whether the 1:1 topology and fresh mempool activity continue. If they do, the attack surface is still spreading.

Bitcoin markets are reacting to a flow shock, not just a wallet alert

This is now as much a flow warning as a security warning. Bitcoin wallet migration volume hit a two-year high after the exploit news broke, and the exposed pool was roughly $88.6 million worth of BTC. When that much migration compresses into a short window, the market does not wait for a full post-mortem; it starts pricing custody distrust immediately.

Bull case vs. bear case

The bull case is that this remains a one-wallet shock. The issue is tied to a Coldcard firmware flaw, not Bitcoin itself, and the pressure should fade once vulnerable users finish moving their funds.

The bear case is stronger for now. The exposed set was still large-roughly 1,367 BTC across 4,585 addresses-and Thorn warned that smaller attackers and imitators were still hunting remaining vulnerable wallets. That shifts the story from an isolated flaw to a broader distribution risk that can keep draining liquidity after the first headline.

What would weaken the bearish flow read

The bearish read weakens if: - new sweeps slow materially - mempool activity stops producing fresh patterns - wallet migration volume falls back after the initial rush

Positioning takeaway

For now, the cleaner read is cautious. A two-year-high migration wave around a still-active August 2 exploit suggests flow sensitivity can stay elevated for a short window. If redistribution quietly stops, the scare can cool fast. If exchange inflows start rising while new sweeps continue, that would point to a more immediate sell pressure than the original breach itself.