What happened
Galaxy Research's head of research has flagged what appears to be a fourth round of organized attacks targeting Coldcard hardware wallets. The monitoring spotted suspicious Bitcoin mempool activity, with similar transactions still waiting for confirmation, while already confirmed transactions show RBF enabled.
Why it matters for the market
Between blocks 960,778 and 960,792, roughly 218 transactions were observed within about 2.5 hours. These involved 462 victim addresses, 216 new destination addresses, and 388.92748828 BTC in total. The per-block sweep rate reached 13.8 during that window, versus 0.3 in a pre-incident control period, roughly a 45-fold increase.
The transactions followed a 1:1 topology, with each victim address mapping to a new destination address. Only one destination address received two sweeps, and no consolidation addresses appeared. Some funds have already been moved to second-hop addresses, pointing to an ongoing, structured extraction process.
Notably, all transaction inputs were not earlier than the Coldcard firmware boundary, a detail that could help narrow down the possible attack vector. The development raises fresh concerns about the security of hardware wallets, even those widely used for cold storage.
What traders should watch
For crypto markets, such incidents can affect sentiment around self-custody and hardware wallet reliability. Intraday traders may watch for further disclosures, and any broader loss of confidence in cold storage could add to risk-off behavior, potentially increasing volatility in BTC-related markets.
