Alex Thorn flags fourth apparent BTC theft wave targeting Coldcard users

Galaxy Digital Head of Research Alex Thorn said a fourth apparent theft wave targeting Coldcard hardware wallet users is underway. Thorn said a pattern over the past roughly two hours and 30 minutes showed 388.93 BTC moving through 218 transactions from 462 victim addresses to 216 new addresses. Some of the transactions are still in the mempool, Thorn said, adding users may still be able to protect funds by using RBF (Replace-By-Fee) to attach higher fees. Thorn also said all UTXOs used in the transactions were created with flawed Coldcard firmware, while transaction frequency was about 45 times higher than before the incident, indicating a high likelihood of an additional attack. Earlier, more than 1,359.88 BTC was stolen due to a random number generation flaw in Coldcard, and reports also emerged that some devices were bricked and failed to boot after an emergency firmware release.