Key facts
- A fourth sweep targeting Coldcard bitcoin addresses began on August 3.
- The attacker is using Bitcoin's replace-by-fee feature, allowing victims to potentially reclaim their funds.
- Total estimated losses across four waves are approaching $114 million, or 1,816 bitcoin.
- The exploit is linked to a March 2021 firmware version that used a predictable seed generation method.
- Coldcard manufacturer Coinkite has released emergency firmware and advised users to secure their funds.
Bitcoin losses potentially nearing $114 million are being reported as a fourth wave of sweeps targeting addresses generated by the Coldcard cold wallet commenced early Monday. Researchers estimate that since July 30, attackers have moved approximately 1,816 bitcoin, valued at around $114 million, from over 5,200 addresses.
Unlike previous waves, the latest transactions are reportedly utilizing Bitcoin's replace-by-fee feature. This mechanism allows users who detect their funds in the mempool—the queue for unconfirmed transactions—to outbid the attacker by paying a higher transaction fee, potentially recovering their bitcoin before the attacker's transaction confirms.
The exploit appears to affect single-key Coldcard seeds, not multisignature setups. The attacker is sending funds to newly created, previously unused addresses, making them harder to trace than the shared collector addresses used in earlier sweeps. The flaw traces back to a March 2021 firmware version that incorrectly routed seed generation to a predictable software randomizer instead of the hardware's secure random number generator, enabling offline key reproduction.
Alex Thorn, head of firmwide research at Galaxy Research, highlighted the ongoing sweep and advised users to check their funds, move any assets off affected devices, and consider bidding up transaction fees. The initial sweep on July 30 reportedly moved 1,083 bitcoin from 1,196 addresses in just 41 minutes. Two subsequent waves over the weekend brought the total observed losses to 1,367 bitcoin across 4,585 addresses. Coldcard manufacturer Coinkite has released emergency firmware for affected models and urged users who generated seeds on the flawed software to transfer their funds to a wallet created with a fresh seed.
Small Bitcoin holders moved coins on July 31 at a rate not seen since the collapse of FTX, according to CryptoQuant. Transfers of less than 1 BTC totaled 39,600 BTC that day, with daily active addresses rising from 645,000 to almost a million. Deposits made up of sub-10 BTC transfers hit 7,300 BTC on July 31, the most since February 6.