Coldcard wallet losses may near $114 million as possible fourth sweep emerges
The pending transactions signal replace-by-fee, so anyone who spots their address in the mempool has minutes to pay a higher fee and move funds first.
Make preferred on
Share this article
Summary
- A fourth wave of sweeps targeting bitcoin in Coldcard-generated addresses is underway, with researchers estimating the attacker has moved about 1,816 bitcoin, or roughly $114 million, from more than 5,200 addresses since July 30.
- Unlike earlier waves, the latest transactions appear to use bitcoin’s replace-by-fee feature, meaning victims who spot their coins in the mempool may still be able to outbid the attacker and move their funds first.
- The pattern suggests the flaw affects single-key Coldcard seeds and not multisignature setups, with the attacker sending funds to previously unused addresses that are harder to trace than in prior waves.
