Blockchain researcher Alex Thorn has warned that approximately 449 BTC was swept from hundreds of Coldcard-generated Bitcoin addresses in under three hours, indicating a suspected fourth wave of attacks tied to a firmware vulnerability.
The incident, flagged on August 3, follows a series of breaches linked to weak entropy in specific Coldcard firmware versions, according to Thorn. Transactions occurred between Bitcoin blocks 960778 and 969792, with 388.93 BTC transferred to 216 newly created addresses.
Coinkite, the firm behind Coldcard wallets, confirmed the vulnerability in certain firmware iterations but has not disclosed further details. Galaxy Research previously estimated that the first three waves drained 1,367 BTC, equivalent to $85.7 million at the time.
Thorn noted that patterns in the stolen funds—such as the use of ThorChain to route 17 BTC to the online casino Duel—resemble prior attacks. However, he cautioned that the identification of victim addresses remains probabilistic, with uncertainties arising from corrections to initial data, including the removal of six addresses and 89 multisig wallets.
Coinkite is reportedly collaborating with law enforcement to trace those responsible, though no arrests or legal actions have been publicly announced. The firm has not confirmed whether the stolen BTC remains under attacker control, with some funds potentially having been moved or lost.
Written by Daniel Brooks
Security Desk
