Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Coldcard wallet hit a new round of attacks, with 389 bitcoins stolen from 462 addresses
This week, thefts have increased significantly with another round of coordinated attacks targeting users of hardware wallet brand Coldcard, a hardware wallet designed specifically for Bitcoin storage. Galaxy research director Alex Thorne reported that in the latest wave of attacks, attackers targeted 462 potential victim addresses, executed 218 transactions, and transferred a total of 388.9 bitcoins. He emphasized that the frequency of these thefts has increased sharply, with the latest activity averaging 13.8 cleanups per block, about 45 times higher than the control period before the incident.
Each transfer typically transfers stolen funds directly to a newly created address rather than remitted to a single collection address, making it more difficult to track total losses or integrate affected funds. Thorne also pointed out that some of the stolen assets have been further moved to other addresses (known as "second hop" wallets), making tracking clues more complex.
Small Dictionary: Coldcard is a Bitcoin hardware wallet developed by Coinkite. It is known for its security features and offline key management, designed to protect users 'cryptocurrency from online threats.
Many of these transactions have not yet been confirmed on the Bitcoin blockchain, and similar activity is still visible in the network's mempool of unconfirmed transactions. Based on unique technological traces and frequency, these patterns of theft show distinctive characteristics associated with Coldcard wallets.
Comparison of the latest attack wave and pre-attack control period data
Affected addresses: The latest attack wave is 462, and the pre-attack comparison period is not specified.
Number of transactions: the latest attack wave is 218, and the pre-attack comparison period is significantly lower.
Transfer Bitcoin: the latest attack wave is 388.9 BTC, and the pre-attack comparison period is very small.
Cleanup per block: The latest wave of attacks was 13.8 and the pre-attack control period was approximately 0.3.
Potential further losses and recommended measures
Thorne commented that if affected users 'transactions have not yet been confirmed, they still have a chance to protect their funds. He suggested that victims who still have control of the key could try broadcasting an alternative transaction with a higher fee, thereby moving Bitcoin into a secure wallet before the offender's transaction is packed into a block by the miners. "These are likely victims of Coldcard-they are consistent with Coldcard's fragile UTXO pattern, and the abnormal trading pattern leaves me highly convinced that this is another round of attacks," Thorne said.
This ongoing round of thefts follows the previous wave of attacks that began last Thursday. Analysts warned that the risk remains high for users who still hold uncompromised keys but are in fragile wallet settings. Some recent estimates suggest that total losses related to the Coldcard vulnerability have reached as high as $70 million.
