Days after the first wave of thefts on Coldcard wallets on Thursday, the users are now being warned of a new wave of coordinated attacks targeting Bitcoin wallets. Galaxy research head Alex Thorn warned that hundreds of transactions are impacting 709 potential victim addresses, moving 448.7 Bitcoin (BTC). According to Thorn, this activity takes place at an average rate of 13.8 sweeps per block, which is about 45 times the rate seen before the incident within the control period.
Researcher Urges Users to Move Funds as New Wallet Sweeps Emerge
Transfers have mostly involved creating a new destination address for each victim instead of merging them into a central collection wallet. Thorn added that some of these funds have already swept into second-hop addresses. The researcher also stated that there are many transactions of the same kind in the mempool that are yet to be confirmed. The users affected by the attack who possess the private keys can broadcast a conflicting transaction with higher fees to move their funds to a safe wallet before confirmation of the malicious transaction.
In the post on X, Thorn stated, “These are LIKELY Coldcard victims — they match the shape of Coldcard vulnerable utxos and the elevated transaction pattern gives me high confidence they are another wave of attacks.” He also insisted, “Move your funds off Coldcard devices ASAP and use high TX fees.”
The Coldcard incident happened last week, on a Friday, when 500 separate wallets, containing 584 Bitcoin, worth about $38 million (roughly Rs. 363 crore), were attacked and stolen. The attack was traced to a flaw in how Coldcard hardware wallets generated their keys. 1,324 chunks of BTC were moved across 500 transactions inside a three-block window. In response, 562 Bitcoin tokens were pooled into a single address that has not been moved. All of the emptied wallets were single-signature wallets containing more than 0.15 BTC.
The first half of 2026 witnessed its highest tally of hacks, as the reports by on-chain security platform Blockaid show that crypto losses had hit $1 billion (roughly Rs. 9,531 crore). The two blockchain networks, Ethereum and Solana, experienced the biggest impact of attacks on their systems. While code exploitation caused Ethereum attacks, breaches of keys and signing infrastructure led to Solana losses.
Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.
