Fourth Coldcard Wallet Attack Pushes Estimated Bitcoin Losses Near $114 Million

Update, October 22, 2026: Coinkite's security advisory confirms that a firmware bug weakened seeds generated on Coldcard Mk2 and Mk3 firmware 4.0.1 through 4.1.9, Mk4 and Mk5 firmware before 5.6.0, and Q firmware before 1.5.0Q (Edge releases before 6.6.0X and 6.6.0QX). Updating the firmware does not fix an existing seed. Affected users need to generate a new seed on fixed firmware and move their funds, including any multisig setup that uses an affected key. Follow Coinkite's migration guide. Loss figures in this article are third-party estimates; Coinkite has not published a total.

>

Correction: An earlier version of this article said the pattern of attacks suggested the flaw was limited to single-key wallets, and described the root cause as a confirmed switch to a software random-number generator. Coinkite says multisig setups with an affected key should also be migrated, and it has not published a root cause; both passages have been corrected.

!coldcard wallet hack

• A fourth wave of thefts from Coldcard-generated bitcoin addresses has pushed estimated cumulative losses to roughly 1,816 BTC, near $114 million, since July 30, according to on-chain researchers.
• Unlike the first three waves, Monday’s transactions used bitcoin’s replace-by-fee feature, giving victims who spot their address in the mempool a short window to move funds before the attacker’s transaction confirms.
• Coinkite says a firmware bug weakened seeds generated on affected Coldcard firmware, going back to March 2021 on the Mk2 and Mk3. It has released fixed firmware and is urging affected users to move funds to a freshly generated seed.

Bitcoin wallets built on Coldcard hardware are being drained for a fourth time since Thursday, with researchers now estimating total losses close to $114 million.

A Fourth Wave With a Different Signature

Alex Thorn, head of firmwide research at Galaxy Research, flagged the new wave early Monday after spotting 218 transactions hit 462 addresses at roughly 14 sweeps per block, about 45 times the rate seen before the incident began. He had no direct victim report and chose speed over confirmation to warn holders while transactions were still unconfirmed.

This wave looks different from the first three. The attacker opted into a Bitcoin feature that allows a pending transaction to be overwritten by a later one paying a higher fee. Until a transaction confirms, anyone who spots their own address in the mempool, the queue of unconfirmed transfers, can broadcast a competing transaction with a higher fee and move their coins out first. Thorn urged affected users to check their funds and bid the fee up if targeted.

So far the sweeps have hit single-key wallets: none of the four waves has touched multisignature setups. That reflects what attackers have targeted, not a limit of the bug. Coinkite says any multisig setup that includes a key generated on affected firmware should also be migrated. The destination addresses this round were freshly generated rather than the shared collector wallets that made earlier waves easier to trace.

What It Means for Wallet Security and the Market

Coinkite’s advisory says a firmware bug weakened seed generation, leaving affected keys reproducible offline. On the Mk2 and Mk3 the affected firmware dates back to March 2021. The company says its investigation is ongoing and a formal technical review will follow.

Coinkite has released corrected firmware for every affected model and says updating alone does not protect existing funds. Anyone who generated a seed on the flawed software needs to move their coins to a wallet built on a new one, since the old keys remain compromised regardless of the firmware version now running on the device.

For the market, the episode adds to a summer already marked by hardware-wallet distrust rather than moving bitcoin’s price on its own. Coldcard-linked losses have climbed in stages since Thursday without triggering the kind of panic selling seen after past custody failures, but each new wave chips away at confidence in cold storage as the default safe option, a dynamic worth watching if it starts nudging smaller holders back toward exchange custody.

Source:

Galaxy Research (Alex Thorn): X post flagging the fourth wave

Coinkite: Coldcard security advisory

Related reading

• Analysts Flag Security Gaps in Standard Chartered-Backed Stablecoin
• Metaplanet Denies Bitcoin Sale, Unveils BitBonds Program
• Could Ripple’s Own Stablecoin Undercut Demand for XRP?
• Binance bStocks Passes xStocks in Tokenized Stocks Race