Fourth Coldcard BTC Theft Wave Drains 389 BTC in Coordinated Firmware Exploit

Woofun AI reports that a fourth apparent wave of thefts targeting Coldcard hardware wallet users has been identified by Alex Thorn, Head of Research at Galaxy Digital. This emerging threat vector represents a systematic exploitation of known vulnerabilities rather than isolated incidents, marking a significant escalation in the sophistication of attacks against self-custody solutions. The pattern of activity suggests a coordinated effort to drain funds from addresses compromised by previous firmware defects.

The operational metrics of this specific attack window reveal a highly efficient extraction mechanism. Within a compressed two-and-a-half-hour timeframe, a total of 388.93 BTC was transferred across the network. These movements were executed through 218 distinct transactions, originating from 462 victim addresses and consolidating into 216 newly created addresses. The precision and volume of these transfers indicate a pre-planned operation designed to maximize asset displacement before detection or intervention could occur.

Immediate mitigation strategies are now critical for users with pending transactions.

Woofun AI data shows that the current transaction frequency has spiked to approximately 45 times the normal rate, a clear indicator of a coordinated attack exploiting the mempool. Affected users are advised to utilize Replace-By-Fee (RBF) mechanisms to attach higher fees to their pending outputs. This action may allow legitimate transactions to override the malicious ones, potentially recovering funds that are currently stuck in the unconfirmed state.

The technical root cause of this vulnerability lies in flawed Coldcard firmware, specifically a defect in the random number generation process. All UTXOs involved in the current theft wave were created using this compromised firmware, which allowed attackers to derive private keys from public information. This is not an isolated error but a continuation of a severe security failure that previously resulted in the loss of 1,359.88 BTC. The recurrence of this exploit highlights a persistent gap in the device's cryptographic integrity.

The aftermath of the previous incident further complicates the current situation. In response to the earlier random number generation flaw, Coldcard issued an emergency firmware update intended to patch the vulnerability.

However, the remediation effort introduced new risks, as reports emerged that some devices were bricked and failed to boot after installation. This secondary failure added to the chaos and eroded user trust, demonstrating the high stakes involved in maintaining hardware security protocols.

This fourth wave underscores the persistent risks facing hardware wallet users, even those relying on devices marketed for their superior security. The incident serves as a stark reminder that no device is infallible and that the cryptographic foundation of any wallet must be rigorously verified. It raises critical questions about liability and the responsibility of manufacturers to ensure their products are secure by design. For the broader cryptocurrency community, this highlights the urgent need for rigorous security audits and timely firmware patches. The pattern of transactions and the speed of the attack suggest a sophisticated actor exploiting a known vulnerability, demanding constant vigilance from all participants in the ecosystem.