Alex Thorn, Head of Galaxy Digital Research, reported that a 4th theft attack targeting Coldcard hardware wallet users appears to be underway. He stated that over the past approximately 2 hours and 30 minutes, a pattern has been observed where a total of 388.93 BTC was transferred from 462 affected addresses to 216 new addresses across 218 transactions. He also mentioned that some transactions are still in the Mempool, suggesting users might be able to protect their funds by setting a higher fee with RBF (Replace-By-Fee). Furthermore, he explained that all UTXOs used in these transactions were generated from faulty Coldcard firmware, and the transaction frequency is about 45 times higher than before the incident, making it highly likely to be an additional attack. Meanwhile, Coldcard previously experienced a theft incident involving over 1,359.88 BTC due to a random number generation flaw, and the urgently distributed firmware also reported instances of some devices failing to boot, or being "bricked."
