A cluster identified as a likely second wave of the Coldcard wallet attack moved 388.9 BTC, while some unconfirmed transactions still left affected users a brief chance to redirect their funds.
Key Takeaways
- The transferred amount was worth approximately $24.4 million.
- Some unconfirmed transactions may still be replaceable through RBF.
- Part of the Bitcoin has already reached second-hop addresses.
Alex Thorn, Galaxy Digital’s Managing Director and Head of Firmwide Research, reported what he described as a likely another wave targeting Coldcard wallet users at around 1:00 UTC on August 3 – just days after the first wave was reviewed.
Thorn’s onchain review covered Bitcoin blocks 960,778 through 960,792, spanning approximately two and a half hours of activity that was still continuing when he published the findings.
The cluster contained 218 transactions involving 462 suspected victim addresses and 216 previously unused destination addresses. Together, they moved 388.92748828 BTC.
With Bitcoin trading near $62,700 at the time of writing, the amount was worth approximately $24.4 million.
The figure measures suspected transfers rather than confirmed, irrecoverable losses. Some transactions were still waiting in Bitcoin’s mempool, and the Coldcard attribution was based on Thorn’s onchain analysis rather than a completed investigation by Coinkite or law enforcement.
🚨 LIKELY 4TH ORGANIZED WAVE COLDCARD ATTACK OCCURRING RIGHT NOW
THERE ARE STILL SIMILAR TXS IN THE MEMPOOL WAITING TO BE CONFIRMED AND THE PREVIOUSLY-CONFIRMED TXS SIGNAL RBF OPT-IN, CHECK YOUR FUNDS AND YOU MAY BE ABLE TO RBF YOUR WAY OUT OF THIS
pattern identified:
blocks…— Alex Thorn (@intangiblecoins) August 3, 2026
The Pattern Matched the Earlier Coldcard Incident
Thorn recorded approximately 13.8 suspected sweeps per Bitcoin block, compared with 0.3 per block during a control period before the incident. The observed rate was therefore around 45 times higher than normal.
The input history also matched the earlier suspected Coldcard activity. According to Thorn, none of the transaction inputs predated the firmware boundary associated with the vulnerability.
The destination pattern was similarly consistent. Almost every transaction sent funds to a separate, newly created address, with only one destination receiving two sweeps.
Rather than consolidating the Bitcoin immediately into one collection wallet, the transactions distributed it across hundreds of fresh addresses, making the cluster less obvious at a glance.
Taken together, the sharp increase in sweeps, the matching input history and the repeated use of fresh destinations led Thorn to attribute the activity to another wave of Coldcard victims. The analysis did not identify who controlled the receiving addresses or how many individual users were affected.
Some Pending Transactions May Still Be Replaceable
The 388.9 BTC total includes transactions that had already confirmed and others that were still waiting in the mempool.
The mempool is where valid Bitcoin transactions remain until a miner includes them in a block. An unconfirmed transaction may still be replaceable when it signals Replace-by-Fee, commonly known as RBF.
Thorn said the confirmed transactions in the cluster had signalled RBF before entering a block. Similar transactions still waiting for confirmation may use the same setting.
Bitcoin’s RBF mechanism allows an unconfirmed transaction to be replaced by another transaction spending the same coins with a higher fee.
An affected owner who still controls the relevant private keys may therefore be able to redirect the Bitcoin to a secure wallet by issuing a valid replacement with a higher fee than the attacker’s transaction.
Recovery is not guaranteed. The replacement must satisfy Bitcoin’s transaction policies, the attacker may also increase the fee, and the opportunity ends once the unauthorized transaction is confirmed.
Second-Hop Transfers Close the RBF Window
Thorn found that some of the Bitcoin had already moved from the initial destination addresses into second-hop wallets.
A first-hop address receives the original sweep. A second hop occurs when the Bitcoin is transferred again to another address.
That movement shows that the original sweep has already confirmed, removing the possibility of replacing it through RBF. Replace-by-Fee can compete with a transaction in the mempool, but it cannot reverse one already recorded on the blockchain.
The Bitcoin remains traceable onchain, although further transfers can divide it among additional addresses, combine it with other funds or move it toward exchanges and other services. Recovery may then depend on identifying those services and obtaining cooperation from their operators or law-enforcement authorities.
What Coldcard Users Should Do Now
Thorn urged users to act quickly:
MOVE YOUR FUNDS OFF COLDCARD DEVICES ASAP AND USE HIGH TX FEES.
Users should first review their transaction history for outgoing payments they did not authorize.
If a suspicious transaction remains unconfirmed and is marked as replaceable, the owner may still be able to issue a higher-fee transaction sending the same Bitcoin to a secure wallet. Anyone unfamiliar with the process should seek urgent assistance from a trusted Bitcoin security professional rather than experimenting with the affected funds.
Any remaining Bitcoin should be transferred to a new wallet created with fresh security credentials. Moving funds to another address generated from the same potentially compromised seed would not remove the underlying risk.
Users should never provide a seed phrase, private key, wallet backup or PIN to anyone offering recovery assistance. Those secrets are not required to inspect a public transaction or determine whether it remains unconfirmed.
If an unauthorized transaction has already confirmed, users should preserve the transaction ID, wallet records and relevant device information for tracing, reporting and any later investigation.
- Security warning: Never provide a seed phrase, private key, wallet backup or PIN to anyone offering recovery assistance. Users facing an unconfirmed unauthorized transaction should seek urgent help from a trusted Bitcoin security professional.
- Methodology: The article uses Alex Thorn’s August 3, 2026 onchain analysis covering Bitcoin blocks 960,778 through 960,792. The dollar estimate multiplies 388.92748828 BTC by the stated Bitcoin price of $62,700. The wave attribution represents Thorn’s assessment and should not be treated as a final finding from Coinkite, law enforcement or an independent forensic investigation.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP.
Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem.
To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem.
His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
Be the first to comment