Galaxy Research has identified a third wave of sweeper attacks targeting Bitcoin cold wallets with weak keys. The campaign has now hit over 4,500 addresses, with cumulative losses approaching $89 million. The attackers are shifting tactics, going after smaller balances that may have been overlooked in earlier sweeps.
Third wave of sweeps
This isn't a new vulnerability. The attack exploits weak keys generated by Coldcard hardware wallets — a problem first flagged months ago. But the latest wave shows the attacker is still actively sweeping funds. Galaxy Research says the pattern of onchain collection has changed, suggesting the operator is adapting to avoid detection.
Attackers shift to smaller targets
Earlier sweeps focused on larger balances. Now the attacker is sweeping addresses with smaller amounts. That's a sign they're scraping the bottom of the barrel — or that they've automated the process to hit every vulnerable address they can find. Either way, the total number of affected addresses keeps climbing.
Weak keys and cold storage
The root cause traces back to Coldcard-generated keys that were not sufficiently random. Galaxy Research has been tracking the fallout since the first wave. The firm's analysts have repeatedly warned that any funds still sitting in those addresses are at risk. The third wave proves that warning was warranted.
Losses mount
At $89 million, the damage is already significant. But the attack isn't over. With 4,500 addresses compromised and the attacker still active, the final tally could go higher. The exchange and wallet providers affected have not issued a new statement this week.
The sweeps continue. No one knows when — or if — the attacker will stop.
