A third wave of bitcoin sweeps targeting Coldcard hardware wallet users has been detected, bringing the total stolen to 1,367 BTC. Galaxy Research disclosed the incident on X, noting that roughly 4,585 addresses have been affected across three separate sweeps.
What the on-chain data shows
Analysts observed deposits to exchanges and activity from long-dormant wallets as additional signals. The sweeps appear to be ongoing, with the latest batch hitting addresses that had not moved funds in previous waves.
How Coldcard users are affected
Coldcard is a popular hardware wallet known for its security features. The sweeps suggest that private keys may have been compromised, though the exact vector has not been publicly confirmed. Users are advised to check their addresses and move funds if they suspect exposure.
Ongoing investigation
Galaxy Research has not yet released a full post-mortem. The exchange deposits flagged in the data could indicate that the attacker is attempting to cash out. Affected users and exchanges are likely coordinating to freeze or trace the stolen coins.
