A suspected fourth wave of attacks targeting Coldcard hardware wallet users has drained an estimated 448 Bitcoin, according to Galaxy Digital research head Alex Thorn, who cautioned that pending transactions may still offer some victims a slim window to rescue their holdings.
What Thorn Observed
Thorn flagged the apparent attack wave publicly, pointing to a cluster of suspicious movements from wallets associated with Coldcard devices. The estimated haul of 448 BTC represents a substantial sum, underscoring the scale of the ongoing campaign against holders of the popular cold-storage hardware.
Crucially, Thorn noted that some of the fraudulent transfers remained unconfirmed at the time of his warning. Because Bitcoin transactions must be included in a block before they are irreversible, those still sitting in the mempool are not yet final, which theoretically leaves a narrow opening for affected users to act.
Unconfirmed transactions may hand some Coldcard users a fleeting chance to claw back their Bitcoin before it's gone for good.
Why Timing Matters
The mempool is the waiting area where broadcast transactions sit before miners confirm them. For victims who spot suspicious activity quickly, the unconfirmed status of a theft attempt can be the difference between recovery and permanent loss. Once a transaction is mined into a block and confirmed, the funds are effectively unrecoverable.
Users who suspect their devices or seed phrases have been compromised are generally advised to move remaining funds to a fresh, secure wallet as fast as possible, ideally using higher fees to outrace any pending malicious transactions.
Guarding Against Hardware Wallet Threats
The reported incidents highlight recurring risks facing hardware wallet owners, even when using devices marketed for their security. Attackers often rely on compromised seed phrases, tampered firmware, or social-engineering tactics rather than breaking the hardware itself.
To reduce exposure, security researchers commonly recommend the following precautions:
- Never enter or store a seed phrase digitally or share it with anyone.
- Verify firmware and purchase devices only from official sources.
- Confirm receiving and sending addresses directly on the device screen.
- Move funds immediately if compromise is suspected, using elevated fees.
As the situation develops, Coldcard users are being urged to monitor their wallets closely