Fourth Coldcard sweep is running live, with estimated losses near $114 million

A fourth wave of bitcoin sweeps from addresses generated by Coldcard hardware wallets began early Monday and was still running hours later, according to Alex Thorn, head of firmwide research at Galaxy Research, whose findings CoinDesk reported. Thorn's estimate puts the running total across all four waves at about 1,816 BTC — roughly $114 million at the $62,702 price CoinDesk quoted — taken from more than 5,200 addresses since July 30.

The distinguishing feature of this wave is that it is, for the moment, reversible. Thorn said the attacker opted into replace-by-fee, the Bitcoin feature that lets an unconfirmed transaction be overwritten by a later one paying a higher fee. A victim who spots their address sitting in the mempool can outbid the attacker and move the coins first — a window measured in minutes, not hours.

The root cause is not new. Per CoinDesk, a March 2021 Coldcard firmware build routed seed generation to a predictable software randomizer rather than the secure chip's hardware source, leaving the resulting private keys reproducible offline by anyone who works out the range. Coinkite, which makes Coldcard, has shipped emergency firmware for every affected model and told anyone who generated a seed on the flawed build to move funds to an address made with a fresh one. Reinstalling firmware does not fix an already-compromised seed.

Key facts

• Wave one, July 30: 1,083 BTC from 1,196 addresses in 41 minutes (Thorn, via CoinDesk).
• Two weekend waves brought observed losses to 1,367 BTC across 4,585 addresses (same).
• Wave four covered blocks 960,778–960,792: 218 transactions against 462 addresses, about 14 sweeps per block versus 0.3 in a pre-incident control window — roughly 45× normal (Thorn's pattern analysis, via CoinDesk).
• Running four-wave estimate: ~1,816 BTC, near $114 million, 5,200+ addresses (same).
• BTC quoted at $62,702.17; a separate CoinDesk headline noted bitcoin slipping under $63,000 as the losses "rattled" the market.
• No multisig setups were touched in the first three waves, consistent with the flaw affecting single-key seeds only.

The real-world read

Thorn is explicit that he has no direct victim report and published on pattern matching alone, choosing speed over confirmation while the transactions were still overridable. That is a defensible call, and it means the $114 million is an estimate, not a confirmed loss. Two things in the same reporting don't reconcile: 4,585 addresses plus wave four's 462 is 5,047, not "more than 5,200," and CoinDesk's own headline list still describes an "$89 million Coldcard exploit" from the three earlier waves. Thorn also flagged six destination addresses with years of prior history — impossible for a freshly generated attacker address — meaning his own filter has known false positives. Unlike the first two waves, this one sends to one fresh address per victim rather than shared collectors, which makes tracing harder and independent verification slower. Coinkite has not, so far, put a number on affected devices. Separately, a Binance "case study" ran alongside the coverage on CoinDesk; it is exchange marketing, not reporting, and has nothing to do with this story.

Opinion, and whose

Thorn's advice — check funds, move anything off an affected device, bid the fee up — is his, offered as incident triage while the mempool window is open, not as a market view. The characterization that the losses "rattled" bitcoin's price is CoinDesk's framing; no causal evidence for the move under $63,000 was presented.

Sources

• CoinDesk (Tier 2, secondary), 3 August 2026, "Coldcard wallet losses may near $114 million as possible fourth sweep emerges" — all figures, wave timeline, block range, firmware history and Coinkite's response. CoinDesk cites Alex Thorn of Galaxy Research as the sole named source for the sweep analysis.
• CoinDesk headline index — the earlier "$89 million" framing and the sub-$63,000 price note, used here only to show the discrepancy.
• Binance-sponsored "Evolution of the Crypto CEX Landscape" unit — marketing, carried on the same page. Not used as a source.

Nothing here is financial advice.