Galaxy Research: Suspected Fourth Organized Coldcard Attack Hits 462 Addresses

ChainCatcher reports that Galaxy's head of research says signs point to a coordinated Coldcard-related attack, with additional similar transactions still waiting in the mempool. Previously confirmed transactions indicate replace-by-fee (RBF) was enabled. On-chain data from blocks 960,778 to 960,792 shows that over roughly 2.5 hours, 218 transactions moved 388.92748828 BTC. The activity involved 462 compromised addresses and 216 newly created destination addresses. All transactions shared a notable constraint: none included inputs older than the Coldcard firmware boundary. During the window, the average "cleaning" pace reached 13.8 transactions per block, versus a pre-incident baseline of 0.3 per block, a roughly 45x jump. The transaction pattern was largely 1:1, with each compromised address sweeping to a single new destination address. Only one destination address received two sweeps, and there were no signs of aggregation addresses. Some of the funds have already been moved onward to second-hop addresses.