₿ Crypto

Fourth Coldcard Attack Sweeps 389 Bitcoin; Users Warned to Act Fast

Galaxy's Alex Thorn warns of a fourth Coldcard attack wave that has already swept 389 BTC, urging users to monitor unconfirmed transactions for a chance to save funds amid the ongoing hardware wallet exploitation.

📅 August 3, 2026 🕐 1 min read

1 assets impacted (Crypto). Net bias: 0 Bullish, 1 Bearish, 0 Neutral. Strongest signal: BTC/USD ↓ 4/10 (60% confidence).

📊 Affected Assets (1)

BTC/USD

Bearish 🤖 60%

📅 Short-term 🌍 Global · Explicit

The article reports a security breach where 389 BTC were stolen from Coldcard wallets, with Galaxy's Thorn warning that unconfirmed transactions may allow some users to salvage funds. This directly impacts Bitcoin's security narrative and could prompt selling pressure if stolen coins are dumped on exchanges, or uncertainty if users lose confidence.

Catalysts

▼ Coldcard attack wave steals 389 BTC
▼ Thorn warns of narrow window to salvage funds via unconfirmed transactions

Risk Factors

▲ Stolen coins may not be sold immediately
▲ Coldcard may quickly patch vulnerability, restoring confidence

▼ Show FAQ (3) ▲ Hide FAQ

What does the Coldcard attack mean for Bitcoin's price?

The theft of 389 BTC could exert selling pressure if attackers dump coins on exchanges, though the amount is relatively small. More importantly, the security breach erodes trust in hardware wallets, potentially dampening investor sentiment in the short term.

Should Bitcoin holders worry about other hardware wallets?

While this attack targets Coldcard specifically, it raises concerns about the security of all self-custody solutions. Users should verify their transaction signatures and consider additional security measures regardless of wallet brand.

How can Bitcoin users protect against such attacks?

Thorn's warning emphasizes monitoring unconfirmed transactions and possibly using fee-bumping to outpace attackers. In general, users should keep firmware updated, verify receiving addresses, and avoid signing transactions on compromised devices.

🎯 Key Takeaways

Galaxy Digital researcher Alex Thorn flags a suspected fourth Coldcard attack wave that has already stolen 389 BTC.
Unconfirmed transactions currently offer a narrow escape for some Coldcard users to rescue their funds before theft finalization.
The attack method remains under investigation but appears to exploit a vulnerability specific to Coldcard's transaction signing process.
The incident underscores the risks of hardware wallet security, even for devices considered cold storage.
Users are advised to check their wallet's transaction status and possibly accelerate fee-bumping to outpace attackers.
The repeated attacks (now fourth wave) suggest a persistent threat actor targeting Coldcard users specifically.
Bitcoin's price may face short-term selling pressure if stolen coins are dumped on exchanges.

📝 Executive Summary

Galaxy research head Alex Thorn warned that unconfirmed transactions may give some Coldcard users a narrow opportunity to save their funds.

❓ FAQ

What happened in the Coldcard attack wave?

Galaxy Digital's Alex Thorn reported that a suspected fourth wave of attacks on Coldcard hardware wallets has resulted in the theft of 389 Bitcoin. The attackers are exploiting a vulnerability, and Thorn warned that unconfirmed transactions might give users a limited chance to save their funds.

How can Coldcard users protect themselves?

Thorn suggests that users with unconfirmed transactions may be able to salvage their Bitcoin by monitoring the network and possibly using fee-bumping techniques to accelerate confirmations before attackers can finalize the theft.

Why is this attack significant for Bitcoin security?

It highlights ongoing vulnerabilities in even the most trusted hardware wallets, raising concerns about the broader self-custody model and potentially eroding user confidence in storing large amounts of Bitcoin offline.

📰 Related Articles

🏷️ Tags

📰 Source

🔗 View Original Article