Researchers Warn of New Bitcoin Wallet Attacks as 448 BTC Is Swept From Hundreds of Addresses

Days after the first wave of thefts on Coldcard wallets on Thursday, the users are now being warned of a new wave of coordinated attacks targeting Bitcoin wallets. Galaxy research head Alex Thorn warned that hundreds of transactions are impacting 709 potential victim addresses, moving 448.7 Bitcoin (BTC). According to Thorn, this activity takes place at an average rate of 13.8 sweeps per block, which is about 45 times the rate seen before the incident within the control period. 

Researcher Urges Users to Move Funds as New Wallet Sweeps Emerge

Transfers have mostly involved creating a new destination address for each victim instead of merging them into a central collection wallet. Thorn added that some of these funds have already swept into second-hop addresses. The researcher also stated that there are many transactions of the same kind in the mempool that are yet to be confirmed. The users affected by the attack who possess the private keys can broadcast a conflicting transaction with higher fees to move their funds to a safe wallet before confirmation of the malicious transaction.

In the post on X, Thorn stated, “These are LIKELY Coldcard victims — they match the shape of Coldcard vulnerable utxos and the elevated transaction pattern gives me high confidence they are another wave of attacks.” He also insisted, “Move your funds off Coldcard devices ASAP and use high TX fees.” 

The Coldcard incident happened last week, on a Friday, when 500 separate wallets, containing 584 Bitcoin, worth about $38 million (roughly Rs. 363 crore), were attacked and stolen. The attack was traced to a flaw in how Coldcard hardware wallets generated their keys. 1,324 chunks of BTC were moved across 500 transactions inside a three-block window. In response,  562 Bitcoin tokens were pooled into a single address that has not been moved. All of the emptied wallets were single-signature wallets containing more than 0.15 BTC. 

The first half of 2026 witnessed its highest tally of hacks, as the reports by on-chain security platform Blockaid show that crypto losses had hit $1 billion (roughly Rs. 9,531 crore). The two blockchain networks, Ethereum and Solana, experienced the biggest impact of attacks on their systems. While code exploitation caused Ethereum attacks, breaches of keys and signing infrastructure led to Solana losses.