388.93 BTC involved in suspected fourth wave of Coldcard attacks, 462 addresses affected

Odaily Planet Daily reports, according to Galaxy’s research lead, an organized Coldcard attack appears to be underway, with similar transactions still pending confirmation in the mempool. Confirmed transactions previously detected show RBF activation. Between blocks 960,778 and 960,792, over a 2.5-hour period, 218 transactions occurred, involving 462 victim addresses, 216 new destination addresses, and 388.92748828 BTC; all transactions had no inputs older than the Coldcard firmware boundary. The sweep rate during this period averaged 13.8 sweeps per block, compared to 0.3 sweeps per block in the pre-incident control window—approximately a 45-fold increase. The transaction topology is 1:1, with each victim address corresponding to one new destination address; only one destination address received two sweeps, and no aggregation addresses were observed. Some funds have already been swept to second-hop addresses.