388.93 BTC stolen in suspected fourth wave of Coldcard attacks affecting 462 addresses

ME News reports that on August 3 (UTC+8), according to monitoring by Galaxy’s Research Lead, an organized Coldcard attack appears to be underway, with similar transactions still pending confirmation in the mempool. Confirmed prior transactions show RBF has been enabled. Between blocks 960,778 and 960,792, over a 2.5-hour period, 218 transactions occurred, involving 462 compromised addresses, 216 new destination addresses, and 388.92748828 BTC. All transactions contained no inputs older than the Coldcard firmware boundary. The sweep rate during this period was 13.8 per block, compared to 0.3 per block in the pre-incident baseline—a 45-fold increase. The transaction topology is 1:1, with each compromised address mapping to one new destination address; only one destination address received two sweeps, and no aggregation addresses were observed. Some funds have already been swept to second-hop addresses. (Source: ODAILY)