Galaxy Research Head Reports Suspected Fourth Coldcard Organized Attack, 462 Addresses Affected

ChainCatcher report: According to Galaxy’s research lead, an organized Coldcard attack appears to be underway, with similar transactions still pending in the mempool. Confirmed prior transactions show RBF has been enabled. Between blocks 960,778 and 960,792, over a 2.5-hour period, 218 transactions occurred, involving 462 compromised addresses, 216 new destination addresses, and 388.92748828 BTC; all transactions contained no inputs older than the Coldcard firmware boundary. The cleaning rate during this period averaged 13.8 transactions per block, compared to 0.3 per block in the pre-incident baseline—a 45-fold increase. The transaction topology is 1:1, with each compromised address mapping to one new destination address; only one destination address received two sweeps, and no aggregation addresses were observed. Some funds have already been swept to second-hop addresses.