Man this Coldcard situation is only getting worse.. wallets are still being drained in waves, and the scariest part is that many of the owners probably have no idea that they’re exposed. the latest tally being shared now puts the damage at roughly 1,367 BTC across 4,585 addresses in three waves. Galaxy had already traced 1,082.65 BTC disappearing in just 41 minutes during the first wave. addresses don’t equal individual users, but the pattern is clear: the attacker didn’t sweep once and leave. they’re returning in batches. probably these are mostly long-term holders who did what everyone told them to do: generate the seed, put the device and backup somewhere safe, then stop touching it. and imo draining can continue. the attacker may already know which addresses were created from the weak seed pattern. now it’s simply a race between them sweeping those wallets and the owners realising they need to move. and also updating the firmware alone won’t save an old wallet.. thats what makes this situation so scary and also the firmware can fix how new seeds are generated. it cannot go back and make an existing weak seed stronger.