New Coldcard Vulnerability Wave Threatens 389 Bitcoin as Galaxy Researcher Sounds Alarm

Galaxy's head of research Alex Thorn is flagging what appears to be a fourth consecutive attack targeting Coldcard hardware wallet users, with approximately 389 Bitcoin now in jeopardy across the affected wallets.

Here's what we're tracking: Thorn's analysis suggests that compromised Coldcard devices are leaving a critical window of vulnerability during the unconfirmed transaction phase. This timing gap could prove decisive for users looking to salvage their holdings before attackers move stolen funds to irreversible blockchain confirmations.

The Attack Pattern

This marks the latest in an escalating series of Coldcard compromises that's been capturing attention across the crypto security community. Each wave has demonstrated increasingly sophisticated methods to extract private keys from what's widely considered one of the most secure hardware wallet solutions on the market.

The 389 Bitcoin figure—currently worth tens of millions depending on market conditions—represents substantial capital at risk. For context, that's enough to make this one of the more significant hardware wallet security incidents we've seen recently.

The Unconfirmed Transaction Window

Thorn's critical insight centers on the mempool opportunity. Since these stolen Bitcoin transactions haven't yet been confirmed on-chain, affected users theoretically have time to intervene. The vulnerability appears to stem from how the Coldcard firmware is processing transaction validation, creating a narrow but real window for users to move their funds to safe addresses before attackers can lock them in via blockchain confirmation.

This is crucial because once a transaction confirms—typically within minutes—the blockchain becomes immutable. Funds moved to attacker-controlled addresses become nearly impossible to recover without the private keys.

What This Means for Portfolio Risk

If you're holding Bitcoin on a Coldcard, this warrants immediate attention. The research community is still investigating whether this represents a fundamental Coldcard vulnerability or whether it's limited to devices from specific manufacturing batches. Either way, the pattern of repeated attack waves suggests this isn't a one-off incident.

Galaxy's warning carries weight in crypto analysis circles. As institutional investors increasingly rely on hardware wallets for security, hardware-level compromises represent an underappreciated portfolio risk that doesn't get enough attention in most trading discussions.

The broader implication: even "cold storage" solutions require active monitoring. Your Bitcoin security posture can't be set-and-forget if attackers are actively targeting specific hardware platforms.

Thorn hasn't specified whether these compromises are firmware-level exploits, supply chain issues, or targeted attacks on specific users. The ambiguity itself is concerning—it means the root cause hasn't been definitively identified, which makes it harder to assess whether your particular Coldcard is at risk.