Galaxy Research Director: Coldcard suspected to be facing the 4th round of organized attacks, 462 addresses affected

According to monitoring by Galaxy's research director, a suspected organized Coldcard attack is occurring, with similar transactions still waiting for confirmation in the mempool. Previously confirmed transactions show RBF enabled. During the period from block 960,778 to 960,792, 218 transactions occurred within approximately 2.5 hours, involving 462 victim addresses, 216 new destination addresses, and 388.92748828 BTC; all transactions had no inputs earlier than the Coldcard firmware boundary.

The clearing rate per block during this period was 13.8 times, compared to a pre-incident control window of 0.3 times per block, approximately 45 times higher. The transaction topology was 1:1, with each victim address corresponding to a new destination address, and only one destination address received two clearings, with no aggregation addresses appearing. Some funds have been cleared to second-hop addresses.