A fourth wave of Bitcoin sweeps tied to the Coldcard hardware wallet vulnerability started early Monday and remained active for several hours. This latest wave, however, has a key difference: researchers say affected transactions can still potentially be canceled or replaced because they have not yet been confirmed.

Alex Thorn, head of firmwide research at Galaxy Research, detected the ongoing activity and explained that the attackers used Bitcoin’s replace-by-fee (RBF) feature. RBF allows users to replace a pending transaction with another one that includes a higher fee. This gives victims who identify their wallet address in the mempool — Bitcoin’s pool of unconfirmed transactions — a limited chance to submit a competing transaction and move their funds before the attacker’s transfer is processed.

The initial Coldcard-related attack began on July 30, when hackers removed 1,083 BTC from 1,196 addresses within approximately 41 minutes. Two additional attack waves over the weekend increased the total confirmed losses to 1,367 BTC across 4,585 addresses.

The security failure originated from a March 2021 Coldcard firmware issue that affected the wallet’s seed generation process. Instead of using the device’s hardware-based random number generator, certain versions relied on a predictable software-based randomizer, making it possible for attackers to recreate wallet keys offline after identifying vulnerable seeds.

Coldcard developer Coinkite responded by issuing emergency firmware updates for affected devices. The company advised users who generated wallet seeds while running vulnerable firmware to create new wallets with fresh seeds and transfer their holdings immediately.

Thorn noted that he had not received direct reports from affected users and that his findings were based on blockchain analysis and transaction patterns. He said he shared the information quickly because some attacker transactions were still pending, leaving a window for users to respond.

If the fourth wave is confirmed, the combined losses from all attack rounds could reach about 1,816 BTC, valued at nearly $114 million, affecting more than 5,200 wallet addresses since the attacks began on July 30.

Thorn urged users with potentially affected wallets to verify their holdings, move funds away from compromised devices, and use higher transaction fees where possible to increase the chance of their replacement transactions being confirmed first.

The latest sweep activity was observed between blocks 960,778 and 960,792, involving 218 transactions that targeted 462 victim addresses. Researchers recorded about 14 sweeps per block, compared with only 0.3 sweeps per block during a normal comparison period before the incident, representing an increase of roughly 45 times.

Blockchain analysts found that the affected BTC came from wallets created after the vulnerable Coldcard firmware period, while the destination addresses were newly generated and had no previous activity. Unlike earlier attack waves that used common collection addresses and were easier to monitor, the latest transfers appeared to send funds to separate addresses assigned to individual victims.

None of the first three attack waves involved multisignature wallets, supporting the view that the flaw mainly affected single-key wallet seeds. Analysts also identified six destination addresses with older transaction histories, suggesting that some receiving addresses were not newly created by the attacker.