Bitcoin Cold-Wallet Exploit Spreads to 4,500 Addresses

✦Key Takeaways

✦Market Analysis

A fast-moving Bitcoin security incident is widening, with Galaxy Research reporting a third wave of wallet sweeps linked to weak Coldcard-generated keys. What began as a concentrated series of thefts has now expanded to roughly 4,500 addresses, pushing estimated losses close to $89 million.

The latest phase of the attack suggests the actor is not simply draining high-value wallets and disappearing. Instead, the pattern indicates a more patient and adaptive strategy. According to the research note, the attacker is now pursuing smaller balances and changing the way funds are collected onchain, likely to improve operational efficiency and reduce obvious clustering signals.

That shift matters for two reasons. First, it shows the campaign is still active and evolving rather than contained. Second, it suggests that even modest-sized wallets can remain exposed once a key-generation flaw becomes public and exploitable. In practical terms, the attack is no longer only a headline risk for large holders; it has become a broad self-custody risk for ordinary Bitcoin users.