Galaxy Research head Alex Thorn says a suspected fourth attack wave targeting Coldcard users may have swept 389 Bitcoin, though unconfirmed transactions could still offer some holders a narrow chance to protect funds. The incident highlights growing operational-security risks for self-custody Bitcoin users.
✦Key Takeaways
✓- A suspected fourth wave of attacks targeting Coldcard users may have exposed as much as 389 BTC.
✓- Galaxy Research head Alex Thorn warned that users with unconfirmed transactions may still have a brief window to recover or move funds.
✓- The incident underscores how self-custody security remains a critical risk area in Bitcoin, even for experienced users.
✓- While the market impact is likely limited in the short term, the episode could renew demand for stronger wallet hygiene, transaction monitoring, and backup practices.
✦Market Analysis
A new security scare is rippling through the Bitcoin self-custody community after Galaxy Research head Alex Thorn flagged what appears to be a fourth attack wave aimed at Coldcard wallet users. According to Thorn, the suspected campaign may have swept up 389 Bitcoin, raising fresh concerns about the safety of funds held in hardware wallets when operational security is compromised.
Coldcard is widely regarded as one of the more security-focused Bitcoin hardware wallets, often used by advanced holders who prioritize offline key storage and air-gapped protection. But the latest warning serves as a reminder that even strong hardware security can be undermined by
This intelligence report is generated and verified by the Squaby Algorithmic Fact-Checking Engine without manual human intervention. It strictly isolates on-chain risk vectors, market liquidity data, and OSINT sentiment streams. All data is processed for institutional clarity and educational purposes only. This content does not constitute financial or investment advice.
transaction timing, address reuse, malicious software, or compromised user workflows
.
The most important nuance in Thorn’s warning is the mention of unconfirmed transactions. In Bitcoin, a transaction that has not yet been included in a block can sometimes be replaced, accelerated, or otherwise acted upon depending on the wallet setup and network conditions. That means some affected users may still have a narrow opportunity to protect their coins if they respond quickly.
From a market perspective, the event is not likely to move Bitcoin’s price on its own. However, it does reinforce a broader narrative that continues to shape investor behavior: custody risk is as important as market risk. For long-term holders, the story is less about protocol failure and more about the human and operational vulnerabilities that surround self-custody.
Episodes like this can also influence wallet adoption trends. Some users may become more cautious about advanced self-custody setups, while others may double down on best practices such as:
✓- verifying wallet firmware and device integrity,
✓- avoiding address reuse,
✓- using clean signing environments,
✓- monitoring mempool activity,
✓- and maintaining secure recovery procedures.
In the broader Bitcoin ecosystem, such incidents often trigger renewed discussion around wallet design, user education, and the tradeoff between convenience and security. For institutions and high-value holders, the takeaway is clear: hardware wallets reduce risk, but they do not eliminate it.
✦What's Next
The key question now is whether the suspected attack wave is fully contained and how many users may still be able to respond before their transactions settle on-chain. If the warning proves accurate, investigators and wallet providers may face pressure to publish clearer guidance for affected users.
Going forward, the incident could accelerate interest in more robust self-custody practices, including multi-signature setups and improved transaction verification workflows. For the Bitcoin market, the immediate price effect may be muted, but the long-term impact could be meaningful if the episode pushes more users to treat wallet security as a first-class investment priority.
As the situation develops, traders and holders alike will be watching for confirmation of the scale of the attack, any official response from Coldcard or related security teams, and whether additional victims are identified.