An unconfirmed transaction may be the single best chance some Coldcard holders have to get their funds out alive." That is the warning from Alex Thorn, Galaxy's head of research, as investigators piece together what appears to be the fourth wave of a coordinated attack on the hardware-wallet maker's users — a wave that has put roughly 389 bitcoin in the crosshairs.
| Metric | Value |
|---|---|
| BTC Price | $63,090 |
| BTC 24h Change | +0.60% |
| BTC 7d Change | -3.00% |
| BTC 24h Volume | $15.49B |
| BTC Market Cap | $1.27T |
| BTC Dominance | 56.3% |
Thorn's point turns on timing rather than luck. When a transaction is broadcast but not yet mined, the private key that signs it has already been used once. For a hardware wallet holding the compromised funds, that gap between broadcast and confirmation is a window in which a controlled move can still be made — before the attacker's own sweep lands. Market observers read the warning as a direct appeal to affected owners to act while the mempool still holds the opening, not to wait.
Tracing the fourth wave
The attack pattern is not new. Three prior waves have already hit Coldcard users, and this fourth campaign follows the same identifiable signature: wallets drained after their seeds or signing material were exposed, with funds consolidated and moved quickly. The figure of 389 bitcoin represents the scale attributed to this latest sweep, a number investigators are treating as the confirmed portion of the haul rather than a total.
What makes hardware-wallet thefts distinct is how little the broad market moves. The funds leave individual users' custody, not a single exchange hot wallet, so the drain does not show up as one dramatic spike in exchange outflow. Instead it shows up as a quiet redistribution across fresh addresses. Data from the wider market suggests this is an internal shuffle of stolen value rather than selling pressure aimed at the books — bitcoin's benchmark did not react to the discovery of the campaign.
How the timing matters
The fourth wave lands as bitcoin trades in a notably fragile stretch of its run.
| BTC price | $63,090 |
| BTC 24h change | +0.60% |
| BTC 7d change | -3.00% |
| BTC 24h volume | $15.49B |
| BTC market cap | $1.27T |
| BTC dominance | 56.3% |
CoinGecko data shows bitcoin down 3% on the week even as the total market holds at roughly $2.25 trillion in a 24-hour volume of $38.3 billion. In that setting, a 389-bitcoin theft is an incident for the victims and the wallet maker — roughly $24.5 million at current prices — rather than a macro event. The duration of the swing between broadcast and confirmation, and how quickly either the owner or the attacker wins that race, is what decides whether this window closes with funds recovered or lost.
Why the wallet maker is now the story
Thorn's intervention reframes the fourth wave from a victim-level crime into a product-level question. A hardware wallet is marketed on the premise that the private key never leaves the device; a series of waves hitting key material puts that core promise under scrutiny. Analysts at Galaxy frame the unconfirmed-transaction advice as a stopgap — a rescue path that buys time but does not repair whatever let the keys out in the first place.
The forward watchpoint is mechanical. If affected Coldcard owners succeed in racing their own unspent outputs to confirmation before the attacker's sweep, the drain on this wave stops at the 389 bitcoin already taken. If not, investigators expect the usual follow-through: the stolen funds consolidated, split across fresh wallets, and moved toward exchanges or mixers for laundering. The next concrete event that will settle the question is confirmation of those raced transactions — the hour, not the year.
For the wider bitcoin market, the takeaway is narrower than the headline. This is not a liquidity shock and not a price driver; it is a custody reminder that surfaced while the benchmark drifted through a soft week. The number that matters next is not $63,090 but whether Thorn's window has already shut.