A new wave of coordinated thefts targeting Coldcard Bitcoin hardware wallets has moved nearly 389 BTC from about 709 addresses, according to Galaxy research head Alex Thorn.

The incidents follow a previously undetected firmware flaw that reduces seed entropy in Coldcard devices, making the wallets vulnerable.

Thorn said the transactions involved 448.7 BTC moving across 709 potential victim addresses, with an average of 13.8 sweeps per block, roughly 45 times the rate seen before the attacks. Each victim’s funds were sent to a fresh destination rather than a single collection wallet, and some transfers were routed through second‑hop addresses. Thorn noted that thousands of wallets may be affected and that the total value stolen is estimated at more than $90 million. Users who control the relevant private keys can broadcast a higher‑fee conflicting transaction to move their funds before the attacker’s transaction is confirmed.

The thefts remain unresolved, and the firmware vulnerability has not yet been patched, leaving thousands of wallets potentially at risk.