Galaxy’s head of research said monitoring points to what appears to be a fourth organized attack tied to Coldcard, with similar transactions still sitting in the mempool awaiting confirmation. Previously confirmed transactions showed Replace-By-Fee, or RBF, enabled.
During blocks 960,778 through 960,792, roughly a 2.5-hour span, 218 transactions were recorded. Those transactions involved 462 victim addresses, 216 new destination addresses, and 388.92748828 BTC. The monitoring also found that none of the transactions used inputs older than the Coldcard firmware boundary.
The sweep rate during that window reached 13.8 per block, compared with 0.3 per block in the pre-incident comparison window, about 45 times higher. In terms of topology, the transactions followed a 1:1 pattern, with each victim address mapped to a new destination address. Only one destination address received two sweeps, and no consolidation address appeared. Some of the funds have already moved on to second-hop addresses.
Galaxy’s head of research said monitoring data suggests a fourth organized attack linked to Coldcard may be underway, with similar transactions still in the mempool waiting for confirmation. Previously confirmed transactions showed Replace-By-Fee, or RBF, enabled.
On-chain activity during the observed window
Across blocks 960,778 to 960,792, a period of about 2.5 hours, 218 transactions were identified. The activity involved 462 victim addresses, 216 new destination addresses, and 388.92748828 BTC. The monitoring further said that none of the transactions had inputs older than the Coldcard firmware boundary.
The sweep rate during that period came to 13.8 per block. In the comparison window before the incident, the rate was 0.3 per block, about 45 times lower.
Transaction topology
The transaction pattern was described as 1:1, meaning each victim address corresponded to one new destination address. Only one destination address received two sweeps, and no consolidation address was observed.
Some of the funds have already been swept to second-hop addresses.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
