A widening attack tied to weak Coldcard-generated keys has now spread to about 4,500 bitcoin addresses, with total losses approaching $89 million. The latest update points to a growing campaign that continues to drain affected wallets rather than a one-off incident.
Galaxy Research identified a third wave of sweeps early Sunday, reporting that the attacker was still moving funds out of vulnerable addresses. The newest activity reportedly drained roughly 208 bitcoin, adding to earlier losses and pushing the overall damage closer to the $89 million mark.
The pattern of theft also appears to be shifting. After targeting larger holdings, the attacker is now emptying wallets with balances worth only a few thousand dollars, suggesting the operation is expanding deeper into the pool of exposed addresses.
Researchers also noted a change in how the stolen funds are being gathered onchain. While the exact mechanics were not detailed in the available report, the adjustment indicates the attacker is continuing to adapt the collection process as the sweeps continue.
