Bitcoin Siege: 4,500 Wallets, $89M Gone

A coordinated attack on Bitcoin cold-wallet infrastructure has now swept across 4,500 addresses, with total losses approaching $89 million, according to CoinDesk. Galaxy Research has identified what it describes as a third wave of fund sweeps, this time targeting smaller balances — a deliberate shift in tactics that suggests the attacker is systematically working down the value chain rather than moving on.

The vulnerability traces back to weak keys generated by Coldcard hardware wallets. Coldcard is among the most widely trusted cold-storage devices in the market, favored precisely by the kind of security-conscious holders who believed they had insulated themselves from exchange risk. The attacker has also changed the onchain collection method between waves, complicating tracing efforts and indicating a level of operational discipline that rules out an opportunistic amateur.

Coinbase and other major custodians have not been implicated, but the breach lands a direct blow at the self-custody argument — the idea that holding your own keys is the safest posture in crypto. Three waves of sweeps across nearly five thousand addresses suggests this is not a smash-and-grab. It is infrastructure predation.

Galaxy Research says the attacker is still active. No arrests have been reported. The investigation spans multiple jurisdictions.