Coldcard wallet sweep nears $114M as RBF enables outbidding in mempool

A fourth Coldcard wallet sweep is underway. Researchers estimate the attacker has moved about 1,816 BTC (≈$114M) from 5,200+ addresses since July 30, and the activity is still ongoing. The key change is that the attacker appears to be using Bitcoin replace-by-fee (RBF). Because RBF can keep transactions in the mempool longer, victims may be able to outbid and move funds first by increasing fees—creating a short-term race dynamic in transaction ordering. The earlier waves are also confirmed in the timeline: 1,083 BTC across 1,196 addresses in 41 minutes on July 30, followed by weekend sweeps that bring observed losses to 1,367 BTC across 4,585 addresses. Latest clustering is seen in blocks around 960,778–960,792, with a faster sweep rate than a control window before the incident. Attribution points to a March 2021 Coldcard firmware issue where seed generation was routed to a predictable software randomizer instead of the chip hardware randomizer. Coinkite has released emergency firmware for impacted models (Mk3/Mk4/Mk5/Q) and advises users to move funds to addresses generated with fresh firmware, since previously generated seeds may remain exposed. For traders, watch mempool RBF fee spikes and potential downstream BTC exchange inflows if victims rush to reposition. This could add near-term volatility to BTC flows, but it is not expected to change longer-term fundamentals. (Keyword: Coldcard wallet sweep appears in title and is referenced in the body multiple times.)