Coldcard Wallet Exploit Losses May Approach $114M Amid Possible Fourth Sweep

Losses linked to a Coldcard hardware wallet vulnerability could be approaching $114 million as signs of a potential fourth fund sweep have emerged. The attacker appears to be using replace-by-fee (RBF) transactions, which allow higher-fee transactions to replace pending ones in the mempool. This technique gives affected users only a narrow window of minutes to counter the sweep by broadcasting their own higher-fee transaction. Victims who spot their wallet address in the mempool may still have a chance to recover funds by acting quickly. The incident highlights ongoing security risks associated with hardware wallet infrastructure.