Alex Thorn: Coldcard Attacks Ongoing, More Small Imitators Emerging
Galaxy Research Director Alex Thorn stated that the attacks surrounding the Coldcard wallet are still ongoing, with more small attackers and imitators emerging, targeting the remaining Coldcard mnemonic phrases.
He assisted in confirming the identity of a deposit user involved in the attack, noting that the relevant funds were transferred out before they could be frozen on the Duel platform, and these funds were not part of the three major waves of attacks previously identified by Galaxy Research.
In the Bitcoin security market, the imitation behavior following the main attack wave extends the risk window, accelerating the migration of funds from affected addresses; trust in hardware wallets is further pressured, while demand for on-chain tracking and freezing services is rising, leaving un-migrated users continuously exposed.
Source: Public Information
ABAB AI Insight
Alex Thorn leads Galaxy Research in continuously tracking the Coldcard vulnerability attacks, which previously identified three major waves involving over 1,300 BTC; this time pointing out the emergence of small imitators continues his observation of "opportunistic following" after the vulnerability disclosure.
In terms of capital pathways, after the main attackers completed large-scale harvesting, the remaining un-migrated addresses became low-cost targets, with resources shifting from precise calculations to simple copy scripts; the motivation lies in exploiting information asymmetry and user inertia to capture residual value.
Similar patterns can be seen in past exchange hacking incidents followed by secondary laundering and imitation attacks, as well as large-scale scanning after software vulnerabilities are disclosed. Currently, hardware wallet security is at a stage of "long-tail risk diffusion after the main vulnerability exploitation."
Structural judgment belongs to technical substitution: once the core entropy source defect is publicly exploited, the attack threshold is significantly lowered, leading to an influx of imitators, causing risks to shift from concentrated outbreaks to continuous consumption, with pricing power transferring to nodes that can quickly migrate and monitor on-chain.
ABAB News · Cognitive Law
- After the main attack ends, imitators begin to harvest the remnants.
- Un-migrated addresses are the cheapest targets.
- The true cost of vulnerability disclosure is in the long-tail phase.