Galaxy’s Alex Thorn warns some Coldcard single-signature wallets may need migration

Warnings around the suspected Coldcard-related security issue have widened beyond single-signature Bitcoin wallets, with wallet provider Nunchuk advising some multisignature users to migrate funds based on how many Coldcard-generated keys are involved. Nunchuk said wallets should be moved immediately when the number of affected Coldcard-generated keys already meets the signing threshold because an attacker could theoretically transfer funds directly. If a multisignature wallet contains only 1 Coldcard-generated key and that remains below the signing threshold, Nunchuk said the wallet should still be migrated but the situation is less urgent because a single affected key cannot move funds on its own. Users who cannot confirm how many Coldcard-generated keys are in their wallet were told to treat the situation as high risk. Nunchuk also said an upcoming mobile update will automatically enable the Slipstream channel for paid users. Under that change, any assisted multisignature wallet transaction containing at least one Coldcard key will be submitted through Slipstream instead of the public mempool, a step aimed at reducing the risk of transactions being monitored and replaced. Users who want to act immediately or who use the free version were told they can follow a manual migration path by creating a migration transaction, completing the multisignature signing flow without broadcasting it, and then submitting the raw transaction data to the Slipstream platform. The update adds a new dimension to earlier warnings from Galaxy Research head Alex Thorn, who said a fresh wave of Bitcoin sweep attacks targeting Coldcard wallet addresses appeared to be underway and pushed estimated cumulative losses tied to the suspected vulnerability close to $114 million. Thorn had said the activity appeared to be affecting single-signature wallets, with no multisignature wallets found to be impacted so far, and noted the assessment was based mainly on on-chain transaction patterns rather than direct victim reports, with some suspected attack transactions still unconfirmed. New fund-flow data flagged by CertiK suggest some of the suspected stolen Bitcoin is now being laundered across chains. CertiK said two separate 200 ETH deposits into Tornado Cash were detected on August 5, 2026 from Ethereum address 0x41B7…3268 after Bitcoin was swapped through THORChain into Ether. The traced activity included multiple rapid swaps roughly 16 to 19 hours before the alert, including examples such as about 2 BTC converting into around 68 ETH, 1 BTC into roughly 34 ETH, and a smaller 0.01 BTC test-like transaction. CertiK said five transactions worth about $382,800 moved from the THORChain router to the intermediary address, followed by two outbound transfers totaling about $374,000 into a sanctioned Tornado Cash contract. The pattern matches a common post-theft path in which stolen assets are bridged, consolidated at an intermediate address and then mixed to obscure their origin.