According to CoinMeta, Wu said that Alex Thorn, the research supervisor of Galaxy Research, indicated that a fourth round of organized attacks is suspected to be occurring on Coldcard. During the period from block 960,778 to 960,792, a total of 218 transactions were detected, involving 462 victim addresses and 216 new destination addresses, with a total amount of approximately 388.9 BTC. The inputs for all transactions were not earlier than the Coldcard firmware boundary, and the transaction frequency was about 45 times higher than in the period before the incident. Some funds have been transferred to second-hop addresses, and there are still similar transactions waiting to be confirmed in the memory pool. The confirmed transactions show that RBF has been enabled. The relevant funds may belong to victims of Coldcard. It is recommended that users immediately transfer their funds out of Coldcard devices and use a higher transaction fee if the transaction supports RBF. Users may also proceed with handling through RBF.