Attackers began a fourth wave of sweeps against bitcoin held in Coldcard hardware wallets on Monday, pushing estimated losses to roughly $114 million since Thursday. The latest transactions remained replaceable in the mempool, giving some victims a brief window to move their coins before the thefts confirm.

Over $70 million in Bitcoin has been pinched. Coldcard has since urged its users to take precautions.

A software bug in popular hardware wallet Coldcard that led to the theft to this point of nearly 600 bitcoin worth roughly $38 million is prompting questions about security and…