🎯 RBF attack

The items that name it 2

• How multisig protected thousands of bitcoin during the Coldcard incident
  article2026-08-12It is written here as RBF attack (exploiting exposed public keys during pending/unconfirmed transactions).

  When a multisig transaction is broadcast to public mempools, the public keys for the spending address are revealed before confirmation, creating a window where bitcoin could be vulnerable to theft until the transaction confirms.

• Coldcard Security Advisory
  advisory2026-07-31It is written here as RBF (Replace-By-Fee) attack.

  An attacker holding 2-of-3 compromised keys in a multisig vault can replace a pending transaction before confirmation; risk exists while a replacement transaction is unconfirmed, and continues for reused addresses that have been spent from (revealing exposed public keys)