Researchers flagged a possible fourth Coldcard attack after 388.93 BTC moved from 462 suspected victim addresses in 218 transactions.