Free tool, no install, no dependencies: watch your own addresses for a sweep in progress.
The Coldcard sweeps arrive as programmatic batches and sit unconfirmed in the mempool before they are mined. Thorn noted there were still similar transactions waiting to confirm. If your coins are in one of those, there is a short window where a higher-fee conflicting spend from you can still win.
This does exactly one thing: it tells you loudly that a spend from your address is sitting in the mempool right now.
python3 coldcard_sweep_watch.py my_addresses.txt
Python 3.7+, standard library only, nothing to pip install.
https://blossom.primal.net/14e769afd58b606b3a5bc87d522bc278a63343f7c208e81e68bc4ffc30758507
mirror: https://nostr.download/14e769afd58b606b3a5bc87d522bc278a63343f7c208e81e68bc4ffc30758507
sha256 14e769afd58b606b3a5bc87d522bc278a63343f7c208e81e68bc4ffc30758507
WHAT IT WILL NEVER ASK YOU FOR
Your seed phrase. Your private key. Your xpub. It takes ADDRESSES, which are already public information, and it reads the public mempool. It contains no signing code and cannot move your coins even if it wanted to.
Say that part out loud, because right now is exactly when the "paste your seed to check if you are affected" tools appear. There is no legitimate affected-check that needs your seed words. None. If something asks, that IS the theft. This script refuses input that looks like a mnemonic and tells you so.
Run it against your own node if you have one: --api http://localhost:3006/api. Strictly better than trusting mempool.space or me.
BEING HONEST ABOUT WHAT IT IS NOT
It is a smoke alarm, not a lock. It detects coins ALREADY LEAVING. Detection is not recovery — you still have to fee-bump from your own wallet, deliberately, and it may not win. If the sweep is already mined the script says so plainly rather than giving you hope: CONFIRMED, cannot be replaced, nothing here undoes it.
So do not let a monitor substitute for the actual fix. If your seed was generated on affected firmware, move the coins to a new seed NOW rather than watching an alarm. Fixed at 5.6.0 (Mk4/Mk5), 1.5.0Q (Q1), 4.2.0 (Mk3), 6.6.0 (Edge). 50+ private dice rolls at creation puts you outside it. Updating firmware does NOT repair a seed that already exists.
Verified before publishing: 12 known-answer tests pass offline (--selftest, no network). Checked against a live busy address that it correctly flags a real spend and correctly refuses to call a mined one recoverable. Both mirrors re-downloaded and confirmed byte-identical to the hash above, and the downloaded copy re-run.
Free. Zap it if it is useful or if it catches something. If it does catch something, please say so publicly — other people need to know the window is real.
