Coldcard Exploit Spurs $114M in Thefts, Small BTC Holders Flee
A Coldcard firmware flaw since 2021 has allowed attackers to steal Bitcoin, with losses nearing $114M. On July 31, small holders moved 39,600 BTC—the most since FTX's collapse—as active addresses spiked, though price held steady, signaling moves to secure rather than sell.
Quick Take
Coldcard vulnerability led to 1,816 BTC stolen (~$114M) across four organized sweeps.
July 31 saw 39,600 BTC in sub-1 BTC transfers, highest since FTX crash, amid panic moves.
Deposits to exchanges hit 7,300 BTC but Bitcoin price remained flat, suggesting safety-seeking.
Galaxy Research warns fourth wave ongoing; users may outbid attacker via replace-by-fee.
Market Impact Analysis
BearishDespite muted price action so far, the vulnerability exposes significant security risk; a confirmed fourth wave could trigger sell pressure or broader panic among hardware wallet users.
Speculation Analysis
Key Takeaways
- Over 1,816 BTC (~$114M) stolen via Coldcard exploit, with a fourth wave likely underway.
- Sub-1 BTC transfers hit 39,600 BTC on July 31, matching panic levels after FTX collapsed.
- Exchange deposits surged to 7,300 BTC, but Bitcoin's price held steady, signaling moves were for security, not selling.
- Replace-by-fee may let users outbid the attacker, but the vulnerability highlights critical hardware wallet risks.
What Happened
Coldcard hardware wallets shipped with a firmware flaw dating to March 2021 that generated weak seed phrases with insufficient entropy. Attackers exploited the bug to systematically drain vulnerable wallets. On July 31, the full scale of the breach became apparent, triggering panic transfers among small Bitcoin holders. A total of 39,600 BTC moved in sub-1 BTC transactions—the highest single-day total since 39,900 BTC was moved in the days following FTX’s collapse in November 2022. Daily active addresses surged from 645,000 to nearly 1 million, underscoring the rush to secure funds.
The Numbers
The flood of transfers on July 31 rivaled the post-FTX panic. Sub-1 BTC movements hit 39,600 BTC, just short of the FTX-era peak. Exchange deposits of sub-10 BTC climbed to 7,300 BTC ($459 million), the most since February 6. Despite the volume, Bitcoin’s price remained flat—down just 0.7%—suggesting users were relocating coins for security, not dumping. Galaxy Research has now identified four organized theft sweeps totaling 1,816 BTC (~$114 million), with the latest wave targeting 709 addresses for 448.73 BTC.
Why It Happened
A Coldcard firmware build error in March 2021 limited the randomness of generated seed phrases, making them guessable by attackers. Over months, thieves methodically swept funds from compromised wallets. The disclosure of the vulnerability, combined with high-profile warnings from figures like Binance founder Changpeng Zhao, ignited fear among retail holders. Many small users reacted by moving coins to exchanges or new wallets, mirroring the behavior seen after the FTX meltdown. The incident reveals how latent hardware flaws can erupt into systemic panic.
Broader Impact
This exploit exposes the critical need for rigorous, ongoing auditing of hardware wallet firmware—even from trusted brands. A flaw that lay dormant for years highlights the long-tail risks in crypto self-custody. The market’s muted price reaction indicates investors can differentiate security-motivated moves from sell-offs, but a confirmed fourth wave could shake confidence in cold storage solutions broadly.
What to Watch Next
- Galaxy Research warns a fourth organized sweep is likely in progress; monitor whether victims confirm thefts and totals rise.
- If stolen BTC hits exchanges for selling, downward price pressure could emerge, though current moves appear non-selloff.
- Users with Coldcard wallets should check firmware and consider using replace-by-fee to outbid the attacker on pending sweeps.
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
