Coldcard Hack Sends $89M Bitcoin Back to Exchanges
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- Coldcard hardware-wallet users began losing funds on Friday, July 30, with on-chain analysts estimating 1,000–1,300 BTC ($70–90 million) drained across more than 1,000 addresses in attacks that may still be ongoing.
- The exploit traces to a firmware bug dating back to March 2021 that caused some devices to fall back on a predictable software random number generator, letting attackers reconstruct seed phrases offline without touching the physical wallet.
- Bitcoin exchange deposits in transactions under 10 BTC surged to 7,300 BTC on July 31 — the highest since February 6, according to CryptoQuant's Julio Moreno, who linked the spike directly to the Coldcard hack.
- Total net inflows to centralized exchanges hit 11,163 BTC on July 31, with most flowing into Binance, River, Kraken, and OKX, according to blockchain sleuth Timechainindex.
- Small transfers under 1 BTC reached 39,600 BTC on Friday, nearly matching the 39,900 BTC moved on November 16, 2022 — the day after FTX filed for bankruptcy.
- Daily active addresses jumped from 645,000 on July 30 to nearly 1 million on July 31, the highest since December 10, 2024, with growth driven by addresses sending coins to exchanges.
- The pattern inverts the FTX-era response: after that 2022 collapse, holders withdrew coins into self-custody; now they're returning them to exchanges, though the source notes most hardware wallets and properly generated seeds remain unaffected.
- Total BTC held in exchange-tied wallets rose to 2.715 million from 2.703837 million before the exploit.
Why it matters: Roughly 11,163 BTC migrated from self-custody to exchange hot wallets in a single day — the inverse of the post-FX withdrawal pattern — while the underlying March 2021 firmware flaw means older Coldcard devices may still be generating compromised seeds. Small-balance holders are now weighing exchange counterparty risk against hardware-wallet entropy integrity, a trade-off the market thought it had settled three years ago.
