Coldcard Hack Sends Bitcoin Back to Exchanges
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- Coldcard hardware wallets (made by Canada's Coinkite) have been hit by an exploit draining an estimated 1,000–1,300 BTC ($70–$90 million) from more than 1,000 addresses since July 30, traced to a March 2021 firmware bug that caused some devices to fall back on a predictable software random number generator when generating seed phrases.
- Bitcoin exchange deposits in transactions under 10 BTC spiked to 7,300 BTC on July 31 — the highest since February 6 — according to CryptoQuant head of research Julio Moreno, who attributed the jump directly to the Coldcard hack.
- Small bitcoin transfers (under 1 BTC) hit 39,600 BTC on Friday, nearly matching the 39,900 BTC moved on November 16, 2022, the day after FTX filed for bankruptcy — a benchmark CryptoQuant's Moreno called the biggest single-day small-holder movement since the FTX collapse.
- Daily active bitcoin addresses surged from 645,000 on July 30 to nearly 1 million on July 31, the highest since December 10, 2024, with most of the growth attributed to addresses sending coins to exchanges.
- Net inflows to centralized exchanges totaled 11,163 BTC on July 31, flowing primarily into Binance, River, Kraken, and OKX, per blockchain sleuth Timechainindex, pushing total exchange-held BTC from 2.703837 million to 2.715 million.
- Binance founder CZ publicly flagged the incident as a reason to rethink hardware wallet and self-custody safety, lending outsized weight to the narrative that self-custody is no longer automatically the safer choice.
Why it matters: Four years of post-FTX self-custody orthodoxy just got dented in a single weekend, with 11,163 BTC flowing onto centralized exchanges on July 31 alone. The trust damage is narrowly scoped to Coinkite's Coldcard line — the article explicitly notes most hardware wallets and properly generated seeds remain unaffected — meaning rivals like Ledger and Trezor are the relative beneficiaries while Coldcard faces a brand-defining recall of its security reputation.
