Coldcard Hack Sparks Biggest Sub-1 BTC Move Since FTX
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- Coldcard wallets were drained in an attack that CryptoQuant identified as the biggest sub-1 BTC move since FTX.
- Alex Thorn, Galaxy Digital's head of firmwide research, warned on X Sunday that the attack was still ongoing and urged Coldcard users to move funds immediately, while his team continued identifying new victim and attacker addresses.
- User reports helped researchers and authorities track stolen funds as the investigation expanded.
- Casa CEO Nick Neuman pushed back against claims that "self-custody is over," estimating that roughly 10 times more Bitcoin was protected through self-custody than was stolen and identified in the attack.
- Bloomberg senior ETF analyst Eric Balchunas argued Bitcoin ETFs provide a safer and more convenient alternative for many users, citing the ETF industry's long operating history.
- Critics countered that the incident was a failure of one wallet provider rather than a failure of self-custody as a principle.
Why it matters: For Bitcoin holders using Coldcard-generated addresses, funds remain at risk while the attack continues, making immediate migration urgent. The breach is being weaponized in the self-custody vs. ETF debate — Casa counters that roughly 10x more BTC was protected through self-custody than was stolen.
