Coldcard Hack Flips the Script: Bitcoin Heads Back to Exchanges 🏃‍♂️💨

The $89 million Coldcard hardware-wallet exploit is driving smaller bitcoin holders to move funds onto centralized exchanges, reversing the withdrawal pattern seen after the FTX collapse in November 2022, according to blockchain analytics firms. Daily exchange deposits of bitcoin transfers under 10 BTC spiked on Friday to 7,300 BTC, the highest since February 6, according to Julio Moreno, head of research at CryptoQuant. "Could be related to the coldcard hack, as people move their holdings looking for safety," Moreno said.

The Coldcard incident began on Friday, July 30, and has continued in waves. On-chain analysts have tracked multiple exploits, with losses estimated at 1,000–1,300 BTC (roughly $70–$90 million) across more than 1,000 addresses. The largest bursts moved hundreds of BTC in under an hour, and researchers say the attacks may be ongoing. Coldcard, the Bitcoin-only hardware wallet made by Canadian firm Coinkite, suffered one of its biggest security incidents after a firmware bug dating back to March 2021 quietly weakened how some devices generate seed phrases.

Attackers exploited the flaw by causing some Coldcard units to fall back on a predictable software random number generator instead of the device's hardware RNG when creating new wallets. That reduced the randomness, or entropy, in the seed, making it possible for an attacker to reconstruct likely seed phrases offline and derive the private keys without ever touching the physical device. The episode has prompted figures including former Binance founder CZ to publicly question the safety of hardware wallets and self-custody in general.

Following the FTX exchange collapse in November 2022, investors rushed to withdraw large volumes of coins from centralized platforms and move them into self-custody solutions, including hardware wallets and personal devices. The current trajectory is the opposite, with active $BTC addresses on exchanges surging as holders transfer coins onto trading platforms.

Coldcard has not yet issued a public statement addressing the estimated losses, and the scope of affected devices remains under investigation by independent blockchain researchers.