Coldcard’s $89M Exploit Triggers Bitcoin Exchange Inflows Unlike FTX Fallout

The Coldcard security flaw has prompted smaller Bitcoin holders to move funds back onto exchanges as a precaution, according to blockchain analytics firms. The reaction contrasts sharply with the market response after the FTX collapse in late 2022, when investors moved assets away from centralized platforms and into self-custody.

Crypto security incidents often lead investors to change how they store their funds. After FTX collapsed in November 2022, concerns over exchange solvency drove users to withdraw large amounts of cryptocurrency from centralized platforms and transfer them into personal wallets and hardware devices.

This time, the trend has reversed. The ongoing multi-million-dollar Coldcard hardware wallet exploit has raised new concerns about self-custody security, leading some users to return their Bitcoin holdings to exchanges.

“Daily exchange deposits of Bitcoin transfers below 10 BTC surged Friday to 7,300 BTC, the highest level since Feb. 6. This could be linked to the Coldcard hack as users move funds in search of safety,” said Julio Moreno, head of research at blockchain analytics firm CryptoQuant.

What Happened With Coldcard

Coldcard, a Bitcoin-focused hardware wallet developed by Canadian company Coinkite, is dealing with one of its largest security incidents after a firmware vulnerability weakened the way certain devices generated seed phrases.

The thefts began on Friday, July 30, and continued through multiple waves. Blockchain analysts estimate that between 1,000 and 1,300 BTC—worth roughly $70 million to $90 million—has been stolen from more than 1,000 addresses. Researchers say attacks may still be continuing, with some transactions involving hundreds of BTC moved within short time periods.

The attackers exploited a flaw dating back to March 2021 that caused some Coldcard devices to rely on a predictable software-based random number generator instead of the built-in hardware random number generator when creating wallets.

This reduced the level of randomness, or entropy, in recovery seeds, allowing attackers to reconstruct possible seed phrases offline and generate the corresponding private keys without ever gaining physical access to the devices.

The incident has caused several industry figures, including Binance founder Changpeng Zhao (CZ), to reassess the risks associated with hardware wallets and self-custody.

Bitcoin Moves Back Toward Exchanges

CryptoQuant data shows a notable increase in Bitcoin transfers to exchanges, reversing the pattern seen after the FTX collapse.

On July 31, Bitcoin exchange deposits involving transactions smaller than 10 BTC climbed to 7,300 BTC, the highest level since Feb. 6.

Daily active Bitcoin addresses also jumped from 645,000 on July 30 to nearly 1 million on July 31, marking the highest level since Dec. 10, 2024. Much of the increase came from addresses transferring coins to exchanges.

Moreno said the data suggests users moved Bitcoin due to heightened caution following the Coldcard exploit.

Small transaction activity showed a similar trend. CryptoQuant data revealed that combined Bitcoin transfers below 1 BTC reached 39,600 BTC on Friday, close to the 39,900 BTC moved on Nov. 16, 2022, shortly after FTX filed for bankruptcy.

Moreno described the activity as the largest movement of Bitcoin by smaller holders since the FTX collapse and said it reflected users taking action to protect their funds.

Blockchain analyst Timechainindex reported similar findings, noting that exchange net inflows reached 11,163 BTC on July 31, with much of the volume flowing to major platforms and firms such as Binance, River, Kraken, and OKX.

The analyst described the inflows as coming from cautious retail holders responding to the security concerns.

The amount of Bitcoin held in wallets linked to centralized exchanges has risen to 2.715 million BTC, up from 2.703837 million BTC before the Coldcard incident.

A Different Reaction From the FTX Era

The risks investors faced after FTX were primarily related to exchange failures, insolvency, and frozen withdrawals. As a result, users moved Bitcoin away from centralized platforms and into self-custody solutions.

The Coldcard incident presents the opposite situation. Instead of losing confidence in exchanges, some users are temporarily moving smaller amounts back onto platforms due to concerns about hardware wallet security.

However, the issue remains limited to affected Coldcard devices rather than representing a broader failure of self-custody. Most hardware wallets and properly generated recovery seeds remain unaffected.

About The Author