The Coldcard hardware wallet exploit that began on July 30 has affected more than 1,000 addresses, with estimated losses between 1,000 and 1,300 BTC, valued at approximately $70 million to $90 million. A firmware bug that weakened the entropy of seed phrase generation since March 2021 is the main culprit behind the breach of investor funds.
Panic over the security of these personal storage devices immediately triggered an unexpected exodus of assets.
Reverse Flow to Centralized Platforms
The transfer volume of small fractions for wallets under 1 BTC reached 39,600 BTC on July 31, nearing the 39,900 BTC moved on the day of FTX’s bankruptcy on November 16, 2022. CryptoQuant’s head of research, Julio Moreno, emphasized that the retail Bitcoin investor cohort has not moved this much assets in a single day since the collapse of that exchange.
At the end of July, daily Bitcoin inflows to exchanges in transaction sizes under 10 BTC surged to 7,300 BTC, marking the highest level since February 6. Total net inflows to exchanges reached 11,163 BTC on the same day, with the majority of the coins landing on major platforms such as Binance, River, Kraken, and OKX. This influx pushed Bitcoin reserves in exchange wallets up from 2,703,837 to 2,715,000 BTC. Network activity also surged, as daily active addresses jumped sharply from 645,000 on July 30 to nearly 1 million the following day, a high point since December 10, 2024.
Why Is It Like FTX, but in the Opposite Direction?
The scale of this asset movement matches the FTX-era exodus, but in the opposite direction. In 2022, investors raced to withdraw their Bitcoin from centralized exchanges to self-custody to avoid the risk of corporate bankruptcy. Now, doubts over the security of personal devices are driving thousands of coin holders to transfer their Bitcoin back to exchanges because third-party platforms are perceived as more secure.
Binance founder CZ even responded to the phenomenon, questioning the security of hardware wallets and the practicality of the self-custody concept for the majority of crypto users.
The Real Limits of Vulnerability
The surge in exchange inflows was driven by fear rather than a careful technical evaluation. This exploit specifically targeted a system vulnerability in Coldcard, and is not an indication of a fundamental failure of self-custody. Hardware wallets from other manufacturers, along with seed phrases generated using correct procedures, are completely unaffected by this vulnerability.
For most users, dissecting system specifications as news of a million-dollar exploit spreads is a luxury they cannot afford. When uncertainty peaks, the first instinct of many is not to inspect the code of their device, but to run to the door of the nearest open exchange.
Reported by CoinDesk.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
