Coldcard Breach Triggers Largest Bitcoin Self-Custody Transfers Since FTX Collapse
A suspected Coldcard wallet hack has driven unprecedented volumes of small Bitcoin transfers, renewing debate over self-custody security versus centralized alternatives.
The Breach and Market Response
A suspected security vulnerability affecting Coldcard hardware wallets has catalyzed the largest wave of small Bitcoin transfers since the cryptocurrency exchange FTX imploded nearly four years ago. According to data from CryptoQuant, daily transfers of Bitcoin below the 1 BTC threshold reached their highest volume since the FTX collapse in November 2022, with 39,600 BTC moved through individual transactions. This figure comes remarkably close to the 39,900 BTC transferred on November 16, 2022, when the exchange filed for bankruptcy, signaling comparable market stress and urgency among smaller Bitcoin holders.
The breach, which surfaced in late July, continues to expand as researchers uncover new compromised addresses. Galaxy Research, the research division of investment firm Galaxy Digital, identified an additional 207.7 BTC—valued at approximately $13.2 million—drained in the most recent identified attack wave. Total estimated losses now reach 1,367 BTC ($88.6 million) across approximately 4,585 distinct wallet addresses. Alex Thorn, who leads Galaxy Digital’s research operations, warned that the compromise appears to remain active and advised users to immediately transfer holdings from any Coldcard-generated addresses if they have not already done so. The research team continues identifying new victim addresses and attacker wallets, with user reports proving instrumental in helping both researchers and law enforcement track the stolen Bitcoin.
Self-Custody Under Scrutiny
The incident has intensified an ongoing debate about whether individuals should maintain direct control over their cryptocurrency holdings or entrust them to institutional custodians. Defenders of decentralized self-custody argue that this incident represents a failure specific to one wallet manufacturer, not a fundamental flaw in the principle of user-controlled assets. Nick Neuman, CEO of Bitcoin security company Casa, pushed back against suggestions that self-custody has become untenable, highlighting how the distributed nature of self-custodied Bitcoin provides time for users to detect and respond to breaches. He further noted that self-custody likely protects roughly ten times more Bitcoin than has been stolen in this particular incident, suggesting the absolute protection offered by user control remains substantial.
However, traditional finance participants see the breach as vindication for institutional solutions. Eric Balchunas, a senior ETF analyst at Bloomberg, pointed to Bitcoin exchange-traded funds as offering both superior security and greater convenience, emphasizing the long track record and regulatory oversight of the established ETF industry as alternatives to direct wallet management.
How the cryptocurrency community responds to this breach—whether embracing stronger self-custody practices or shifting toward institutional custodians—will shape the industry’s security standards and adoption trajectory for years to come.
Source: CryptoQuant, via Cointelegraph. Not financial advice.