As Coldcard Losses Mount Near $114M, Bitcoin Transfers Hit FTX-Era Levels
A five-year vulnerability in Coldcard hardware wallets has triggered suspected thefts nearing $114 million, as frightened Bitcoin holders moved coins at levels unseen since the FTX collapse.
The Coldcard Vulnerability Unleashed
A firmware error dating back to March 2021 left Coldcard hardware wallets generating seed phrases from an insufficiently randomized pool, meaning private keys could be guessed. This vulnerability went undetected for five years, creating a massive security window for attackers. According to Galaxy Research, the flaw has triggered three confirmed waves of thefts totaling 1,367 BTC across 4,585 addresses, with losses beginning at $38 million when the vulnerability was initially disclosed and climbing as higher-profile warnings amplified awareness of the risk.
Bitcoin Holders Rush to Secure Assets
On July 31, 2026, the crypto market witnessed an extraordinary surge in Bitcoin activity. Transfers under 1 BTC totaled 39,600 BTC (roughly $2.5 billion), according to data from CryptoQuant—a volume unseen since November 16, 2022, just days after the FTX collapse. Daily active Bitcoin addresses jumped from 645,000 to nearly one million, marking the highest level since December 2024, with the spike concentrated in outbound transfers rather than inbound ones. CryptoQuant Head of Research Julio Moreno indicated that holders appeared to be moving their coins in search of security, rather than attempting to sell.
Exchange deposits comprised of smaller transactions totaling fewer than 10 BTC reached 7,300 BTC ($459 million) on the same day—the most significant figure since February 6. Bitcoin’s price held relatively steady despite this massive movement, a signal that security concerns, rather than panic selling, drove the activity.
A Fourth Wave of Thefts Emerges
Galaxy Research has flagged evidence of a likely fourth organized theft wave currently underway. Researcher Alex Thorn identified suspicious transaction patterns across 15 consecutive blocks at roughly 45 times the normal rate, ultimately identifying 709 addresses and 448.73 BTC ($28 million) in the suspected theft pattern. While no victims have publicly confirmed losses from this fourth wave, the transaction data suggests total Coldcard-related thefts could reach approximately 1,816 BTC, nearing $114 million.
The scale and speed of these thefts underscore the persistence of the vulnerability window. Attackers systematically exploited the weak randomization to generate and test private key guesses, while victims raced to relocate remaining holdings to safer storage methods. This incident reinforces why hardware wallet security practices matter across the entire cryptocurrency ecosystem.
Source: CryptoQuant and Galaxy Research, via Decrypt. Not financial advice.