Coldcard Losses Near $114M As Small Bitcoin Transfers Spike
Small Bitcoin holders moved coins on July 31 at a rate not seen since the collapse of FTX, according to CryptoQuant, as news spread that Coldcard hardware wallets had been generating guessable keys for five years.
Transfers of less than 1 BTC totaled 39,600 BTC (around $2.5 billion) that day, the firm's Head of Research Julio Moreno tweeted. The last comparable figure was 39,900 BTC on November 16, 2022, days after FTX failed. Daily active addresses rose from 645,000 on July 30 to almost a million on July 31, the highest since December 2024, with the jump concentrated in sending addresses rather than receiving ones.
The Bitcoin plebs had not move this amount of BTC in a day since the FTX collapse.
— Julio Moreno (@jjcmoreno) August 2, 2026
39.6K BTC transferred on July 31st after the coldcard hack, 39.9K BTC transferred on November 16 2022, a few days after the FTX collapse.
These are Bitcoin transfers < 1 BTC.
I like to see that… pic.twitter.com/c7Qzx7za6M
Some of it went to exchanges. Deposits made up of sub-10 BTC transfers hit 7,300 BTC ($459 million) on July 31, the most since February 6, CryptoQuant said. Moreno linked the move to the Coldcard breach, saying people appeared to be shifting holdings "looking for safety," while noting the connection was not certain.
Notably, Bitcoin's price barely moved amid the wave of exchange deposits, suggesting that users were moving their coins to secure them rather than sell. Bitcoin is currently trading at $62,724, down 0.7% over the past day, per CoinGecko data.
The ColdCard exploit
The Coldcard flaw dates to a March 2021 firmware build error that left seed phrases drawn from far too small a pool. Galaxy Research logged three waves of thefts by Saturday, totaling 1,367 BTC across 4,585 addresses, up from $38 million when the flaw was disclosed and $70 million when Binance founder Changpeng Zhao warned holders.
A fourth is likely under way. Galaxy Research's Alex Thorn flagged sweeps across 15 consecutive blocks on Monday, running at roughly 45 times the normal rate, and after correcting a set that had wrongly included multisig addresses put the wave at 709 addresses and 448.73 BTC ($28 million). That would take the running total to about 1,816 BTC, near $114 million. Thorn added a caveat that no victim has yet confirmed the fourth wave, which rests on pattern matching.
🚨 LIKELY 4TH ORGANIZED WAVE COLDCARD ATTACK OCCURRING RIGHT NOW
— Alex Thorn (@intangiblecoins) August 3, 2026
THERE ARE STILL SIMILAR TXS IN THE MEMPOOL WAITING TO BE CONFIRMED AND THE PREVIOUSLY-CONFIRMED TXS SIGNAL RBF OPT-IN, CHECK YOUR FUNDS AND YOU MAY BE ABLE TO RBF YOUR WAY OUT OF THIS
pattern identified:
blocks…
Some sweeps were still sitting unconfirmed in the mempool and had opted into replace-by-fee, he said, meaning holders who act quickly and pay a high fee may be able to outbid the attacker. None of the addresses hit in the first three waves were multisig.
'A wake-up call'
Kraken chief security officer Nick Percoco called the incident a "wake-up call for the entire hardware wallet industry." ColdCard’s Mk4, Mk5 and Q ship with certified secure elements, he noted, and their seeds still came out around 72 bits, because the certification covered the component while nobody verified which code path actually ran.
— Nick Percoco (@c7five) August 2, 2026
Percoco wants independent lab validation of entropy sources, bound to specific firmware versions and listed in a public registry, as payment terminals already require. He added that Coinkite's hotfix now fails the build unless the correct generator is linked in, a control he said took about 48 hours to write once the company knew what to look for.
Related Markets
All MarketsMarket data may be delayed. Not financial advice.
- • A firmware error in Coldcard hardware wallets caused predictable seed phrases, leading to nearly $114 million in Bitcoin thefts.
- • Small Bitcoin holders moved $2.5 billion in a single day to secure funds following the breach.
- • The vulnerability affected multiple models including the Mk4, Mk5, and Q.
The flaw originated from a March 2021 firmware error that bypassed secure hardware entropy for a weak software source. This error left thousands of users vulnerable to organized theft waves.
Christian Perspective
This event highlights the inherent instability of relying on manmade digital systems for security. While Bitcoin offers a way to bypass corrupt central banks, this breach proves that even decentralized tools are subject to human error and deception. True security and stewardship must ultimately be rooted in God rather than fallible technology.
Implications
The vulnerability of digital assets underscores the need for individuals to maintain self-reliance and physical control over their resources. As globalist entities attempt to move toward programmable, centralized currencies, these technical failures serve as a warning. Protecting one's family and wealth requires constant vigilance against both systemic corruption and technical incompetence.
Broader Trends
The spike in movement reflects a growing distrust in centralized financial institutions and a desperate search for autonomy. This volatility is a symptom of a decaying technological landscape where even "secure" tools fail. It mirrors the broader instability seen as the nation struggles to maintain order amidst shifting economic and social structures.
Takeaway
Prioritize tangible assets and diverse methods of wealth preservation to protect your household from sudden systemic shocks. Do not place absolute faith in any single technological solution or institution. Maintain the traditional role of the provider by remaining vigilant and prepared for the inevitable failures of a modern, secularized economy.
What is your reaction to this story?
Want to join the conversation about this story?
Join our community at Gab.com→
Gab AI
The one AI they can't control. Our exclusive AI model trained to uphold Christian values and traditional principles in every interaction.
