Unlike the FTX collapse, the $89 million Coldcard exploit has investors sending bitcoin back to exchanges

Security issues in the crypto market often push investors in predictable directions. For instance, following the collapse of the FTX exchange in November 2022, investors rushed to withdraw large volumes of coins from centralized platforms and move them into self-custody solutions, including hardware wallets and personal devices.

Now they are doing the opposite by moving coins to exchanges, as the ongoing multi‑million‑dollar Coldcard hardware‑wallet incident, which began Friday, has raised fresh questions about the safety of self‑custody.

“Daily exchange deposits of Bitcoin transfers < 10 $BTC spiked yesterday [Friday] to 7.3K $BTC, the highest since February 6. Could be related to the coldcard hack, as people move their holdings looking for safety,” Julio Moreno, head of research at blockchain analytics firm CryptoQuant, said.

What went wrong with Coldcard

Coldcard, the Bitcoin‑only hardware wallet made by Canadian firm Coinkite, is facing one of its biggest security incidents after a firmware bug quietly weakened how some devices generate seed phrases.

The thefts began on Friday, July 30, and have continued in waves since. On‑chain analysts have tracked multiple exploits, with losses now estimated at 1,000–1,300 $BTC (roughly $70–$90 million) across more than 1,000 addresses. The largest bursts moved hundreds of $BTC in under an hour, and researchers say the attacks may be ongoing as of this writing.

Attackers exploited a flaw dating back to March 2021, causing some Coldcard units to fall back on a predictable software random number generator instead of the device’s hardware RNG when creating new wallets. That reduced the randomness (entropy) in the seed, making it possible for an attacker to reconstruct likely seed phrases offline and derive the private keys without ever touching the physical device.

This has prompted many, including the likes of Binance Founder CZ, to rethink the safety of hardware wallets and self-custody in general

The onchain reaction: Small transfers spike

Data from CryptoQuant shows a clear response involving a movement of coins to exchanges, the opposite of what happened in the aftermath of FTX’s collapse.

As noted earlier, on July 31, daily bitcoin deposits to exchanges in transactions under 10 $BTC jumped to 7,300 $BTC, the highest level since Feb 6.

The number of daily active addresses spiked from 645,000 on July 30 to almost one million on July 31, the highest since Dec. 10, 2024. Most of the growth was due to addresses sending coins to exchanges.