The Coldcard hardware wallet exploit has resulted in the theft of at least 1,596 BTC from about 7,300 addresses as users continue moving funds from potentially vulnerable wallets.
Galaxy Research said the confirmed losses came from three major attack waves and 14 smaller incidents.
The firm has also identified a possible fourth wave that could increase the total to 2,055 BTC, worth about $130 million, but has kept those addresses outside its confirmed estimate pending additional victim reports.
At least 73 victims have contacted Galaxy’s head of research, Alex Thorn, for help tracing their Bitcoin. Those reports helped researchers identify additional attack patterns and conclude that at least 15 attackers may now be exploiting the vulnerability.
About 90% of the stolen Bitcoin has not moved, while all coins linked to the first three confirmed waves remain at their initial attacker-controlled addresses.
Galaxy has shared the identified addresses with US law enforcement agencies, cryptocurrency exchanges and blockchain investigation firms so the funds can be flagged if the attackers attempt to move them through centralized platforms.
The thefts stem from a flaw in Coldcard firmware dating to March 2021. A coding error caused some devices to generate recovery seeds using a weaker software process instead of drawing sufficient randomness from the hardware random-number generator.
The error left some seeds with far fewer possible combinations than intended, allowing attackers to reconstruct private keys remotely without obtaining the device or the owner’s recovery words. Updating the firmware prevents the creation of additional weak seeds, but it cannot protect a wallet whose recovery phrase was already generated through the flawed process.
Coldcard’s manufacturer, Coinkite, has urged users to install the security update, create a new seed, and transfer their Bitcoin. The threat remains active because every affected wallet remains exposed until its funds are moved to an address generated from a secure seed.
Coldcard migrations push Bitcoin activity to multi-month highs
That race to replace exposed seeds is now visible across the Bitcoin network, where activity has climbed to levels last seen during earlier periods of market stress.
Santiment data showed 712,000 active Bitcoin addresses over the past seven days, the highest in three months. Transactions worth more than $100,000 reached 61,800 during the same period, a five-month high.
CryptoQuant said the Coldcard crisis was the main catalyst behind the increase as affected users moved coins into newly generated wallets, consolidated balances, or transferred funds to custodial platforms.
In a report shared with CryptoSlate, the firm stated that transactions valued below $100,000 reached $3.2 billion, their highest level since November 2024.
At the same time, spending by long-term holders outside exchanges rose to 406,000 BTC on a 30-day basis as of Aug. 3—up from 269,000 BTC before the exploit and the highest level since January.
Those movements do not necessarily indicate that holders are selling. A transfer from a vulnerable Coldcard address to a newly secured wallet appears on-chain as spent Bitcoin even when ownership remains unchanged.
Notably, the rush also congested the network. Transactions waiting in Bitcoin’s mempool increased from about 33,000 to roughly 96,000, the highest level since June 20, as thousands of holders attempted to move funds at the same time.
Exchange inflows rise as phishing targets wallet migrations
Part of the migration has flowed into centralized exchanges as users seek an immediate destination for Bitcoin removed from vulnerable wallets.
CryptoQuant said deposits from smaller holders reached their highest level since Feb. 6. Some users appear to have moved funds into existing custodial accounts while deciding whether to create another self-custody wallet or switch hardware providers.
According to the firm’s data, total exchange reserves increased by about 17,500 BTC between July 28 and Aug. 3, rising from roughly 2.702 million BTC to 2.719 million BTC. Binance received about 51% of the net increase, with its reserves climbing by approximately 9,000 BTC to 659,000 BTC.
The inflows increase the amount of Bitcoin immediately available for trading and could add to short-term sell-side pressure. However, they do not establish that holders intend to sell.
This is because some of the deposits may represent temporary custody arrangements while users replace exposed seeds and test new wallets.
Meanwhile, other holders are trying to retain direct control by generating fresh recovery phrases and transferring their Bitcoin into new self-custody wallets. That process has created another opening for criminals distributing fraudulent migration instructions and impersonating wallet support teams.
Trezor, a rival hardware wallet maker, warned that phishing attempts had increased following disclosure of the Coldcard flaw.
The firm told users never to share their recovery seeds or enter them into websites, applications or forms supplied through unsolicited messages.
The company said recovery words should only be entered directly on a Trezor device during wallet restoration. It also urged users to ignore migration instructions received through email, messages or phone calls and confirmed that its devices were not affected by the Coldcard incident.
The warning reflects the difficulty facing affected users. They must move their Bitcoin before attackers reconstruct their private keys while avoiding scammers attempting to obtain the recovery words directly.
Importing an existing weak seed into another device does not remove the vulnerability. Users must generate an entirely new recovery phrase and transfer the funds to an address derived from it, a more complex process than installing a firmware update or restoring an ordinary wallet.
Scammers can exploit that complexity by directing users to fraudulent applications, requesting recovery words for a supposed security check or providing an address they claim is safe.
ETFs gain an opening in Bitcoin’s custody debate
The movement toward exchanges and the growing risk surrounding wallet migrations have strengthened the argument for holding Bitcoin through regulated investment products.
Bloomberg Intelligence ETF analyst Eric Balchunas said the Coldcard breach could encourage some investors, including long-term holders, to migrate toward spot Bitcoin exchange-traded funds.
Bitcoin supporters have traditionally criticized ETFs because investors do not control the underlying coins or private keys. Instead, institutional custodians hold the assets on behalf of the funds.
Balchunas said that arrangement may now appear more attractive when compared with relying on a small hardware wallet manufacturer. ETF issuers and their custodians are large financial institutions with decades of experience safeguarding client assets, while Coldcard is operated by a Canadian company with a small workforce.
Institutional custody does not eliminate the possibility of theft or operational failure. Balchunas said a successful attack on an ETF custodian would probably trigger an immediate regulatory investigation and a coordinated response involving the fund manager, custodian and law enforcement agencies.
There is no evidence that Coldcard users have directly purchased ETF shares as a result of the exploit. The increase in exchange deposits may also prove temporary as holders create new wallets and return to self-custody.
The breach has nonetheless changed the calculation for investors deciding where to keep their Bitcoin. Self-custody removes dependence on a bank, exchange or fund manager, but it also leaves users responsible for the hardware and software that create their private keys.
For holders now trying to escape weak seeds while avoiding phishing attacks, the institutional structure once criticized for placing Bitcoin in Wall Street’s hands may offer the simpler option.
