Unlike the FTX collapse, the $89 million Coldcard exploit has investors sending bitcoin back to exchanges

Security issues in the crypto market often push investors in predictable directions. For instance, following the collapse of the FTX exchange in November 2022, investors rushed to withdraw large volumes of coins from centralized platforms and move them into self-custody solutions, including hardware wallets and personal devices.

Now they are doing the opposite by moving coins to exchanges, as the ongoing multi‑million‑dollar Coldcard hardware‑wallet incident, which began Friday, has raised fresh questions about the safety of self‑custody.

“Daily exchange deposits of Bitcoin transfers < 10 BTC spiked yesterday [Friday] to 7.3K BTC, the highest since February 6. Could be related to the coldcard hack, as people move their holdings looking for safety,” Julio Moreno, head of research at blockchain analytics firm CryptoQuant, said.

Coldcard, the Bitcoin‑only hardware wallet made by Canadian firm Coinkite, is facing one of its biggest security incidents after a firmware bug quietly weakened how some devices generate seed phrases.

The thefts began on Friday, July 30, and have continued in waves since. On‑chain analysts have tracked multiple exploits, with losses now estimated at 1,000–1,300 BTC (roughly $70–$90 million) across more than 1,000 addresses. The largest bursts moved hundreds of BTC in under an hour, and researchers say the attacks may be ongoing as of this writing.

Attackers exploited a flaw dating back to March 2021, causing some Coldcard units to fall back on a predictable software random number generator instead of the device’s hardware RNG when creating new wallets. That reduced the randomness (entropy) in the seed, making it possible for an attacker to reconstruct likely seed phrases offline and derive the private keys without ever touching the physical device.

This has prompted many, including the likes of Binance Founder CZ, to rethink the safety of hardware wallets and self-custody in general

Data from CryptoQuant shows a clear response involving a movement of coins to exchanges, the opposite of what happened in the aftermath of FTX’s collapse.

As noted earlier, on July 31, daily bitcoin deposits to exchanges in transactions under 10 BTC jumped to 7,300 BTC, the highest level since Feb 6.

The number of daily active addresses spiked from 645,000 on July 30 to almost one million on July 31, the highest since Dec. 10, 2024. Most of the growth was due to addresses sending coins to exchanges.

“Seems people really moved their Bitcoin out of extreme caution after the coldcard hack,” Moreno said.

Small Bitcoin transactions tell a similar story. According to CryptoQuant, the combined volume of all transfers smaller than 1 BTC reached 39,600 BTC on Friday, just shy of the 39,900 BTC moved on November 16, 2022, the day after FTX filed for bankruptcy.

“The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse,” Moreno said, adding that he liked to see people “taking action.”

Blockchain sleuth Timechainindex made a similar observation, noting that total net inflows to exchanges totaled 11,163 BTC on July 31, most of which flowed into major exchanges and firms like Binance, River, Kraken, and OKX.

“These are plebs who are scared,” the handle said on X, explaining the nature of the BTC inflow.

The total number of BTC held in wallets tied to centralized exchanges has increased to 2.715 million from 2.703837 million before the Coldcard exploit.

Following FTX’s failure, the dominant risk was exchange insolvency and withdrawal freezes. Holders responded by moving bitcoin into self-custody, reducing exchange balances.

The current episode centers on self-custody risk associated with a single hardware wallet. The vulnerability has prompted some holders to temporarily shift smaller balances onto exchanges.

The incident is specific to Coldcard rather than a broad failure of self-custody. Most hardware wallets and properly generated seeds remain unaffected.