← Editorial Bitcoin

Coldcard losses near $114M as small Bitcoin transfers spike

A firmware flaw in Coldcard hardware wallets that generated guessable keys for five years has triggered waves of theft, with researchers detecting a likely fourth attack.

· -7

On July 31, holders of small Bitcoin amounts moved coins at rates unseen since FTX's collapse in November 2022, according to CryptoQuant analysis. Transfers of less than 1 BTC totaled 39,600 BTC—roughly $2.5 billion—that day, mirroring the 39,900 BTC transferred days after FTX failed. Daily active sending addresses surged from 645,000 on July 30 to nearly a million on July 31, the highest since December 2024.

The movement coincided with disclosure of a March 2021 Coldcard firmware error that left seed phrases drawn from an inadequately small pool of possibilities. Exchange deposits composed of sub-10 BTC transfers hit 7,300 BTC ($459 million) on July 31, the largest amount since February 6. Researchers noted the pattern suggested users were relocating holdings for security rather than liquidating, as Bitcoin's price barely moved despite the inflow of exchange deposits.

Galaxy Research logged three waves of theft by Saturday totaling 1,367 BTC across 4,585 addresses, up from $38 million when the flaw was disclosed and $70 million following a public warning. Analyst Alex Thorn flagged what appeared to be a fourth wave of sweeps running at roughly 45 times the normal rate across 15 consecutive blocks on Monday, estimating 448.73 BTC ($28 million) in affected addresses after correcting for multisig accounts. This would bring the running total to approximately 1,816 BTC, near $114 million. Thorn added that no victim had yet confirmed the fourth wave, which rests on pattern matching.

How this piece reads Sell tone -7
Site call on Bitcoin Buy score 37.2

These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.

More on Bitcoin All pieces →

Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.