After Coldcard Was Hacked, $15 Billion in Bitcoin Moved to Safety

Within the days after the worst {hardware} pockets exploit in Bitcoin’s latest historical past, Casa CEO Nick Neuman started counting extra than simply the $BTC being drained from susceptible Coldcard wallets.

Whereas attackers had been draining Coldcard wallets one deal with at a time, 233,000 $BTC—price about $15 billion at as we speak’s costs—was quietly transferring looking for security.

The large and ongoing breach that began on July 30 has already led to shut to $130 million in stolen Bitcoin from Coldcard {hardware} wallets—bodily devices that retailer non-public keys solely offline, by no means connecting to the web, and made by Canadian firm Coinkite.

A firmware bug launched in March 2021 had routed key era via a weak software program random quantity generator as a substitute of the gadget’s devoted {hardware} chip. Non-public keys (the key codes that show possession of Bitcoin and authorize any transaction) grew to become guessable, with safety collapsing from 128 bits to roughly 40—the cryptographic equal of a financial institution vault that seems to have a four-digit PIN.

Galaxy Analysis tracked the fallout throughout three confirmed assault waves, with losses reaching roughly 1,596 $BTC throughout greater than 5,200 addresses.

Casa’s Neuman, earlier this week, posted the on-chain numbers from analyst James Verify of Checkonchain to make an argument for Bitcoin’s resilience. Self-custody, holding your individual non-public keys somewhat than leaving Bitcoin with an trade or custodian, did not buckle beneath strain however as a substitute tailored, he argued.

“The onchain metrics across the Coldcard incident reinforce how vital self-custody is to the resilience of Bitcoin as an asset class,” Neuman wrote on X.

The breakdown Neumann cited in his put up, drawing Checkonchain’s onchain knowledge: 2,100 $BTC stolen (increased than Galaxy’s personal accouting), and 22,000 $BTC moved to exchanges. And 233,000 $BTC moved out of long-term holder wallets—addresses dormant for not less than 155 days, a cohort analysts watch as a proxy for critical, affected person buyers—into security. That’s greater than 100 occasions what the attackers took.

A few of that got here from Coldcard customers migrating to multisig wallets (setups requiring a number of impartial keys to approve any transaction, so no single compromised gadget can drain every thing). Some got here from holders on Ledger and Trezor—solely totally different {hardware}—who used the hack as a wake-up name.

Casa confirmed each patterns from precise buyer conversations. “So someplace between ~10x-100x the quantity of bitcoin stolen was moved to security as folks sounded the alarm,” Neuman wrote.

When a centralized trade will get breached, every thing goes directly. Right here, the attacker needed to crack addresses individually, incomes a trickle at a time whereas the remainder of the community had time to reply. “This can be a big flashing neon signal showcasing the resilience that self-custody provides to the community,” Neuman wrote. “If all that $BTC was held at a custodian and the custodian was hacked as a substitute, these numbers would have been flipped.”

Information from analytics firm Glassnode confirms the dimensions: long-term holder provide dropped from almost 15 million $BTC to roughly 14.7 million—the most important weekly decline since December 2024. It occurred whereas Bitcoin traded roughly 50% under its all-time excessive of $126,000, set in October 2025.

Coinkite has urged anybody who generated a seed on firmware variations 4.0.1 via 4.1.9—masking March 2021 to July 2026—to deal with these wallets as compromised and migrate to a brand new seed instantly.