The Coldcard vulnerability has led some smaller Bitcoin holders to transfer their funds back to exchanges as a safety measure, according to blockchain analytics companies. The move is the opposite of what happened after the FTX collapse in late 2022, when investors moved assets away from centralized platforms and into self-custody wallets.
Crypto security events often influence investor behavior in predictable ways. Following FTX’s failure in November 2022, concerns over exchange solvency caused users to withdraw large amounts of Bitcoin from centralized exchanges and store their holdings in personal wallets, including hardware devices.
The latest Coldcard incident has reversed that trend. The multi-million-dollar exploit affecting certain Coldcard hardware wallets has renewed concerns about the security of self-custody, prompting some users to move their Bitcoin back onto exchanges.
“Daily exchange deposits of Bitcoin transfers below 10 BTC surged to 7,300 BTC on Friday, the highest level since Feb. 6. This may be connected to the Coldcard hack, as users move their holdings in search of safety,” said Julio Moreno, head of research at CryptoQuant.
Coldcard Security Flaw Explained
Coldcard, a Bitcoin-only hardware wallet developed by Canadian company Coinkite, is facing a major security crisis after a firmware bug weakened the process used by some devices to generate wallet recovery seeds.
The attacks began on Friday, July 30, and continued in multiple waves. On-chain analysts estimate that between 1,000 and 1,300 BTC—worth approximately $70 million to $90 million—has been stolen from more than 1,000 addresses. Researchers have warned that additional losses could occur as investigations continue.
The attackers took advantage of a vulnerability dating back to March 2021. The flaw caused certain Coldcard devices to use a predictable software random number generator instead of the built-in hardware random number generator when creating wallets.
As a result, the randomness of recovery seeds was weakened, making it possible for attackers to recreate potential seed phrases offline and derive private keys without physically accessing the devices.
The incident has sparked broader discussions about hardware wallet security and self-custody, with figures such as Binance founder Changpeng Zhao (CZ) highlighting the need to reconsider how crypto holders manage risk.
Exchange Inflows Rise After Coldcard Exploit
CryptoQuant data shows that Bitcoin is moving toward exchanges at an increased pace, marking a reversal from the post-FTX trend.
On July 31, Bitcoin deposits involving transactions smaller than 10 BTC reached 7,300 BTC, the highest daily level since Feb. 6.
The number of active Bitcoin addresses also increased sharply, rising from 645,000 on July 30 to nearly 1 million on July 31, the highest level since Dec. 10, 2024. Much of the increase came from wallets sending BTC to exchanges.
Moreno said the activity indicates that users moved their holdings out of caution following the Coldcard breach.
Smaller transactions showed a similar pattern. CryptoQuant data revealed that Bitcoin transfers below 1 BTC totaled 39,600 BTC on Friday, approaching the 39,900 BTC moved on Nov. 16, 2022, shortly after FTX’s bankruptcy filing.
Moreno noted that smaller Bitcoin holders had not moved this much BTC in a single day since the FTX collapse, describing the activity as users taking proactive steps to protect their assets.
Blockchain analyst Timechainindex also reported significant exchange inflows, with net Bitcoin deposits reaching 11,163 BTC on July 31. Most of these funds moved into major platforms and companies, including Binance, River, Kraken, and OKX.
The analyst suggested that the transfers reflected cautious behavior from retail Bitcoin holders concerned about wallet security.
Bitcoin held in exchange-linked wallets has since increased to 2.715 million BTC, up from 2.703837 million BTC before the Coldcard exploit.
Opposite Market Reaction Compared With FTX
The FTX collapse centered on concerns about centralized exchanges, including insolvency risks and withdrawal restrictions. Investors responded by moving Bitcoin into self-custody, reducing exchange balances.
The Coldcard exploit represents a different type of risk. Instead of abandoning exchanges, some users are temporarily returning smaller holdings to centralized platforms because of concerns over hardware wallet vulnerabilities.
However, the issue remains specific to affected Coldcard devices and does not represent a failure of self-custody as a whole. Properly generated seeds and most hardware wallets remain unaffected.
