Following a Coldcard wallet hack, $15 billion in Bitcoin was moved to safer holdings, highlighting the importance of self-custody.
Significant Bitcoin Migration Following Coldcard Hack
In the wake of a security breach affecting Coldcard wallets, approximately 233,000 BTC, valued at around $15 billion, was moved to safer holdings. The hack, which occurred on July 30, resulted in the theft of about 2,100 BTC, leading to total losses estimated at nearly $130 million across multiple attacks.
According to Nick Neuman, CEO of Casa, the data from Checkonchain indicates that many of the BTC relocated during this period were not solely from Coldcard users. Instead, a substantial number came from users of other wallets like Ledger and Trezor, who opted for multisig wallets after witnessing the exploit.
The vulnerability, stemming from a firmware flaw introduced in March 2021, significantly compromised the security of the Coldcard devices. This flaw allowed key generation through a weak random number generator, reducing security levels drastically. As a result, the incident has highlighted the importance of self-custody in maintaining Bitcoin's stability as an asset.
Neuman emphasized that the metrics from this incident demonstrate how self-custody can protect assets during crises. He noted that while 2,100 BTC were stolen, the movement of 233,000 BTC from long-term holders—who generally keep their holdings inactive for extended periods—reflected a proactive response to the breach. This amount far exceeds the stolen BTC, illustrating a significant shift in user behavior toward enhanced security measures.
"Somewhere between ~10x-100x the amount of Bitcoin stolen was swiftly moved to safety as people raised alarms," Neuman stated.
Galaxy Research has tracked the impact of the hack, confirming losses across over 5,200 wallets. Meanwhile, analytics from Glassnode indicated a notable decrease in long-term holder supply, dropping from nearly 15 million BTC to about 14.7 million BTC—the largest decline since December 2024.
Coinkite, the manufacturer of Coldcard, has advised users who generated wallets on firmware versions 4.0.1 to 4.1.9 to consider their wallets compromised and to switch to a new seed immediately.
