Coldcard hardware wallet vulnerabilities have led to a surge in small Bitcoin transfers, with potential theft losses nearing $114 million.
Key Highlights
- On July 31, under 1 BTC transfers totaled 39,600 BTC, nearly matching post-FTX levels, as per CryptoQuant.
- Daily active Bitcoin addresses surged from 645,000 to almost 1 million, the highest since December 2024.
- Galaxy Research reports potential for total theft losses to reach 1,816 BTC, approximately $114 million.
The Bitcoin community has seen a notable increase in transactions following the revelation of vulnerabilities in Coldcard hardware wallets. On July 31, small Bitcoin transfers reached 39,600 BTC (around $2.5 billion), echoing activity levels seen shortly after the FTX collapse. This surge was driven by concerns over Coldcard wallets producing insecure keys for the past five years, as highlighted by CryptoQuant.
Daily active addresses jumped significantly, from 645,000 on July 30 to nearly 1 million by July 31, marking the highest count since December 2024. Most of this increase was attributed to sending addresses, indicating users were likely moving their assets.
This surge is the highest volume of Bitcoin moved in a single day since the FTX fallout.
On July 31, 39.6K BTC was transferred following the Coldcard breach, closely mirroring the 39.9K BTC moved on November 16, 2022, shortly after FTX's collapse.
— Julio Moreno (@jjcmoreno) August 2, 2026
Many of these transactions were directed to exchanges, with transfers below 10 BTC amounting to 7,300 BTC ($459 million) on the same day, the highest since February 6. Julio Moreno of CryptoQuant suggested that the uptick in activity was likely a reaction to the Coldcard breach, as users sought to secure their holdings.
Despite the influx of deposits into exchanges, Bitcoin's market price remained stable, trading at $62,724, reflecting a slight decline of 0.7% from the previous day, according to CoinGecko data.
Details of the Coldcard Vulnerability
The issues with Coldcard stemmed from a firmware error in March 2021, which led to the generation of seed phrases from an inadequately small pool. Galaxy Research has identified three waves of thefts totaling 1,367 BTC across 4,585 addresses. As the situation evolves, a potential fourth wave is being tracked, which could increase total losses to 1,816 BTC, nearing $114 million.
Alex Thorn from Galaxy Research noted unusual transaction activity across 15 consecutive blocks on the blockchain, indicating a potential organized attack. While this new wave has not yet been validated by victims, it suggests a pattern of ongoing risk for Coldcard users.
🚨 A LIKELY FOURTH ORGANIZED WAVE OF COLD CARD ATTACKS IS IN PROGRESS
— Alex Thorn (@intangiblecoins) August 3, 2026
Some transactions remain unconfirmed in the mempool, using replace-by-fee, which allows holders to potentially outbid attackers by offering higher fees. Notably, none of the addresses affected in the first three waves were multisig wallets.
A Call to Action
Nick Percoco, Chief Security Officer at Kraken, has called this incident a "wake-up call" for the hardware wallet industry. He emphasized that while Coldcard’s Mk4, Mk5, and Q models feature certified secure components, the seed generation still produced a security level of only 72 bits due to the certification limitations. He advocates for independent validation of entropy sources tied to specific firmware versions to enhance security protocols.
— Nick Percoco (@c7five) August 2, 2026
Percoco also mentioned that Coinkite has implemented a hotfix that will prevent builds unless the correct generator is connected, a measure that was put in place within 48 hours of identifying the issue.
