Unlike the FTX collapse, the $89 million Coldcard exploit has investors sending bitcoin back to exchanges

In late July 2026, Coldcard, a Bitcoin-only hardware wallet made by Canadian firm Coinkite, suffered a significant security breach due to a firmware bug that weakened the generation of seed phrases in some devices. The flaw, dating back to March 2021, caused affected Coldcard units to rely on a predictable software random number generator rather than a hardware-based one, reducing the entropy of the seed phrase. This vulnerability allowed attackers to reconstruct seed phrases offline and steal private keys without physical access to the wallets. Since July 30, the exploits have resulted in estimated losses of 1,000 to 1,300 BTC, worth approximately $70–$90 million, spread across over 1,000 addresses.

The hack has prompted a notable behavioral shift among Bitcoin holders, who are now moving coins onto centralized exchanges rather than withdrawing them to self-custody solutions. This stands in contrast to the aftermath of the FTX collapse in late 2022 when investors fled exchanges en masse. According to blockchain data from CryptoQuant, daily Bitcoin deposits to exchanges for transactions under 10 BTC surged to 7,300 BTC on July 31, the highest since early February 2026. The number of active Bitcoin addresses also jumped from 645,000 on July 30 to nearly one million on July 31, driven primarily by users transferring funds into exchanges like Binance, Kraken, River, and OKX.

This shift highlights heightened concerns about the security of self-custody after the Coldcard incident, especially given that these are smaller, retail-level transactions rather than large institutional movements. CryptoQuant’s head of research, Julio Moreno, emphasized that many holders acted out of extreme caution. Total Bitcoin held in exchange wallets increased from about 2.703 million BTC before the exploit to approximately 2.715 million BTC afterwards. The source clarifies that this incident is specific to Coldcard hardware wallets rather than indicating a broader vulnerability affecting other hardware wallets or self-custody methods.

The development matters because it challenges prevailing investor assumptions about the relative safety of self-custody versus centralized exchanges. While the 2022 FTX collapse raised concerns about exchange insolvency and led to a surge in on-chain withdrawals to private wallets, the Coldcard exploit reversed this trend by exposing risks in hardware wallet security. Prominent figures, including Binance founder Changpeng Zhao (CZ), have publicly reconsidered the security assumptions underlying hardware wallets following the incident.