Coldcard exploit drives Bitcoin outflows as “hodlers” consolidate—Aug 2 digest

Recent activity around Coldcard hardware wallets has reignited concerns about the safety of seed generation. Galaxy Research, the research arm of Galaxy Digital, estimates that a third weekend wave of attacks tied to Coldcard-generated addresses resulted in losses totaling 1,367 BTC (about $88.6 million) across 4,585 addresses.

At the same time, on-chain data suggests that smaller Bitcoin holders have been moving quickly toward exchanges or other custody routes. CryptoQuant head of research Julio Moreno said that on Friday, Bitcoin transfers below 1 BTC reached their highest daily level since 2022, with 39,600 BTC moved—just 300 BTC shy of the 39,900 BTC figure recorded on Nov. 16, 2022, shortly after FTX filed for bankruptcy.

Key takeaways

• Galaxy Research estimates weekend Coldcard-related losses at 1,367 BTC across 4,585 addresses.
• CryptoQuant data shows sub-1 BTC transfers spiking to the highest daily level since 2022, indicating rapid fund reallocation by smaller users.
• Galaxy Digital’s Alex Thorn said the attack activity was still ongoing and urged users to move funds immediately from affected Coldcard-generated addresses.
• The reported exploit is linked to a flaw in Coldcard seed generation that allegedly did not rely on a “genuinely random” number generator.

Coldcard compromise spills into user behavior

The Coldcard incident is notable not only for the size of estimated losses, but also for how quickly it is changing user behavior on-chain. After reports of stolen funds, many holders appear to be reducing their exposure to the compromised wallet ecosystem and shifting to more liquid venues.

Moreno’s CryptoQuant observations place this movement in a broader pattern: transfers below 1 BTC spiked to 39,600 BTC on Friday, the highest daily level since 2022. While the reasons behind sub-1 BTC movement can vary, a move of this magnitude is consistent with panic-driven consolidation—especially among smaller holders who may prefer centralized exchanges for speed, or for services they believe are better insulated from the specific failure mode described in the Coldcard case.

Galaxy Research tracks the scope of weekend losses

In its Saturday update, Galaxy Research said the third weekend wave brought estimated losses to 1,367 BTC, spread across 4,585 addresses. Earlier coverage cited a similar on-chain extraction profile during previous waves of attacks, reinforcing that the incident did not appear to stop after the first report.

Alex Thorn, Galaxy Digital’s head of firmwide research, warned on X on Sunday that the attack was still ongoing. He urged any users who had received funds to move them out of Coldcard-generated addresses immediately if they had not already done so. The implication for investors and traders is straightforward: compromised custody can translate into sudden market liquidity shifts, forced sell decisions, and heightened operational risk—not just for large-volume actors, but for the many users who keep relatively modest balances.

What’s driving the exploit theory

Thorn’s warning focused on the technical root cause described in connection with the compromise: an alleged weakness in Coldcard’s seed generation process. The concern raised in the reporting is that the process did not employ a “genuinely random” number generator.

That distinction matters for security analysis. Seed generation flaws are particularly damaging because they affect how private keys are derived. Unlike a purely software-side vulnerability that might be patchable at the wallet’s interface, a seed-generation issue can impact the determinism of wallet recovery—meaning attackers may be able to reproduce or narrow down keys used by affected devices.

Investors should watch custody risk as the story develops

Coldcard-related events highlight a larger dynamic in crypto risk management: as incidents emerge, the immediate follow-through on-chain often tells you more about user priorities than public assurances. The combination of multi-address losses on one side and heightened transfer activity—particularly smaller transfers—on the other suggests users are making fast decisions about where their funds should sit next.

For anyone holding Bitcoin secured by hardware-generated addresses, the practical takeaway is to treat custody updates as time-sensitive. Even when the broader market trades quietly, custody failures can cause localized surges in withdrawals and spending activity that ripple outward through liquidity and exchange flows.

Moving forward, readers should focus on whether the estimated loss totals continue to rise and whether on-chain transfer patterns remain elevated beyond the initial reaction window—signals that can help determine whether the worst phase is truly over or if additional affected addresses are still being targeted.