The Coldcard security issue has prompted some smaller Bitcoin holders to move their assets back onto exchanges for added protection, according to blockchain analytics firms. This response is the reverse of what happened after the FTX collapse in 2022, when users withdrew funds from centralized exchanges and shifted them into self-custody wallets.
Crypto market participants often change their storage behavior after major security events. When FTX failed in November 2022, fears over exchange solvency and frozen withdrawals pushed investors to remove large amounts of Bitcoin from centralized platforms and store coins in personal wallets and hardware devices.
The latest Coldcard exploit has produced the opposite reaction. Concerns over a vulnerability affecting certain hardware wallets have caused some holders to temporarily return their BTC to exchanges, highlighting renewed uncertainty around self-custody solutions.
“Daily Bitcoin exchange deposits involving transfers below 10 BTC climbed to 7,300 BTC on Friday, the highest level since Feb. 6. This could be connected to the Coldcard exploit as users move funds in search of safety,” said Julio Moreno, head of research at CryptoQuant.
Details Behind the Coldcard Exploit
Coldcard, a Bitcoin-focused hardware wallet created by Canadian company Coinkite, is facing a major security incident after a firmware flaw weakened the seed-generation process on some devices.
The attacks started on Friday, July 30, and continued across multiple waves. Blockchain researchers estimate that between 1,000 and 1,300 BTC, valued at approximately $70 million to $90 million, has been stolen from more than 1,000 addresses. Analysts have warned that the exploitation may not yet be complete.
The attackers exploited a vulnerability dating back to March 2021 that caused certain Coldcard devices to rely on a predictable software-based random number generator rather than the built-in hardware RNG when generating wallet seeds.
This reduced the strength of the recovery phrases, allowing attackers to reconstruct possible seed combinations offline and derive private keys without needing access to the physical devices.
The incident has raised wider concerns about hardware wallet security and self-custody practices, with industry leaders including Binance founder Changpeng Zhao (CZ) calling attention to the risks of relying on a single storage method.
Bitcoin Exchange Deposits Surge
Data from CryptoQuant shows a significant increase in Bitcoin transfers toward exchanges, reversing the trend observed after the FTX collapse.
On July 31, deposits involving transactions smaller than 10 BTC rose to 7,300 BTC, marking the highest level since Feb. 6.
Bitcoin’s daily active addresses also jumped from 645,000 on July 30 to nearly 1 million on July 31, reaching the highest level since Dec. 10, 2024. Most of the increase came from wallets sending coins to centralized exchanges.
Moreno said the activity suggests users moved Bitcoin because of increased caution following the Coldcard incident.
Smaller Bitcoin transfers reflected the same trend. CryptoQuant data showed that transactions below 1 BTC totaled 39,600 BTC on Friday, just below the 39,900 BTC moved on Nov. 16, 2022, shortly after FTX filed for bankruptcy.
Moreno said smaller Bitcoin holders had not moved this volume of BTC in a single day since the FTX collapse, viewing the activity as users taking steps to protect their holdings.
Blockchain analyst Timechainindex reported similar findings, showing total Bitcoin exchange inflows reached 11,163 BTC on July 31. Much of the inflow went to major platforms and firms, including Binance, River, Kraken, and OKX.
The analyst described the transfers as a response from cautious retail holders concerned about wallet security.
The amount of Bitcoin stored in wallets associated with centralized exchanges has increased to 2.715 million BTC, compared with 2.703837 million BTC before the Coldcard exploit.
A Reversal of the FTX-Era Trend
After FTX collapsed, investors were primarily worried about exchange failures, insolvency, and withdrawal restrictions. The response was a large movement of Bitcoin away from exchanges and into self-custody.
The Coldcard incident presents a different challenge. Instead of reducing exchange exposure, some users are temporarily moving smaller amounts back to centralized platforms due to concerns about hardware wallet vulnerabilities.
However, the issue is limited to affected Coldcard devices and does not indicate a broader failure of self-custody. Most hardware wallets and properly generated recovery seeds remain secure.
