After Coldcard Was Hacked, $15 Billion in Bitcoin Moved to Security – Decrypt

Within the days after the worst {hardware} pockets exploit in Bitcoin’s latest historical past, Casa CEO Nick Neuman started counting extra than simply the BTC being drained from weak Coldcard wallets.

Whereas attackers have been draining Coldcard wallets one handle at a time, 233,000 BTC—price about $15 billion at at the moment’s costs—was quietly shifting looking for security.

The huge and ongoing breach that began on July 30 has already led to shut to $130 million in stolen Bitcoin from Coldcard {hardware} wallets—bodily devices that retailer personal keys completely offline, by no means connecting to the web, and made by Canadian firm Coinkite.

A firmware bug launched in March 2021 had routed key era via a weak software program random quantity generator as a substitute of the gadget’s devoted {hardware} chip. Non-public keys (the key codes that show possession of Bitcoin and authorize any transaction) turned guessable, with safety collapsing from 128 bits to roughly 40—the cryptographic equal of a financial institution vault that seems to have a four-digit PIN.

Galaxy Analysis tracked the fallout throughout three confirmed assault waves, with losses reaching roughly 1,596 BTC throughout greater than 5,200 addresses.

Casa’s Neuman, earlier this week, posted the on-chain numbers from analyst James Test of Checkonchain to make an argument for Bitcoin’s resilience. Self-custody, holding your personal personal keys somewhat than leaving Bitcoin with an alternate or custodian, did not buckle below stress however as a substitute tailored, he argued.

“The onchain metrics across the Coldcard incident reinforce how vital self-custody is to the resilience of Bitcoin as an asset class,” Neuman wrote on X.

The breakdown Neumann cited in his submit, drawing Checkonchain’s onchain knowledge: 2,100 BTC stolen (greater than Galaxy’s personal accouting), and 22,000 BTC moved to exchanges. And 233,000 BTC moved out of long-term holder wallets—addresses dormant for not less than 155 days, a cohort analysts watch as a proxy for critical, affected person buyers—into security. That’s greater than 100 instances what the attackers took.

A few of that got here from Coldcard customers migrating to multisig wallets (setups requiring a number of unbiased keys to approve any transaction, so no single compromised gadget can drain every thing). Some got here from holders on Ledger and Trezor—completely completely different {hardware}—who used the hack as a wake-up name.

Casa confirmed each patterns from precise buyer conversations. “So someplace between ~10x-100x the quantity of bitcoin stolen was moved to security as folks sounded the alarm,” Neuman wrote.

When a centralized alternate will get breached, every thing goes without delay. Right here, the attacker needed to crack addresses individually, incomes a trickle at a time whereas the remainder of the community had time to reply. “It is a big flashing neon signal showcasing the resilience that self-custody provides to the community,” Neuman wrote. “If all that BTC was held at a custodian and the custodian was hacked as a substitute, these numbers would have been flipped.”

Information from analytics firm Glassnode confirms the dimensions: long-term holder provide dropped from practically 15 million BTC to roughly 14.7 million—the most important weekly decline since December 2024. It occurred whereas Bitcoin traded roughly 50% beneath its all-time excessive of $126,000, set in October 2025.

Coinkite has urged anybody who generated a seed on firmware variations 4.0.1 via 4.1.9—masking March 2021 to July 2026—to deal with these wallets as compromised and migrate to a brand new seed instantly.