Bitcoin Investors React Differently to Coldcard Exploit, Moving Coins Back to Exchanges Instead of Withdrawing

The Coldcard security breach has caused some smaller Bitcoin holders to move their funds onto exchanges, according to blockchain analytics firms. The shift is the opposite of the market response after FTX collapsed in late 2022, when investors moved their crypto away from centralized platforms and into self-custody wallets.

Crypto investors often change their storage habits following major security events. After FTX filed for bankruptcy in November 2022, concerns over exchange solvency and potential withdrawal freezes led users to withdraw significant amounts of Bitcoin and transfer their holdings into personal wallets and hardware devices.

The latest Coldcard incident has triggered a different reaction. With renewed concerns about hardware wallet security, some Bitcoin holders are moving assets back to exchanges as a temporary safety measure.

“Daily Bitcoin exchange deposits involving transfers below 10 BTC jumped to 7,300 BTC on Friday, the highest level since Feb. 6. This may be connected to the Coldcard hack, as users move funds while looking for safety,” said Julio Moreno, head of research at CryptoQuant.

Coldcard Exploit Details

Coldcard, a Bitcoin-only hardware wallet developed by Canadian company Coinkite, is facing a significant security incident after a firmware flaw weakened the seed-generation process on certain devices.

The attacks began on July 30 and continued through multiple waves. On-chain analysts estimate that between 1,000 and 1,300 BTC, valued at roughly $70 million to $90 million, has been stolen from more than 1,000 addresses. Researchers believe additional attacks may still be underway.

The attackers took advantage of a vulnerability dating back to March 2021, which caused some Coldcard devices to use a predictable software-based random number generator instead of the built-in hardware random number generator when creating new wallets.

This reduced the security of recovery seeds, allowing attackers to reconstruct possible seed phrases offline and obtain private keys without needing physical access to the affected devices.

The incident has sparked broader debate about the reliability of hardware wallets and the risks associated with self-custody. Industry figures, including Binance founder Changpeng Zhao (CZ), have highlighted the importance of spreading risk across different storage methods.

Bitcoin Exchange Activity Rises

CryptoQuant data shows that Bitcoin transfers to exchanges have increased significantly, reversing the trend observed after the FTX collapse.

On July 31, Bitcoin deposits involving transactions smaller than 10 BTC reached 7,300 BTC, marking the highest level since Feb. 6.

Daily active Bitcoin addresses also climbed from 645,000 on July 30 to nearly 1 million on July 31, the highest reading since Dec. 10, 2024. The majority of the increase came from wallets sending BTC to exchanges.

Moreno said the movement suggests users transferred their holdings out of caution following the Coldcard exploit.

Smaller Bitcoin transactions showed similar behavior. CryptoQuant data revealed that transfers below 1 BTC totaled 39,600 BTC on Friday, close to the 39,900 BTC moved on Nov. 16, 2022, shortly after FTX’s bankruptcy announcement.

Moreno said smaller Bitcoin holders had not moved such a large amount of BTC in a single day since the FTX collapse, viewing the activity as a sign that users were taking protective action.

Blockchain analyst Timechainindex reported that Bitcoin exchange net inflows reached 11,163 BTC on July 31, with much of the volume moving into major platforms and firms such as Binance, River, Kraken, and OKX.

The analyst described the transfers as a response from cautious holders concerned about wallet security.

Bitcoin held in exchange-linked wallets has risen to 2.715 million BTC, compared with 2.703837 million BTC before the Coldcard incident.

Why This Differs From FTX

The FTX collapse centered on concerns over centralized exchange failures, insolvency, and frozen withdrawals. Investors responded by moving Bitcoin away from exchanges and increasing their use of self-custody.

The Coldcard breach presents a different challenge, focusing on vulnerabilities within self-custody tools themselves. As a result, some users have temporarily moved smaller BTC holdings back onto exchanges.

However, the issue remains limited to affected Coldcard devices and does not indicate a wider failure of self-custody. Most hardware wallets and properly generated recovery seeds remain unaffected.