Coldcard Wallet Flaw Sparks $15B Bitcoin Move as Theft Nears $130M

CoinDesk reports that fallout from a security issue affecting the Coldcard hardware wallet has triggered unusually large on-chain fund movements. Several institutional data sources estimate that about 233,000 BTC were moved out of long-term holder addresses in the window around the incident—roughly $15 billion at the prices cited—far eclipsing the attack's direct losses. Reported stolen funds are nearing $130 million. The incident began July 30, when an attacker exploited a key-generation weakness in Coldcard firmware and gradually drained affected wallets. Multiple reports put the theft at about 2,100 BTC, or close to $130 million. Galaxy Research said it has verified three attacks and that more than 5,200 addresses were impacted, with losses totaling roughly 1,596 BTC. Checkonchain's on-chain figures indicate a higher stolen total of around 2,100 BTC. As thefts continued, broader migrations appeared in the chain data. Checkonchain estimates roughly 233,000 BTC exited long-term holder wallets around the incident. Long-term holders are typically defined as addresses that have not moved coins for at least 155 days and are viewed as a relatively steady cohort. The same dataset also shows about 22,000 BTC flowing into exchanges. Glassnode data aligns with the shift: long-term holder supply fell from nearly 15 million BTC to about 14.7 million, the steepest weekly drop since December 2024. Casa CEO Nick Neuman said the transfers did not all originate from Coldcard users. Based on customer communications, some moves reflected Coldcard holders migrating to multisignature wallets, while some came from Ledger and Trezor users adjusting custody practices after the news. Multisig setups require multiple independent keys to authorize a transaction, reducing the risk that a single compromised device can drain funds. On-chain flows also show some bitcoin moving to exchanges, suggesting certain users prioritized liquidity before deciding on longer-term custody. Coinkite has advised that any mnemonic generated on firmware versions 4.0.1 through 4.1.9 between March 2021 and July 2026 should be treated as compromised, and users should migrate funds to a new seed wallet as soon as possible.