Coldcard Wallet Flaw Triggers Bitcoin Transfers Near Post-FTX Peak

Small Bitcoin holders are moving coins at the fastest pace since the FTX collapse, as a Coldcard firmware issue fuels renewed scrutiny of self-custody security. CryptoQuant data cited by research head Julio Moreno shows transfers below 1 BTC totaled 39,600 BTC on Friday, the highest daily reading since November 2022. Moreno compared the figure with 39,900 BTC moved on Nov. 16, 2022, days after FTX filed for Chapter 11 on Nov. 11, according to court records. The latest surge sits about 300 BTC below that earlier peak. The metric does not reveal destinations for each transfer, but the timing aligns with warnings aimed at Coldcard users. The pattern points to defensive wallet migration rather than broad accumulation. The distinction is important: exchange inflows can signal selling, while wallet-to-wallet moves often reflect security-driven repositioning. Galaxy Research said it identified three suspected attack waves tied to Coldcard-generated addresses, tracking 1,367 BTC across 4,585 impacted addresses. In the third wave, an additional 207.7 BTC was drained from 1,912 addresses between July 31 and Aug. 1. Galaxy estimated total losses at about $88.6 million at current prices, placing the incident among the largest disclosed Bitcoin wallet thefts of 2026. Alex Thorn, head of research at Galaxy Digital, said investigators are still mapping victims and attacker-controlled addresses and urged potentially exposed users to move funds tied to affected seeds. Early tracking showed the stolen BTC remained concentrated in attacker-controlled wallets, with no broad exchange deposits reported. Coinkite issued a security advisory on July 30 after users reported missing funds, saying certain firmware produced seeds with insufficient entropy. The advisory covers Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, as well as earlier fixed-release versions across Mk4, Mk5 and Q devices. Coinkite said updates can prevent unsafe seed generation going forward, but cannot repair seeds created under affected software. Block's Bitcoin Engineering and Security team traced the issue to a random-number generator integration error, where code relied on a deterministic software fallback instead of intended hardware entropy. Block said newer devices add secure-element entropy but retained only 32 bits during reseeding, leaving a smaller candidate space than users expected. Coinkite has released corrected firmware across all affected models and release tracks and recommends generating new seeds after installing the updated versions. The company added that strong BIP-39 passphrases can reduce immediate exposure, but still advised migration because passphrases do not fix weakened seeds. The incident has reignited debate over self-custody versus ETFs. Casa CEO Nick Neuman argued that self-custody has not "failed," saying distributed ownership gives users time to respond and estimating self-custody protects roughly ten times more Bitcoin than attackers stole, though he noted totals remain uncertain while exposed balances are assessed. Bloomberg ETF analyst Eric Balchunas made the counterpoint that Bitcoin funds offer familiar safeguards and easier access for many investors. Bitcoin traded near $63,124 on Sunday as users weighed operational risk. The Coldcard issue reflects a seed-generation failure at one provider, not a breakdown of Bitcoin's settlement network. Still, the losses underscore that hardware custody depends on firmware quality, entropy sources and timely migration practices. Coinkite said its investigation is ongoing and that a formal technical review is forthcoming, alongside additional tracking from Galaxy. The post Bitcoin News: Coldcard Hack Pushes Transfers to FTXEra High appeared first on The Coin Republic.