Galaxy

<p>Recent activity around Coldcard hardware wallets has reignited concerns about the safety of seed generation. Galaxy Research, the research arm of Galaxy Digital, estimates that a third weekend wave of attacks tied to Coldcard-generated addresses resulted in losses totaling 1,367 <a href="https://coinstats.app/coins/bitcoin/" rel="noopener noreferrer nofollow">BTC</a> (about $88.6 million) across 4,585 addresses.</p>
<p>At the same time, on-chain data suggests that smaller <a href="https://coinstats.app/coins/bitcoin/" rel="noopener noreferrer nofollow">Bitcoin</a> holders have been moving quickly toward exchanges or other custody routes. CryptoQuant head of research Julio Moreno said that on Friday, <a href="https://coinstats.app/coins/bitcoin/" rel="noopener noreferrer nofollow">Bitcoin</a> transfers below 1 <a href="https://coinstats.app/coins/bitcoin/" rel="noopener noreferrer nofollow">BTC</a> reached their highest daily level since 2022, with 39,600 BTC moved—just 300 BTC shy of the 39,900 BTC figure recorded on Nov. 16, 2022, shortly after FTX filed for bankruptcy.</p>
<h2 id="key-takeaways">Key takeaways</h2>
<ul>
 <li>Galaxy Research estimates weekend Coldcard-related losses at 1,367 BTC across 4,585 addresses.</li>
 <li>CryptoQuant data shows sub-1 BTC transfers spiking to the highest daily level since 2022, indicating rapid fund reallocation by smaller users.</li>
 <li>Galaxy Digital’s Alex Thorn said the attack activity was still ongoing and urged users to move funds immediately from affected Coldcard-generated addresses.</li>
 <li>The reported exploit is linked to a flaw in Coldcard seed generation that allegedly did not rely on a “genuinely random” number generator.</li>
</ul>
<h2 id="coldcard-compromise-spills-into-user-behavior">Coldcard compromise spills into user behavior</h2>
<p>The Coldcard incident is notable not only for the size of estimated losses, but also for how quickly it is changing user behavior on-chain. After reports of stolen funds, many holders appear to be reducing their exposure to the compromised wallet ecosystem and shifting to more liquid venues.</p>
<p>Moreno’s CryptoQuant observations place this movement in a broader pattern: transfers below 1 BTC spiked to 39,600 BTC on Friday, the highest daily level since 2022. While the reasons behind sub-1 BTC movement can vary, a move of this magnitude is consistent with panic-driven consolidation—especially among smaller holders who may prefer centralized exchanges for speed, or for services they believe are better insulated from the specific failure mode described in the Coldcard case.</p>
<h2 id="galaxy-research-tracks-the-scope-of-weekend-losses">Galaxy Research tracks the scope of weekend losses</h2>
<p>In its Saturday update, Galaxy Research said the third weekend wave brought estimated losses to 1,367 BTC, spread across 4,585 addresses. Earlier coverage cited a similar on-chain extraction profile during previous waves of attacks, reinforcing that the incident did not appear to stop after the first report.</p>
<p>Alex Thorn, Galaxy Digital’s head of firmwide research, warned on X on Sunday that the attack was still ongoing. He urged any users who had received funds to move them out of Coldcard-generated addresses immediately if they had not already done so. The implication for investors and traders is straightforward: compromised custody can translate into sudden market liquidity shifts, forced sell decisions, and heightened operational risk—not just for large-volume actors, but for the many users who keep relatively modest balances.</p>
<h2 id="what-s-driving-the-exploit-theory">What’s driving the exploit theory</h2>
<p>Thorn’s warning focused on the technical root cause described in connection with the compromise: an alleged weakness in Coldcard’s seed generation process. The concern raised in the reporting is that the process did not employ a “genuinely random” number generator.</p>
<p>That distinction matters for security analysis. Seed generation flaws are particularly damaging because they affect how private keys are derived. Unlike a purely software-side vulnerability that might be patchable at the wallet’s interface, a seed-generation issue can impact the determinism of wallet recovery—meaning attackers may be able to reproduce or narrow down keys used by affected devices.</p>
<h2 id="investors-should-watch-custody-risk-as-the-story-develops">Investors should watch custody risk as the story develops</h2>
<p>Coldcard-related events highlight a larger dynamic in crypto risk management: as incidents emerge, the immediate follow-through on-chain often tells you more about user priorities than public assurances. The combination of multi-address losses on one side and heightened transfer activity—particularly smaller transfers—on the other suggests users are making fast decisions about where their funds should sit next.</p>
<p>For anyone holding Bitcoin secured by hardware-generated addresses, the practical takeaway is to treat custody updates as time-sensitive. Even when the broader market trades quietly, custody failures can cause localized surges in withdrawals and spending activity that <a href="https://coinstats.app/coins/ripple/" rel="noopener noreferrer nofollow">ripple</a> outward through liquidity and exchange flows.</p>
<p>Moving forward, readers should focus on whether the estimated loss totals continue to rise and whether on-chain transfer patterns remain elevated beyond the initial reaction window—signals that can help determine whether the worst phase is truly over or if additional affected addresses are still being targeted.</p>
<p>This article was originally published as <a href="https://www.cryptobreaking.com/coldcard-exploit-drives-bitcoin-outflows/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Coldcard exploit drives Bitcoin outflows as “hodlers” consolidate—Aug 2 digest</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.</p>

Coldcard exploit drives Bitcoin outflows as “hodlers” consolidate—Aug 2 digest

Table of Contents

Crypto Breaking News

Other articles published on Aug 3, 2026

Join our free newsletter for daily crypto updates!