Small Bitcoin holders moved coins on July 31 at a rate not seen since the collapse of FTX, according to CryptoQuant, as news spread that ColdCard—a Bitcoin-only hardware wallet manufactured by Toronto-based Coinkite—had been generating guessable keys for five years.

Transfers of less than 1 BTC totaled 39,600 BTC (around $2.5 billion) that day, the firm's Head of Research Julio Moreno tweeted. The last comparable figure was 39,900 BTC on November 16, 2022, days after FTX failed.

The Bitcoin plebs had not move this amount of BTC in a day since the FTX collapse.

39.6K BTC transferred on July 31st after the coldcard hack, 39.9K BTC transferred on November 16 2022, a few days after the FTX collapse.

These are Bitcoin transfers < 1 BTC.

I like to see that… pic.twitter.com/c7Qzx7za6M

— Julio Moreno (@jjcmoreno) August 2, 2026

Daily active addresses rose from 645,000 on July 30 to almost a million on July 31, the highest level since December 2024, with the jump concentrated in sending addresses rather than receiving ones.

Exchange Deposits Surge

A portion of the moved coins went to exchanges. Deposits made up of sub-10 BTC transfers hit 7,300 BTC ($459 million) on July 31, the most since February 6, CryptoQuant said. Moreno linked the move to the ColdCard breach, saying people appeared to be shifting holdings "looking for safety," while noting the connection was not certain.

Notably, Bitcoin's price barely moved amid the wave of exchange deposits, suggesting that users were moving their coins to secure them rather than sell. Bitcoin is currently trading at $62,724, down 0.7% over the past day, per CoinGecko data.

The ColdCard Exploit

The ColdCard flaw dates to a March 2021 firmware build error that left seed phrases drawn from far too small a pool. Under the BIP39 standard that governs Bitcoin wallet recovery phrases, seeds should carry a minimum of 128 bits of entropy—enough to make brute-force guessing computationally infeasible. Galaxy Research logged three waves of thefts by Saturday, totaling 1,367 BTC across 4,585 addresses—up from $38 million when the flaw was disclosed and $70 million when Binance founder Changpeng Zhao warned holders.

A fourth wave is likely under way. Galaxy Research's Alex Thorn flagged sweeps across 15 consecutive blocks on Monday, running at roughly 45 times the normal rate. After correcting a set that had wrongly included multisig addresses, Thorn put the wave at 709 addresses and 448.73 BTC ($28 million). That would take the running total to about 1,816 BTC, near $114 million. Thorn added a caveat that no victim has yet confirmed the fourth wave, which rests on pattern matching.

🚨 LIKELY 4TH ORGANIZED WAVE COLDCARD ATTACK OCCURRING RIGHT NOW

THERE ARE STILL SIMILAR TXS IN THE MEMPOOL WAITING TO BE CONFIRMED AND THE PREVIOUSLY-CONFIRMED TXS SIGNAL RBF OPT-IN, CHECK YOUR FUNDS AND YOU MAY BE ABLE TO RBF YOUR WAY OUT OF THIS

pattern identified: blocks…

— Alex Thorn (@intangiblecoins) August 3, 2026

Some sweeps were still sitting unconfirmed in the mempool and had opted into replace-by-fee (RBF), a Bitcoin feature that lets a sender substitute an unconfirmed transaction with one carrying a higher fee. This means holders who act quickly and pay a high fee may be able to outbid the attacker. None of the addresses hit in the first three waves were multisig.

"A Wake-Up Call"

Kraken Chief Security Officer Nick Percoco called the incident a "wake-up call for the entire hardware wallet industry." ColdCard's Mk4, Mk5, and Q models ship with certified secure elements, he noted, yet their seeds still came out at around 72 bits of entropy—well below the 128-bit BIP39 minimum—because the certification covered the component itself while nobody verified which code path actually ran. Hardware wallets are widely regarded as among the most secure options for self-custody of cryptocurrency, which places the entropy gap at the center of broader questions about how the industry validates the security claims behind those devices.

— Nick Percoco (@c7five) August 2, 2026

Percoco called for independent lab validation of entropy sources, bound to specific firmware versions and listed in a public registry, as payment terminals already require. He added that Coinkite's hotfix now fails the build unless the correct generator is linked in—a control he said took about 48 hours to write once the company knew what to look for. Affected users who update their firmware are advised to generate a new wallet with a freshly created seed phrase and transfer any remaining funds before retiring the compromised recovery words.