Bitcoin transfers under 1 BTC surged to their highest daily level since the collapse of cryptocurrency exchange FTX, as an ongoing suspected Coldcard hack continued to unfold.

Coldcard, a Bitcoin-only hardware wallet produced by Coinkite, has been widely adopted among self-custody advocates for its air-gapped design that keeps private keys offline — a feature that has made the suspected compromise especially alarming for users who viewed hardware wallets as the most secure storage option.

On Friday, small Bitcoin transfers below 1 BTC reached 39,600 BTC — the highest daily volume since November 2022, according to data shared by CryptoQuant head of research Julio Moreno on Saturday. The figure fell just 300 BTC short of the 39,900 BTC transferred on November 16, 2022, days after FTX filed for bankruptcy in one of the largest exchange failures in crypto history — a collapse that erased billions in customer assets and accelerated a shift toward self-custody solutions.

"The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse," Moreno said, adding that he was encouraged to see users "taking action."

As the suspected hack against Coldcard hardware wallet users continues, the incident has become a wider test for Bitcoin self-custody, reigniting debate over whether users are better served by controlling their own funds or relying on third-party platforms.

Galaxy Research Tracks Three Attack Waves

The spike in small transfers came as researchers continued to identify new victims of the suspected Coldcard hack, which first surfaced in late July and appeared to remain active at the time of publication.

Galaxy Research, the research arm of crypto investment firm Galaxy Digital, reported on Saturday that the most recently identified wave drained an additional 207.7 BTC, valued at approximately $13.2 million. The theft brought total estimated losses to 1,367 BTC ($88.6 million) across 4,585 addresses.

Alex Thorn, Galaxy Digital's head of firmwide research, warned in an X post on Sunday that the attack was still ongoing and urged users who had not already done so to move funds from Coldcard-generated addresses immediately. Thorn said his team continued to identify new victim and attacker addresses, noting that user reports had helped researchers and authorities track stolen funds.

Self-Custody Debate Reignited

The suspected Coldcard hack has reignited debate over the risks and benefits of Bitcoin self-custody, a foundational crypto principle that enables users to control their funds without relying on intermediaries. The incident is particularly notable because hardware wallets like Coldcard are generally regarded as the gold standard for personal Bitcoin storage, keeping private keys on devices disconnected from the internet.

Nick Neuman, CEO of Bitcoin security company Casa, pushed back against claims that "self-custody is over," arguing that its distributed nature gave users time to react. He estimated that potentially 10 times more Bitcoin was protected through self-custody than was stolen and identified in the attack so far.

The debate also drew responses from traditional finance supporters. Eric Balchunas, senior ETF analyst at Bloomberg, said that Bitcoin exchange-traded funds (ETFs) offer a safer and more convenient alternative for many users, citing the long operating history of the ETF industry. US spot Bitcoin ETFs, approved in January 2024, have provided investors with a regulated way to gain Bitcoin exposure without managing private keys directly. Others countered, arguing that the Coldcard incident represented a failure of one wallet provider rather than a failure of self-custody itself.

Related: SecondFi to wind down after $2.6M ADA theft linked to wallet flaw

Magazine: A quantum roadmap would push Bitcoin much higher: Charles Edwards