Bitcoin News: Coldcard was hacked, transfer volume soared to FTX era high

Key Insights

Bitcoin News tracks the largest small wallet transfer since the FTX crash.

Galaxy Research linked 1,367 bitcoins to three suspected attack waves.

Coldcard's firmware flaw rekindled discussions about the risks of Bitcoin self-custody.

Small bitcoin holders are moving money at the fastest rate since the FTX crash. CryptoQuant data showed that transfers below 1 BTC reached 39,600 bitcoins last Friday. This trend has shifted the focus of Bitcoin news to wallet security and custody risks.

This activity is important because it reflects defensive migration rather than widespread hoarding. A firmware flaw exposes weak seed generation mechanisms in multiple Coldcard models. Bitcoin traded at around $63,124 on Sunday, and users were assessing the risks of self-custody.

Bitcoin News tracks a surge in small transfers

Julio Moreno, head of research at CryptoQuant, said that transfers below 1 BTC reached 39,600 bitcoins last Friday, setting a single-day high since November 2022. Bitcoin spending output value range. Moreno compared this data with 39,900 bitcoins as of November 16, 2022. Court records show that the surge in transfers occurred after FTX filed for bankruptcy protection on November 11.

The most recent transfer volume was only 300 bitcoins lower than the previous peak. Moreno said small holders had never moved funds of this magnitude since the collapse of the exchange. The data does not show the final destination of each transfer, but the timing of its occurrence coincides with warnings for Coldcard users. As such, this model suggests wallet migration, although CryptoQuant has not yet classified every transaction. This distinction is important because depositing on an exchange may mean selling, while wallet transfers may reflect security measures.

Bitcoin News Focus on Three Coldcard Attack Waves

Galaxy Research identified three suspected Attack Waves targeting Coldcard generated addresses. Its analysis tracked 1,367 bitcoins in 4,585 affected addresses. Bitcoin lost from Coldcard wallet. The third wave of attacks transferred an additional 207.7 bitcoins from 1,912 addresses between July 31 and August 1. Previous waves of attacks used different wallet quantities and transaction patterns.

Based on the findings of Galaxy Research, the loss is estimated at approximately US$88.6 million at current prices. This total ranks among the largest Bitcoin wallet thefts disclosed in 2026. Alex Thorne, director of research at Galaxy Digital, said investigators are still identifying victim and attacker addresses. He also urged exposed users to move funds out of affected seeds. In preliminary tracking, stolen bitcoins are still concentrated in addresses controlled by attackers, and researchers have not reported large amounts of these wallets deposited on exchanges.

Coldcard firmware defect exposure weak seed generation

Coinkite issued a security advisory on July 30 after users reported missing funds. The company said the affected firmware generated insufficient entropy of seeds. The announcement covers firmware versions from 4.0.1 to 4.1.9 for Mk2 and Mk3 models, as well as early fixed versions on Mk4, Mk5 and Q devices. Coinkite said firmware updates prevent unsafe seed generation, but cannot repair seeds created under affected software.

Block's Bitcoin engineering and security team traced the flaw to a random number generator integration error. The code uses deterministic software fallback rather than expected hardware entropy. Block said newer devices have increased the safety element entropy, but only 32 bits are retained when re-sowing. This structure results in a smaller candidate space than users expected. Coinkite has released revised firmware for all affected models and releases, and recommends that users generate new seeds after installing the revised version. The company also said that strong Bitcoin improvements Proposal 39 passphrase could reduce direct exposure, but still recommended migration because passphrase cannot repair the seeds of weakening.

Bitcoin news rekindled the battle between self-custody and ETFs

Casa CEO Nick Newman dismissed claims that self-custody failed. He believes that distributed ownership gives users time to respond. Newman estimates that the amount of money protected by self-custody is about ten times the amount stolen by attackers. His estimates remain directional because the total exposure balance is unclear. Eric Balchunas, an analyst at Bloomberg exchange-traded funds, offers the opposite view of custody. He said Bitcoin funds provide familiar security guarantees and simpler access methods for many investors.

This comparison distinguishes asset exposure from direct ownership. Fund shareholders hold regulated securities, while self-custodial users control private keys and trading rights. Therefore, the Coldcard failure tests a vendor's seed generation process, not Bitcoin's settlement network. Still, the loss suggests that hardware hosting depends on firmware, entropy and migration practices. For Bitcoin cryptocurrency investors, the current issue remains operational rather than directional. Bitcoin price response is limited, while wallet transfers are accelerating.

Coinkite said its investigation was still ongoing and promised to release a formal technical review report. The report and further follow-up of galactic research will provide the next verifiable progress.