Coldcard Got Absolutely Mugged—And Now Everyone's Running Back to Exchanges

Nearly 1,367 bitcoin—almost $89 million—has vanished from 4,585 addresses in three distinct waves of attacks. The Coldcard hardware wallet vulnerability has triggered something remarkable: small holders fleeing self-custody and stampeding back to centralised exchanges. This is the exact opposite of what happened after FTX imploded in late 2022, when everyone swore off exchanges forever.

The technical failure is almost banal in how it broke everything. A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator instead of the proper STM32 hardware random number generator. Translation: supposedly unguessable seed phrases became computationally enumerable. Attackers reconstructed private keys without ever touching the devices. On July 30 alone, an attacker drained 1,196 Bitcoin addresses in 41 minutes, taking 1,082.65 BTC worth about $70.2 million at the time.

The on-chain reaction was brutal. Exchange deposit volumes spiked immediately. River received an estimated 3,679 BTC on July 31, followed by Binance with 3,224 BTC, Kraken with 2,848 BTC, and OKX with 1,291 BTC. Total net exchange inflows hit 11,163 BTC that single day. The pattern is unmistakable: security-conscious users decided that a potentially dodgy exchange looked safer than their supposedly unhackable hardware wallet.

This wasn't institutional fraud like FTX. This was a subtle engineering error sitting in publicly available open-source firmware for over three years, waiting to be exploited. Whether the vulnerability was discovered manually or with AI tools remains unknown—but either way, it worked perfectly.

Lorenzo Valente, director of digital asset research at ARK Invest, didn't mince words: "The self-custodial hardware space is a disaster at this point and creates more bad rep for the industry than anything else." He's right. Consumers traded counterparty risk for software risk, hardware risk, supply-chain risk, phishing risk, backup risk, and the possibility of losing everything through one mistake. According to Valente, you're better off holding funds across several publicly-traded exchanges or ETFs.

The remediation process has likely accelerated the exodus to exchanges. Coinkite shipped emergency firmware on July 31, but installing it does nothing for an existing seed—it's already compromised. After updating the firmware, users need to create a new wallet and migrate funds onchain to fresh addresses. That's a two-step dance that takes time and introduces operational friction. For nervous bitcoin holders, a temporary deposit on an exchange looks like a pragmatic holding pattern while they figure out the migration.

The incident highlights how rapidly cybersecurity threats are evolving as artificial intelligence lowers the cost of discovering software vulnerabilities. A subtle hardware wallet flaw that persisted for years has now cost users at least $38 million by some measures, closer to $89 million by others. It's one of the biggest failures of Bitcoin self-custody to date.

The whole thing inverts the narrative that crypto advocates have been pushing since FTX: that self-custody is always better, that exchanges are the real enemy, that hardware wallets are the answer. Turns out the answer is far messier. Hardware wallets are only as good as the firmware running them. Exchanges are only as safe as their solvency. There's no clean solution here, just a series of trade-offs, each one sharp enough to draw blood.

Source & further reading:

• Unlike the FTX collapse, the $89 million Coldcard exploit has investors sending bitcoin back to exchanges — CoinDesk
• Strategy holds STRC dividend at 12% — CoinDesk
• Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million — CoinDesk
• Tokenized stock trading surged 288% in July, but one QQQ token drove most of it — CoinDesk
• Bank of Italy research suggests stablecoins aren't necessarily cheaper for remittances — CoinDesk