Coldcard exploit coincides with retail-sized BTC rushing back to exchanges
Sub-10 BTC deposits hit 7,300 BTC on July 31 as net inflows turned positive and exchange balances rose to 2.715M BTC.
A Coldcard seed-generation exploit is coinciding with a sharp reversal in Bitcoin custody flows, with smaller holders pushing coins onto centralized exchanges instead of pulling them off. On-chain metrics for July 31 show a spike in sub-10 BTC deposits, a jump in active addresses, and more than 11,000 BTC of net exchange inflows.
Key Takeaways
- Estimated losses tied to the Coldcard incident reached 1,000–1,300 BTC ($70–$90 million) across more than 1,000 addresses, with thefts starting July 30 and continuing in waves.
- The exploit traces back to a March 2021 flaw where some devices could fall back to a predictable software RNG during seed generation, weakening entropy and enabling offline seed reconstruction without physical access.
- Sub-10 BTC daily deposits to exchanges jumped to 7,300 BTC on July 31, the highest print since Feb. 6, as daily active addresses climbed from 645,000 to nearly 1,000,000.
- Net exchange inflows totaled 11,163 BTC on July 31, and BTC held in exchange-tied wallets rose to 2.715 million from 2.703837 million before the exploit.
Coldcard Exploit Triggers a Rush Back to Exchanges
The flow is the story. July 31 printed 7,300 BTC of daily exchange deposits in transactions under 10 BTC, per CryptoQuant data. That is the highest level since Feb. 6.
Activity followed the same direction. Daily active Bitcoin addresses rose from 645,000 on July 30 to almost 1,000,000 on July 31, the highest since Dec. 10, 2024, according to CryptoQuant. The key detail is composition: most of the incremental addresses were sending coins to exchanges.
Timechainindex put a second stamp on the same behavior, estimating total net inflows to exchanges at 11,163 BTC on July 31, with most of that flow into Binance, River, Kraken, and OKX. Exchange-associated wallet balances also rose to 2.715 million BTC from 2.703837 million BTC before the exploit.
This is the inversion of the post-FTX reflex. In late 2022, the market treated centralized platforms as the primary failure point and pulled coins into self-custody. Here, the catalyst is a self-custody product risk, and the immediate response is to park coins back on venues.
How a 2021 RNG Fallback Turned Seed Phrases Into a Target
The exploit sits at the seed layer. A seed phrase is the master backup that can recreate a wallet and spend its funds. If an attacker can reconstruct the seed, the rest is just key derivation.
Researchers tied the incident to a flaw dating back to March 2021 in which some Coldcard units could fall back to a predictable software random number generator instead of using the device’s hardware RNG when creating new wallets. Hardware RNGs draw randomness from physical processes. Software RNGs can be predictable if the implementation or fallback path is weak. Predictability is the problem. Lower entropy means fewer possible seeds to search.
That entropy reduction is what turns this into an offline attack. The mechanism described is straightforward: weakened randomness makes it possible to reconstruct likely seed phrases offline and derive private keys without ever touching the physical device. No device access is the part that changes the threat model.
Loss estimates are still a range. On-chain analysts tracked multiple exploit waves beginning Friday, July 30, with losses estimated at 1,000–1,300 BTC, roughly $70–$90 million, across more than 1,000 addresses. The largest bursts moved hundreds of BTC in under an hour. Researchers said the attacks may be ongoing as of Aug. 2, which keeps the upper bound open.
CryptoQuant contributor Julio Moreno framed the behavior as caution-driven: “Seems people really moved their Bitcoin out of extreme caution after the coldcard hack,” he said.
Flow Reversal vs. Post-FTX: What the Retail-Sized Deposits Suggest
The market implication is not automatic selling. It is optionality. Coins on exchanges are coins that can be sold quickly, posted as collateral, or rotated into derivatives margin without an on-chain round trip. That is why exchange net inflows get treated as a proxy for potential sell-side supply.
The retail sizing matters. CryptoQuant also tracked the combined volume of all transfers smaller than 1 BTC reaching 39,600 BTC on Friday, near the 39,900 BTC moved on Nov. 16, 2022, the day after FTX filed for bankruptcy. Moreno’s read was blunt: “The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse,” adding that he liked seeing people “taking action.”
Timechainindex characterized the same flow as fear-driven. “These are plebs who are scared,” the handle wrote on X, describing the nature of the BTC moving onto exchanges.
The second-order effect is a custody-risk regime shift, even if temporary. Post-FTX, the dominant perceived risk was exchange insolvency and withdrawal freezes, so the market’s defensive move was to withdraw and reduce exchange balances. This episode is narrower. It is tied to a single hardware wallet product, and the source framing is explicit that most hardware wallets and properly generated seeds remain unaffected. But the flow data says the marginal holder is not waiting around to parse that nuance.
If the exploit waves continue, the impulse can persist. If the incident is contained quickly, the flow reversal can mean little more than a short-lived safety trade that fades as soon as confidence returns.
Signals Traders Can Track as the Incident Develops
The cleanest signal is whether the July 31 retail-sized deposit spike repeats. Another daily print near or above 7,300 BTC in sub-10 BTC deposits would confirm this is not a one-day panic transfer.
Net inflows and exchange balances are the next layer. Timechainindex’s 11,163 BTC net inflow day is the kind of number that can distort short-term supply dynamics if it persists. The follow-through is whether exchange-tied wallet balances keep rising from roughly 2.715 million BTC, or whether the balance increase stalls and reverses.
The incident status is the gating item. Researchers said attacks may be ongoing as of Aug. 2, and the loss estimate remains 1,000–1,300 BTC across more than 1,000 addresses. Confirmation that the exploit waves have stopped would likely reduce the urgency driving coins onto venues.
Finally, watch participation. Daily active addresses near the ~1,000,000 level matter less as a headline and more as a composition check. The key question is whether incremental activity remains dominated by exchange-directed sends.
My Read: Custody Risk Is Rotating, Not Disappearing
The threshold that matters is persistence, not the first spike. One day of 7,300 BTC in sub-10 BTC deposits can be a scramble. Multiple days at that level starts to look like a behavioral shift where small holders temporarily price self-custody as the higher-risk option.
If net inflows stay positive after the 11,163 BTC day and exchange-held BTC keeps climbing from ~2.715 million, the setup becomes structural rather than narrative-driven: more BTC sitting where it can become sell-side supply on short notice.
