Galaxy estimates 1,367 BTC Coldcard drain as sub-1 BTC transfers hit 39,600 BTC
The reported third-wave losses span 4,585 addresses, while Senate odds for a Clarity Act vote fade with five days left.
A reported third wave of Coldcard-user drains hit an estimated 1,367 BTC across 4,585 addresses as Galaxy Digital’s Alex Thorn warned the attack was still ongoing and urged users to move funds from Coldcard-generated addresses. The same window saw retail-sized Bitcoin transfers spike to 39,600 BTC in a day, a level last seen during the 2022 FTX-era custody panic, while the Clarity Act’s Senate path appeared to be running out of time.
Key Takeaways
- A reported third wave of attacks tied to Coldcard users drained an estimated 1,367 BTC (about $88.6 million) across 4,585 addresses, based on Galaxy Research’s estimate.
- Bitcoin transfers below 1 BTC totaled 39,600 BTC on Friday, the highest daily level since 2022, per CryptoQuant head of research Julio Moreno.
- Galaxy Digital research head Alex Thorn said the Coldcard attack was still ongoing as of Sunday and urged users to move funds from Coldcard-generated addresses.
- With five days left in the stated window, the odds of any Senate vote on the Clarity Act were described as receding, and passage would still require multiple separate votes.
Coldcard’s reported third-wave drain collides with a retail-sized BTC transfer surge
The number that matters first is breadth. Galaxy Research put the latest Coldcard-linked losses at 1,367 BTC, roughly $88.6 million, spread across 4,585 addresses. That is not a single whale getting clipped. That is a wide surface area event, the kind that forces lots of small, time-sensitive decisions at once.
Alex Thorn, Galaxy Digital’s head of firmwide research, said in an X post on Sunday that the attack was still ongoing and urged users to move funds from Coldcard-generated addresses immediately if they had not already done so. When a credible desk-side voice uses “ongoing” language, the market response is rarely orderly. People do not optimize for fees or privacy in that moment. They optimize for speed.
That urgency lines up with the other datapoint in the packet. CryptoQuant head of research Julio Moreno said Bitcoin transfers below 1 BTC hit 39,600 BTC on Friday, the highest daily level since 2022. Sub-1 BTC activity is not a perfect retail proxy, but it is directionally useful when the catalyst is a consumer custody scare. The immediate implication is flow sensitivity. If coins are being swept off compromised seeds, a non-trivial share will touch centralized exchanges or new custody rails before they settle.
The catch is that “flight” does not always mean “sell.” Some of that volume is defensive reshuffling, not liquidation. But it still matters for traders because it changes where liquidity sits. Exchange inflows can rise even when intent is neutral, and that can distort short-term read-throughs on sentiment and positioning.
Why sub-1 BTC transfers matter: the 2022 FTX-era comparison point returns
Moreno’s comparison point was Nov. 16, 2022, when 39,900 BTC moved in sub-1 BTC transfers, just days after FTX filed for bankruptcy. Friday’s 39,600 BTC print was only 300 BTC below that reference. That is the tell. The market is seeing a retail-sized custody-stress pattern that rhymes with 2022, even if the trigger is different.
What sub-1 BTC transfers typically capture is not “retail bullishness” or “retail bearishness.” It captures retail urgency. Small holders move in chunks that fit the unit size. They also tend to move in batches when a narrative breaks, because the coordination mechanism is social and the execution mechanism is simple: send coins somewhere else.
The second-order effect is how that urgency interacts with market microstructure. A wave of small transfers can create a temporary mismatch between where coins are and where bids are. If a meaningful portion of those coins lands on centralized venues, market makers see inventory risk rise and spreads can widen. If the same coins instead move into new self-custody, the onchain footprint still spikes, but sell-side pressure may not.
The 2022 parallel is useful precisely because it was not subtle. Post-FTX, the market learned that custody headlines can overwhelm macro for short windows. The packet does not provide exchange-specific inflow data, so the clean read is limited. Still, the combination of a broad address set (4,585) and a near-FTX-level retail transfer day is enough to treat flows as a near-term driver, not background noise.
What the exploit is alleged to be — and what the packet can’t verify
The exploit mechanism is characterized, not proven, in the packet. The description is that the attack targets a flaw in Coldcard’s seed generation process that “did not employ a genuinely random number generator.” That is a serious allegation because seed generation is the root of wallet security.
Here is the plain-English version of the moving parts.
A seed phrase is the recovery phrase that controls a wallet’s private keys. If someone can predict or reconstruct that seed, they can derive the same keys and spend the funds. “Coldcard-generated addresses” are simply Bitcoin addresses created from that seed on a Coldcard device. If the seed is compromised, every address derived from it is potentially compromised.
A genuinely random number generator matters because cryptographic secrets need unpredictability. Weak randomness can shrink the search space. That is the nightmare scenario: not a one-off phishing incident, but a systematic weakness that makes some seeds guessable or reproducible.
What the packet cannot verify is the technical chain from “not genuinely random” to “funds drained.” There is no primary technical documentation included, no vendor confirmation, and no CVE-style reference in the excerpt. There is also no detail on whether the alleged weakness is hardware, firmware, user behavior, or supply chain. Traders should treat the “how” as unconfirmed and focus on what is observable: the drain estimate, the address count, and the fact that a major research desk described the attack as ongoing.
The other friction point is the dollar figure. The excerpt uses both “$90 million” and “1,367 BTC ($88.6 million).” That discrepancy likely comes from price and timing differences or rounding, but it is not reconciled in the packet. The BTC-denominated estimate is the cleaner anchor because it is not sensitive to intraday price.
Clarity Act clock runs down as enforcement and stablecoin-yield disputes widen
Policy risk is running in parallel, and it is not offering traders a clean binary. The packet frames the Clarity Act as running out of time in the Senate. With five days left to hold a Senate vote, the chances of any kind of vote were described as receding, and multiple separate votes would still be required to pass the bill.
The enforcement fight is the core blockage in the excerpt. President Donald Trump was described as considering a revised ethics proposal devised by Sen. Thom Tillis and Sen. Ruben Gallego. The original proposal Trump signed off on would have prevented elected officials from endorsing or profiting from crypto projects and would have been enforced by the Department of Justice. Democrats were described as opposing DoJ-only enforcement and wanting State Attorneys General involved. The compromise proposal would allow State AGs to sue the DoJ if it does not properly enforce the rules, rather than suing elected officials directly.
Trump’s reported $1.4 billion in crypto profits were described as a sticking point, and Senate Minority Leader Chuck Schumer introduced the Anti-Corruption Bureau Creation Act targeting “executive branch corruption,” though the excerpt characterizes it as having little hope of passing.
The other disputes matter because they widen the blast radius beyond ethics. Banks were described as “up in arms” over paying any kind of yield on stablecoins. Law-enforcement groups were described as divided over the Blockchain Regulatory Certainty Act (BRCA), with critics arguing it could thwart investigations into money laundering and fraud. White House crypto advisor Patrick Witt dismissed proposed BRCA changes backed by the National Association of Assistant US Attorneys and the National District Attorneys Association, calling the claim they resulted from “productive negotiations” a non-starter. “This is not even close,” he said.
For markets, this is classic delay risk. When a bill needs multiple votes and the calendar is tight, the base case becomes headline volatility without resolution. That tends to reward short-dated positioning and punish anyone leaning too hard on a single legislative outcome.
Signals to monitor next: exchange inflows, additional drain estimates, and Senate scheduling
The first signal is whether public estimates update the 1,367 BTC and 4,585-address figure or point to further waves. Thorn’s “ongoing” warning is the key qualifier. If the drain estimate grows or the address set expands, reactive transfers can persist even if price is stable.
The second is follow-through in sub-1 BTC transfer totals after the 39,600 BTC day. A one-day spike can be a single panic flush. A multi-day cluster is a regime change in retail behavior. The cited 39,900 BTC level from Nov. 16, 2022 is the reference point the market will keep anchoring to.
The third is Senate scheduling inside the stated five-day window. Any procedural update that confirms a vote path would tighten the distribution of outcomes. Silence keeps the “receding odds” framing intact and increases the chance that traders treat policy as a background volatility source rather than a catalyst with a date.
The last is the missing piece on the Coldcard allegation: primary technical documentation or vendor confirmation addressing the described seed-generation randomness flaw. Without that, the market is trading the effects, not the mechanism.
My read: this is a custody-and-confidence shock first, and traders should treat flows as the tell
The setup is not complicated. A broad, address-heavy drain estimate plus an explicit “still ongoing” warning is the recipe for forced movement. Not forced selling, forced movement. That distinction matters because it changes what you measure.
If this stays contained, the pattern should look like a short, sharp spike in sub-1 BTC transfers that mean-reverts, with no sustained follow-through in observable venue-side pressure. In that scenario, the market digests it as a custody scare that created noise in flows but did not change the medium-term supply picture.
If it is not contained, the next wave will not need to be larger in BTC terms to matter. It only needs to be persistent. A drip of new drain estimates keeps retail in motion, keeps coins touching exchanges, and keeps liquidity providers cautious. That is how a security story becomes a market-structure story.
On the policy side, the Clarity Act reads like delay risk, not a clean pass-fail catalyst, because the packet frames multiple votes as required and the window as tight. That tends to produce tradable headlines without delivering a settlement date the market can anchor to.
The threshold that matters is whether the retail-sized transfer metric stays elevated after the initial shock while new drain estimates continue to print. If both persist, the custody narrative stops being a one-week scare and starts acting like a structural flow driver for BTC price discovery.
