Bitcoin fell 1.5% and ether dropped nearly 2% as a hack of the Coldcard hardware wallet entered its fifth day. Confirmed losses stand at $88.6 million across three waves of theft, and researchers say a fourth, unconfirmed wave could push the total toward $114 million. Small holders have rushed bitcoin back to exchanges at a pace not seen since FTX's collapse.
Bitcoin fell 1.5% over 24 hours to $62,595. Ether dropped nearly 2% to $1,842 as a hack of the Coldcard hardware wallet entered its fifth day. The CoinDesk DeFi Select Index fell 2.5% over the same stretch.
Muted reaction despite the hack's scale
Given the scale of the theft, bitcoin's price reaction appears relatively restrained. Analysts at Marex said the hack has spooked holders into sending coins back to exchanges, a reversal of the self-custody trend crypto is built on. Bitcoin's 200-week moving average, now above $63,000, is back in focus after Strategy said it is tracking the level and hinted at resuming purchases following a five-week pause, its longest yet, funded by preferred stock carrying a 12% rate.
Losses could reach $114 million
Galaxy Research has confirmed three waves of theft totaling 1,367 BTC, or about $88.6 million, across 4,585 addresses, up from the $38 million when the flaw was disclosed. A fourth wave now appears likely: Galaxy's Alex Thorn flagged sweeps across 15 consecutive blocks running at roughly 45 times the normal rate, which after correction spanned 709 addresses and 448.73 BTC, or about $28 million. That would push the running total to about 1,816 BTC, near $114 million, though no victim has yet confirmed the fourth wave, Thorn said.
The flaw traces to a March 2021 firmware build error that generated seed phrases from too small a pool of possibilities, leaving private keys guessable. Thorn said the stolen coins had sat untouched for an average of 3.18 years, pointing to long-term holders as the victims.
Small holders rush back to exchanges
The scare has triggered the biggest wave of small-holder movement since FTX's collapse. Transfers under 1 BTC totaled 39,600 BTC, or about $2.5 billion, on July 31, matching the 39,900 BTC moved on November 16, 2022, days after FTX failed, according to CryptoQuant. Daily active addresses jumped from 645,000 to almost a million over the same span, the highest level since December 2024.
Kraken chief security officer Nick Percoco called the episode "a wake-up call for the entire hardware wallet industry." Coinkite has since shipped a fix that fails the build unless the correct random-number generator is linked in, a change Percoco said took about 48 hours to write once the company identified the flaw.
Trading involves risk.
Risk Disclaimer
