Swan Bitcoin CEO Cory Klippsten says clients hit by last week's Coldcard hack are moving into stronger multisig vaults, not away from self-custody. Attackers exploited a five-year-old firmware flaw to drain almost 1,600 BTC from about 7,300 addresses, and the fallout is now pushing exchange reserves higher and strengthening the case for bitcoin ETFs.
Swan Bitcoin CEO Cory Klippsten says holders hit by the Coldcard hardware wallet hack are not retreating from self-custody — they are upgrading it instead. Attackers exploited a firmware flaw that had sat undetected for five years, draining almost 1,600 BTC valued at over $100 million from around 7,300 addresses before Coinkite patched every affected device line.
A five-year-old flaw drains thousands of wallets
The defect traces back to a March 2021 firmware update for the Coinkite-made wallet, which caused some devices to generate recovery seeds through a weaker software process instead of drawing enough randomness from the hardware, leaving some private keys less secure than intended. Galaxy Research said confirmed losses came from three major attack waves and 14 smaller incidents, and it has flagged a possible fourth wave that could push the total to 2,055 BTC, worth about $130 million, though it is keeping those addresses outside its confirmed estimate pending more victim reports. Still, nearly 90% of the stolen coins remain unmoved onchain, and Galaxy has shared the attacker addresses with U.S. federal law enforcement.
Exchange reserves climb as holders migrate funds
Part of that migration is flowing into exchanges. CryptoQuant data cited by CryptoSlate showed total exchange reserves rose by about 17,500 BTC between July 28 and Aug. 3, with Binance absorbing roughly 51% of that increase. Yet the inflows do not establish that holders intend to sell — some deposits may reflect temporary custody while users replace exposed seeds.
Klippsten: "the best thing that ever happened to self-custody"
Swan paused withdrawals for at-risk clients and opened its migration support to anyone affected, not only its own customers. Klippsten said clients are moving into Swan Vault, the firm's collaborative multisig product where no single device can put a user's funds at risk. According to Swan CEO Cory Klippsten: "This might end up being the best thing that ever happened to self-custody."
The hack has also given ammunition to exchange-traded fund advocates. Bloomberg Intelligence analyst Eric Balchunas said the breach could encourage some long-term holders to migrate toward spot bitcoin ETFs, though there is no evidence Coldcard users have directly bought ETF shares as a result. Klippsten's own read is more measured: bitcoin, he said, is antifragile, and its security tools are getting stronger by the hour.
Sources: CoinDesk, CryptoSlate
Trading involves risk.
Risk Disclaimer
