Coldcard Exploit: 1,367 BTC Lost, Bitcoin Holders Flee to Exchanges
A flaw in Coldcard hardware wallets has cost Bitcoin holders an estimated 1,367 BTC, worth approximately $88.6 million, across 4,585 compromised addresses, according to Galaxy Research. The attacks, which unfolded across at least three waves, triggered the largest spike in small Bitcoin transfers since the FTX collapse in November 2022.
Coldcard Seed Generation Flaw Drives $88.6 Million in Losses
Galaxy Digital researcher Alex Thorn confirmed the attacks are ongoing and publicly urged all users holding Bitcoin in Coldcard-generated addresses to move their funds immediately. The exploit is linked to a flaw in Coldcard’s seed phrase generation process, specifically a failure to produce true randomness during wallet creation. Weak randomness in seed generation can allow attackers to reconstruct private keys and drain wallets without any physical access to the device.
Galaxy Research tracked the damage across three separate attack waves, ultimately counting 4,585 affected addresses and losses totaling 1,367 BTC. The third wave alone pushed cumulative losses past the $88 million mark. Thorn’s public warning, issued via social media, represents one of the most direct calls to action from a major crypto research firm during an active security incident.
Coldcard is manufactured by Coinkite and has long been considered one of the most security-focused hardware wallets available to Bitcoin users. The irony of a security-first device being compromised through its own key generation process has shaken confidence among a segment of Bitcoin holders who specifically chose Coldcard to avoid custodial risk.
Small Bitcoin Holders Panic, Exchange Inflows Surge
CryptoQuant analyst Julio Moreno reported that sub-1 BTC transfers spiked to 39,600 BTC on Friday, the highest single-day volume for small transfers since the FTX collapse in November 2022. This data point signals that retail and smaller self-custody holders, not institutions, drove the majority of the exchange inflow activity. The pattern is consistent with panic-driven behavior rather than strategic repositioning.
CryptoQuant’s on-chain data shows the spike was concentrated in a single trading day, suggesting the news spread rapidly and prompted immediate action from holders who recognized their wallets as potentially vulnerable. Exchange inflows of this scale from sub-1 BTC addresses are historically associated with fear events rather than profit-taking. The FTX comparison is significant: that collapse in November 2022 wiped out billions in customer funds and remains the benchmark for retail crypto panic in on-chain data.
The behavior also raises a structural question about self-custody adoption. Many smaller holders moved to hardware wallets precisely to avoid exchange risk after FTX, and a high-profile exploit on a trusted device pushes that population back toward custodial solutions, at least temporarily.
Clarity Act Stalls as Trump Ethics Proposal Adds Complexity
The Clarity Act, a legislative effort to establish clearer crypto regulatory boundaries in the United States, failed to advance this week amid disagreements over an ethics amendment proposed by the Trump administration. President Trump is reportedly considering a revised version of the proposal that would allow state attorneys general to sue the Department of Justice rather than targeting elected officials directly. Senators Thom Tillis and Ruben Gallego have been involved in negotiations, while Senate Majority Leader Chuck Schumer has not committed to bringing the bill to a floor vote.
Patrick Witt, a crypto policy advocate, noted that the ethics provision has become a sticking point that is slowing what was otherwise a bill with bipartisan support. The revised proposal attempts to reduce political exposure for sitting legislators while preserving enforcement mechanisms. Whether that compromise satisfies enough senators to move the bill forward remains unclear as of the August 3 publication date.
The legislative gridlock matters for the broader crypto regulation picture because the Clarity Act was positioned as a framework bill that would define which digital assets fall under SEC versus CFTC jurisdiction. Without it, enforcement continues on a case-by-case basis, creating ongoing uncertainty for exchanges, issuers, and institutional participants.
Coinbase Posts $359 Million Q2 Loss as Crypto Firms Face Earnings Pressure
Coinbase reported a net loss of $359 million for Q2 2026, missing analyst expectations and marking a significant reversal from prior quarters where trading volume had supported profitability. Robinhood also reported weaker-than-expected Q2 results, with Lorenzo Valente of ARK Invest noting that both firms faced headwinds from reduced retail trading activity. The earnings misses come despite Bitcoin trading near historically elevated price levels, suggesting that revenue concentration in trading fees remains a structural vulnerability for publicly listed crypto companies.
The contrast between Coinbase’s results and the performance of decentralized applications is notable. Hyperliquid and Pump.fun together account for approximately 67% of total crypto application revenue, according to data cited in the weekly roundup. Coinbase’s struggles highlight how centralized intermediaries are losing revenue share to on-chain alternatives that operate without the overhead of compliance, staffing, and infrastructure costs.
For users evaluating where to hold or trade Bitcoin, the earnings data adds another layer of consideration. A detailed breakdown of fees and features is available in the Coinbase vs Kraken comparison for those weighing custodial options.
Pavel Durov Added to Russian Wanted List Over Terrorism Charges
Russian authorities placed Telegram founder Pavel Durov on an international wanted list, citing charges related to terrorism facilitation. Durov, who is currently facing a separate legal process in France related to Telegram’s content moderation practices, now faces potential extradition risk in jurisdictions that cooperate with Russian law enforcement requests. The Russian wanted listing adds a new dimension to the legal pressure surrounding Durov and Telegram.
Telegram remains one of the primary communication platforms for the global crypto community, used by projects, traders, and developers for announcements, community management, and trading signals. Any disruption to Telegram’s operations or leadership would have downstream effects on how crypto information flows across the industry. Durov has not publicly commented on the Russian wanted listing as of this article’s publication.
Coldcard vs. Competing Hardware Wallets: Key Security Comparison
| Feature | Coldcard | Ledger | Trezor |
|---|---|---|---|
| Seed Generation Method | On-device (flaw reported) | On-device | On-device |
| Open Source Firmware | Yes | Partial | Yes |
| Air-Gapped Operation | Yes | No | No |
| Recent Security Incident | Yes (2026 exploit) | Yes (2023 data breach) | Yes (2024 supply chain) |
| Custodial Option | No | No | No |
The table above reflects publicly reported incidents and general product specifications. Users should consult manufacturer documentation and independent security audits before making custody decisions. A broader guide to evaluating storage options is available in the crypto wallets explained resource.
Key Takeaways
- Galaxy Research estimates the Coldcard exploit caused losses of 1,367 BTC, approximately $88.6 million, across 4,585 addresses as of the third attack wave.
- CryptoQuant recorded sub-1 BTC Bitcoin transfers of 39,600 BTC on Friday, the highest daily level since the FTX collapse in November 2022.
- Galaxy Digital’s Alex Thorn confirmed attacks are ongoing and issued a public warning urging immediate fund migration from affected addresses.
- Coinbase reported a Q2 2026 net loss of $359 million, missing analyst expectations alongside similar misses from Robinhood.
- Hyperliquid and Pump.fun together account for roughly 67% of total crypto application revenue, outpacing centralized exchange earnings.
- Russian authorities added Telegram founder Pavel Durov to an international wanted list on terrorism facilitation charges.
FAQ
What is the Coldcard exploit and how did it happen?
The Coldcard exploit involves a flaw in the wallet’s seed phrase generation process that failed to produce true randomness. Attackers were able to exploit this weakness to reconstruct private keys and drain Bitcoin from affected wallets. Galaxy Research tracked losses across three attack waves, totaling 1,367 BTC across 4,585 addresses.
How do I know if my Coldcard wallet is affected?
Galaxy Digital researcher Alex Thorn has urged all users with funds in Coldcard-generated addresses to move their Bitcoin immediately while the investigation continues. Users should monitor official communications from Coinkite, the manufacturer of Coldcard, for specific guidance on which firmware versions or device generations are affected. Moving funds to a new wallet generated by a different device or software is the safest precautionary step.
What caused the spike in small Bitcoin transfers to exchanges?
CryptoQuant data shows sub-1 BTC transfers reached 39,600 BTC on Friday, driven by smaller retail holders moving funds off Coldcard wallets and onto exchanges. Analyst Julio Moreno identified this as the highest daily level for small transfers since the FTX collapse in November 2022. The pattern reflects fear-driven behavior rather than profit-taking or institutional rebalancing.
What is the Clarity Act and why did it stall?
The Clarity Act is a proposed U.S. law designed to clarify whether digital assets fall under SEC or CFTC jurisdiction. It stalled this week because of a disputed ethics amendment from the Trump administration that would allow state attorneys general to sue the Department of Justice rather than elected officials. Senators Thom Tillis, Ruben Gallego, and Chuck Schumer are among the key figures involved in the ongoing negotiations.
Who is Pavel Durov and why was he added to Russia’s wanted list?
Pavel Durov is the founder of Telegram, the messaging platform widely used by the global crypto community. Russian authorities added Durov to an international wanted list citing terrorism facilitation charges, separate from the legal proceedings he faces in France over Telegram’s content moderation policies. The listing raises concerns about potential disruption to Telegram’s operations given its central role in crypto communications.
Sources
- Cointelegraph: Coldcard Exploit, Clarity Act, and Hodler’s Digest August 2, Primary roundup covering the Coldcard exploit, legislative developments, and Q2 earnings data.
- CryptoBreaking: Coldcard Exploit Drives Bitcoin Outflows, Detailed coverage of CryptoQuant on-chain data showing the sub-1 BTC transfer spike.