Community Trust ScoreVerified
Bitcoin users panicked. Fast. And the numbers back it up — 39,600 BTC moved in small transactions under 1 BTC on Friday, the biggest single-day volume of sub-1 BTC transfers since November 2022, when FTX was imploding and everyone was scrambling to get their coins off exchanges.
The comparison to FTX isn’t casual. Per CryptoQuant head of research Julio Moreno, Friday’s figure came just shy of the 39,900 BTC shifted on November 16, 2022 — the chaotic days right after FTX filed for bankruptcy. Moreno sees the activity as users taking proactive steps in response to the Coldcard crisis. Not panic-selling. Moving. Getting funds out of addresses that might already be compromised.
That’s a pretty meaningful distinction.
The Hack Is Still Running
The Coldcard breach didn’t wrap up neatly. It’s still active. Researchers are still finding new victims. Galaxy Research, part of Galaxy Digital, put out updated figures showing another 207.7 BTC stolen in the latest wave — roughly $13.2 million at current prices. Stack that on top of earlier losses and the total comes to 1,367 BTC, worth around $88.6 million, spread across 4,585 compromised addresses.
Alex Thorn, head of firmwide research at Galaxy Digital, went straight to social media with a warning: move your funds out of Coldcard-generated addresses now. Not later. He also said user reports were critical in tracking where the stolen Bitcoin was going. Without people flagging suspicious activity, researchers basically can’t map the flow of funds. So the community is doing real work here, not just watching.
It’s unclear exactly how the attackers are exploiting the vulnerability, and no full technical post-mortem has been published yet. New victim addresses keep showing up, which means the attack surface is probably wider than the current numbers suggest. The 4,585 figure will likely grow.
Self-Custody Takes Another Hit — Or Does It?
The Coldcard hack reignited a fight that never really goes away in Bitcoin circles: is self-custody actually safe?
Casa CEO Nick Neuman came out defending it. His argument — the decentralized nature of self-custody has protected far more Bitcoin than was lost in the hack. He’s basically saying: look at the scale of what self-custody secures globally, then compare that to $88.6 million. The math still favors personal control, in his view.
But critics aren’t buying it wholesale. Some point out that the Coldcard incident is a failure of one specific wallet provider, not a flaw in the idea of self-custody itself. That’s a fair read. Hardware wallet security and the broader concept of holding your own keys are separate things. One bad actor — or one exploited vulnerability — doesn’t invalidate the whole model.
On the other side, traditional finance voices are pushing ETFs as the cleaner option. No seed phrases, no hardware, no worrying about whether your wallet firmware has a zero-day. Just shares in a fund. It’s convenient. And after a breach like this, some Bitcoin investors are probably reconsidering their setup.
The debate’s genuinely split. And it’s not resolving anytime soon.
What Users Are Actually Doing
Forget the debate for a second — the on-chain data tells you what people chose. They moved funds. Friday’s 39,600 BTC in sub-1 BTC transactions is a direct response to fear, and it’s the kind of fear that drives action. Small holders, probably the most exposed in a hack like this, didn’t wait for a full investigation. They saw Thorn’s warning, saw the news, and got their coins out.
That’s the thing about a hardware wallet breach. It’s personal. It’s not an exchange going under where you hope the lawyers recover something. It’s your wallet, your address, your funds — and the attacker may already know the keys. The urgency is different.
Galaxy Research keeps updating its figures as new addresses get flagged. The 207.7 BTC in the latest wave won’t be the last update. Researchers are still mapping the attack, and the full scope of losses probably isn’t visible yet.
For now, the core advice from Thorn stands: if you generated addresses using Coldcard, move the funds. Don’t wait for clarity on how the exploit works. The 1,367 BTC already gone is reason enough.
The total number of compromised addresses sits at 4,585. The total estimated loss is $88.6 million. And the hack is still active.
Frequently Asked Questions
How much Bitcoin has been stolen in the Coldcard hack so far?
Total estimated losses stand at 1,367 BTC, worth approximately $88.6 million, across 4,585 compromised addresses, per Galaxy Research figures.
Why did sub-1 BTC Bitcoin transfers spike on Friday?
CryptoQuant’s Julio Moreno tied the 39,600 BTC in small transfers to users proactively moving funds away from vulnerable Coldcard-generated addresses — the highest daily volume of such transactions since the FTX collapse in November 2022.
