Bitcoin Coldcard Losses Reach 1,367 BTC After Third Wave

Bitcoin News

On-chain analysis of the Coldcard firmware flaw shows Bitcoin losses have expanded to 1,367.05 BTC, about $88.6 million, across 4,585 addresses after three suspected attack waves. The first sweep began early on July 30 and moved 1,082.65 BTC from 1,196 addresses in roughly 41 minutes, using a 30 satoshi-per-virtual-byte fee and no change outputs, traits that made the cluster easier to trace. A second wave on July 31 took 76.16 BTC from 1,478 addresses, while a later batch removed 207.7294 BTC from 1,912 addresses. The latest total supersedes an earlier $70.2 million estimate and remains an observed figure, not a final audit. Coinkite has said integration errors prevented the hardware random-number generator from contributing properly to seed creation, and fixed firmware only prevents new weak seeds. Users must generate and fund a fresh seed. The episode has become a stress test for self-custody, and our Bitcoin hub is tracking the migration guidance.

Smaller Bitcoin transfers have reached levels last seen during the FTX collapse, signalling that many holders are moving funds away from potentially exposed addresses. Sub-1 BTC transactions climbed to 39,600 BTC in a single day, the highest daily total since November 2022 and only about 300 BTC below the 39,900 BTC recorded on Nov. 16, 2022, when FTX was failing. The on-chain surge coincided with researchers continuing to identify new victim and attacker addresses, and the suspected campaign remained active. The moment has reopened a bear-market-era argument about whether individuals should rely on self-custody or regulated custodians. Some security practitioners argue distributed self-custody gave users time to react, because potentially far more BTC was protected by independent wallets than was identified as stolen. Others counter that exchange-traded funds and professional custodians reduce technical risk for users who cannot manage firmware, seeds and address verification. The pattern suggests risk mitigation, not panic selling, because the transfers were fragmented and below 1 BTC. The same caution applies to any altcoin held through self-custody.

The Coldcard vulnerability has also intensified a custody-security debate among industry figures after entrepreneur Jonathan Goodman said he lost $1.6 million in Bitcoin from an offline setup. Goodman described keys held on a Coldcard device that had never connected to the internet and stored in a safe-deposit box, a configuration many users regard as conservative. BlockTower Capital founder Ari Paul argued that no custody method is risk-free: platform custody introduces counterparty and legal risk, while individual custody introduces hardware, software and operational risk. Paul also said legal institutions in developed markets can currently offer more reliable property protection than cryptographic control alone. ShapeShift founder Erik Voorhees pushed back, saying the incident does not prove crypto assets cannot be stored safely, though he agreed no model is perfect. The debate is less about price or all-time-high expectations than about control, moving the discussion away from absolute security toward measurable trade-offs. That framing matters for both institutions and individuals.

Individual accounts are giving the technical failure a human scale, with one user saying more than 3 BTC, worth nearly $200,000, disappeared after years of regular saving. The user said funds were withdrawn from an exchange in 2022 and moved to a Coldcard, followed by weekly purchases of about $250 and occasional extra deposits, with the balance rarely checked. The loss underscores why Coinkite’s July 31 emergency firmware update is not a complete remedy. The company has warned that updating firmware can correct future seed generation, but it cannot add entropy to an already-created recovery phrase. Coinkite’s advisory tells users to verify device versions, create a completely new seed, test the receiving address with a small transaction and then migrate remaining funds. The underlying flaw traces to a March 2021 code path that could bypass the hardware random-number generator, leaving some keys with far less search space than intended. For a Bitcoin holder following the standard cold-storage playbook, the failure is a reminder that legacy seeds need active migration.

COINOTAG’s proprietary 42-indicator composite S/R scoring engine shows Bitcoin trading at $63,272, just below the $63,989 resistance rated 64/100 by Ichimoku Kijun and EMA 20 confluence. The strongest overhead barrier is $66,971 at 70/100, driven by Donchian Upper and Swing High signals, while nearby support at $62,830 scores 81/100 from Donchian Lower and ATR Lower. Derivatives positioning is mildly crowded long: funding is 0.0049%, open interest is $12.68 billion and the long/short account ratio is 1.93. Fear & Greed reads 27/100, showing fear rather than euphoria. A reclaim of $63,989 would open a move toward $65,776, but losing $62,830 would confirm the bearish MACD and downtrend; a break below $61,044 would invalidate any near-term recovery thesis.