Coldcard hack triggers largest sub-1 BTC transfers since FTX

CryptoQuant researcher Julio Moreno shared data showing 39,600 BTC moved in transactions smaller than 1 BTC on Friday, the highest daily total for such transfers since mid‑November 2022. The amount was roughly 300 BTC less than the 39,900 BTC moved on Nov. 16, 2022.

Moreno wrote: “The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse,” and added that he was encouraged to see users “taking action.”

Researchers tracking the suspected Coldcard exploit reported new victims and additional thefts. Galaxy Research identified a recent wave that drained 207.7 BTC, about $13.2 million, raising the estimated total loss to roughly 1,367 BTC, or $88.6 million, across 4,585 addresses.

Alex Thorn, head of firmwide research at Galaxy Digital, warned on social media that the attack remained active and urged anyone using Coldcard‑generated addresses to move funds immediately. Thorn’s team said user reports helped analysts and authorities identify victim and attacker addresses and trace stolen funds.

Researchers described the spike in small transfers as retail holders moving coins from potentially compromised addresses to new wallets or custodial services. The pattern — many small transactions in a short period — matched behavior seen when individual users shift funds after an account or device compromise.

Nick Neuman, CEO of Bitcoin security firm Casa, rejected claims that self‑custody has failed, arguing that the distributed nature of self‑custody allowed many users time to react and estimating that up to ten times more Bitcoin may have been protected than has so far been identified as stolen.

Eric Balchunas, a senior ETF analyst, suggested that Bitcoin exchange‑traded funds provide a safer and more convenient option for many investors, citing the long operating history of the ETF industry. Other industry participants said the losses appear linked to failures at a single wallet provider rather than to self‑custody as a whole.

The suspected Coldcard breach first surfaced in late July and remained active at the time of the latest reports. The surge in small transfers on Friday marked the most significant retail movement of Bitcoin since traders and holders reacted to the FTX bankruptcy in November 2022.