In brief
- The Coldcard firmware exploit drained approximately 2,100 BTC, with losses estimated near $130 million across multiple attack waves.
- Onchain data from Checkonchain shows 233,000 BTC left long-term holder wallets in the days around the breach.
- Casa CEO Nick Neuman, citing actual customer conversations, says some of that 233,000 BTC came from Ledger and Trezor users—not Coldcard owners—who upgraded to multisig after watching the hack unfold.
In the days after the worst hardware wallet exploit in Bitcoin’s recent history, Casa CEO Nick Neuman began counting more than just the BTC being drained from vulnerable Coldcard wallets.
While attackers were draining Coldcard wallets one address at a time, 233,000 BTC—worth about $15 billion at today’s prices—was quietly moving in search of safety.
The massive and ongoing breach that started on July 30 has already led to close to $130 million in stolen Bitcoin from Coldcard hardware wallets—physical gadgets that store private keys entirely offline, never connecting to the internet, and made by Canadian company Coinkite.
A firmware bug introduced in March 2021 had routed key generation through a weak software random number generator instead of the device's dedicated hardware chip. Private keys (the secret codes that prove ownership of Bitcoin and authorize any transaction) became guessable, with security collapsing from 128 bits to roughly 40—the cryptographic equivalent of a bank vault that turns out to have a four-digit PIN.
Galaxy Research tracked the fallout across three confirmed attack waves, with losses reaching approximately 1,596 BTC across more than 5,200 addresses.
Casa’s Neuman, earlier this week, posted the on-chain numbers from analyst James Check of Checkonchain to make an argument for Bitcoin’s resilience. Self-custody, holding your own private keys rather than leaving Bitcoin with an exchange or custodian, didn't buckle under pressure but instead adapted, he argued.
"The onchain metrics around the Coldcard incident reinforce how important self-custody is to the resilience of Bitcoin as an asset class," Neuman wrote on X.
The breakdown Neumann cited in his post, drawing Checkonchain’s onchain data: 2,100 BTC stolen (higher than Galaxy's own accouting), and 22,000 BTC moved to exchanges. And 233,000 BTC moved out of long-term holder wallets—addresses dormant for at least 155 days, a cohort analysts watch as a proxy for serious, patient investors—into safety. That’s more than 100 times what the attackers took.
