After Coldcard Was Hacked, $15 Billion in Bitcoin Moved to Safety

Galaxy Research tracked the fallout across three confirmed attack waves, with losses reaching approximately 1,596 BTC across more than 5,200 addresses.

Casa’s Neuman, earlier this week, posted the on-chain numbers from analyst James Check of Checkonchain to make an argument for Bitcoin’s resilience. Self-custody, holding your own private keys rather than leaving Bitcoin with an exchange or custodian, didn't buckle under pressure but instead adapted, he argued.

"The onchain metrics around the Coldcard incident reinforce how important self-custody is to the resilience of Bitcoin as an asset class," Neuman wrote on X.

The breakdown Neumann cited in his post, drawing Checkonchain’s onchain data: 2,100 BTC stolen (higher than Galaxy's own accouting), and 22,000 BTC moved to exchanges. And 233,000 BTC moved out of long-term holder wallets—addresses dormant for at least 155 days, a cohort analysts watch as a proxy for serious, patient investors—into safety. That’s more than 100 times what the attackers took.

Some of that came from Coldcard users migrating to multisig wallets (setups requiring multiple independent keys to approve any transaction, so no single compromised device can drain everything). Some came from holders on Ledger and Trezor—entirely different hardware—who used the hack as a wake-up call.

Casa confirmed both patterns from actual customer conversations. "So somewhere between ~10x-100x the amount of bitcoin stolen was moved to safety as people sounded the alarm," Neuman wrote.

When a centralized exchange gets breached, everything goes at once. Here, the attacker had to crack addresses individually, earning a trickle at a time while the rest of the network had time to respond. "This is a giant flashing neon sign showcasing the resilience that self-custody adds to the network," Neuman wrote. "If all that BTC was held at a custodian and the custodian was hacked instead, those numbers would have been flipped."

Data from analytics company Glassnode confirms the scale: long-term holder supply dropped from nearly 15 million BTC to approximately 14.7 million—the largest weekly decline since December 2024. It happened while Bitcoin traded roughly 50% below its all-time high of $126,000, set in October 2025.

Coinkite has urged anyone who generated a seed on firmware versions 4.0.1 through 4.1.9—covering March 2021 to July 2026—to treat those wallets as compromised and migrate to a new seed immediately.