The Coldcard exploit has driven some smaller Bitcoin holders to shift their funds back to exchanges, according to blockchain analytics providers. The move marks a sharp contrast with the aftermath of the FTX collapse, when investors moved their assets away from centralized platforms and into self-custody solutions.

Major security events in crypto often trigger changes in how users manage their holdings. Following FTX’s downfall in November 2022, concerns over exchange failures and withdrawal restrictions led many investors to pull Bitcoin from centralized exchanges and store it in personal wallets, including hardware devices.

The current Coldcard incident has created the opposite reaction. As questions grow over the security of certain hardware wallets, some users have chosen to temporarily move Bitcoin back to exchanges as a precaution.

“Daily exchange deposits involving Bitcoin transfers under 10 BTC surged to 7,300 BTC on Friday, reaching the highest level since Feb. 6. This could be linked to the Coldcard exploit as users move their funds in search of greater safety,” said Julio Moreno, head of research at CryptoQuant.

Coldcard Vulnerability Behind the Shift

Coldcard, a Bitcoin-only hardware wallet developed by Canadian firm Coinkite, is dealing with a major security incident after a firmware vulnerability affected the way some devices generated recovery seeds.

The attacks began on Friday, July 30, and continued through multiple transactions. Blockchain analysts estimate that between 1,000 and 1,300 BTC—worth around $70 million to $90 million—has been stolen from more than 1,000 wallet addresses. Researchers have indicated that further losses could still occur.

The attackers exploited a flaw introduced in March 2021 that caused certain Coldcard devices to use a weaker software-based random number generator instead of the device’s built-in hardware RNG when creating new wallets.

The issue reduced the randomness of recovery seeds, allowing attackers to recreate likely seed phrases offline and generate private keys without ever accessing the physical wallets.

The breach has intensified discussions about the risks of hardware wallets and self-custody, with industry figures including Binance founder Changpeng Zhao (CZ) highlighting the importance of managing storage risks.

Bitcoin Flows Shift Toward Exchanges

CryptoQuant data shows a noticeable rise in Bitcoin transfers to exchanges, reversing the pattern seen after the FTX failure.

On July 31, Bitcoin deposits involving transactions below 10 BTC climbed to 7,300 BTC, the highest daily figure since Feb. 6.

The number of active Bitcoin addresses also increased sharply, rising from 645,000 on July 30 to nearly 1 million on July 31, the highest level since Dec. 10, 2024. Much of the increase came from wallets transferring BTC to centralized exchanges.

Moreno said the data indicates that users moved funds because of heightened concerns following the Coldcard breach.

Activity among smaller transactions showed a similar trend. CryptoQuant data revealed that transfers under 1 BTC totaled 39,600 BTC on Friday, approaching the 39,900 BTC recorded on Nov. 16, 2022, shortly after FTX’s bankruptcy filing.

Moreno noted that smaller Bitcoin holders had not moved this much BTC in one day since the FTX collapse, suggesting users were actively responding to the security concerns.

Blockchain analyst Timechainindex reported that Bitcoin exchange net inflows reached 11,163 BTC on July 31, with much of the volume moving to major platforms and companies such as Binance, River, Kraken, and OKX.

The analyst described the activity as a reaction from cautious Bitcoin holders concerned about wallet security.

Bitcoin balances held in wallets linked to centralized exchanges have since increased to 2.715 million BTC, up from 2.703837 million BTC before the Coldcard incident.

Different Risks, Different Reactions

The FTX collapse was driven by fears around centralized exchange solvency, mismanagement, and frozen withdrawals. Investors responded by moving Bitcoin into self-custody and reducing their exchange exposure.

The Coldcard incident involves a different type of risk: vulnerabilities within self-custody tools. As a result, some users have temporarily moved smaller amounts of Bitcoin back to exchanges.

Still, the exploit is limited to affected Coldcard devices and does not represent a failure of self-custody as a whole. Most hardware wallets and properly generated recovery seeds remain unaffected.