Cold wallet vulnerability leads to theft of 1,596 BTC… Is Bitcoin returning to Wall Street

Due to a firmware vulnerability in Coldcard hardware wallets, a minimum of 1,596 BTC has been stolen from approximately 7,300 addresses. Galaxy Research stated that the damage occurred in three major attack waves and 14 smaller incidents. Including a fourth wave that is still being investigated, the total potential loss could reach 2,055 BTC, equivalent to approximately $130 million. However, Galaxy is waiting for further reports of victims and is excluding these addresses from the official count. To date, at least 73 victims have contacted Galaxy Research's Alex Sohn for assistance, and the research team concluded that at least 15 attackers are still exploiting this vulnerability. The root cause of the vulnerability is a firmware coding error dating back to March 2021. Some devices failed to generate sufficient randomness from the hardware random number generator, instead creating recovery seeds through software, resulting in a significantly smaller number of possible combinations than intended. This allowed attackers to reconstruct private keys remotely without obtaining the device or recovery words. While firmware updates prevent the creation of new vulnerable seeds, seeds already generated using the flawed method remain unprotected. Coldcard manufacturer CoinKite urgently recommends installing security updates, generating new seeds, and transferring Bitcoin. This incident has led to a significant increase in on-chain Bitcoin activity. According to Santiment data, the number of active Bitcoin addresses reached 712,000 in the past 7 days, the highest level in 3 months. Transactions exceeding $100,000 totaled 61,800, the highest in 5 months. The volume of transactions below $100,000 also reached $3.2 billion, the highest level since November 2024. The number of pending transactions in the Bitcoin mempool also surged from approximately 33,000 to 96,000, the highest since June 20. Some of the funds have been transferred to exchanges. According to CryptoQuant, the total Bitcoin holdings of exchanges increased from approximately 27.02 million BTC to 27.19 million BTC, an increase of 17,500 BTC between July 28 and August 3. Approximately 51% of this increase was absorbed by Binance, with Binance's holdings increasing by approximately 9,000 BTC to 6.59 million BTC. However, analysts suggest that this inflow does not necessarily indicate a selling intention, and it is likely a temporary holding period while new wallets are being prepared. The Coldcard incident has reignited discussions about ETF custody methods. Bloomberg Intelligence ETF analyst Eric Balchunas stated that this incident could prompt some long-term holders to consider moving to physically-backed Bitcoin ETFs. He pointed out that in the event of an attack on an ETF custodian, an immediate regulatory investigation and coordinated response from fund managers, custodians, and law enforcement agencies would occur. While self-custody eliminates reliance on banks or exchanges, this incident highlighted the risk that users must bear full responsibility for managing hardware and software. Competitor Trezor warned that phishing attempts have increased since the incident, urging users to never share their recovery seeds or enter them into external websites or apps.