Coldcard Hack Triggers $15 Billion in Bitcoin Transfers

The Coldcard hack increasingly resembles a crypto news item. Except the real story isn't hidden in the $130 million stolen... It's in the $15 billion that has fled in Bitcoin transfers.

In Brief

• $15 billion versus $130 million: for every dollar stolen during the Coldcard hack, about a hundred dollars were prudently moved to safer wallets.
• A 5-year-old flaw, uncovered by AI: the entropy bug had been lurking in Coldcard's public code since 2021. It took an AI to spot it.
• Defense must now match the speed of the attack: diversifying wallets reduces risk but doesn't eliminate it. The real line of defense lies in the speed of auditing one's own code.

As hackers cracked Coldcard's Bitcoin wallets one after another, something else was happening... Something much larger... And silently. Casa's CEO, Nick Neuman, reveals a colossal movement of 233,000 BTC, worth about $15 billion, that left wallets held for over 155 days. This category is monitored by analysts as a barometer of serious, patient investors, not the type to panic over a tweet. The funniest part is that some of this volume didn't even come from Coldcard users.

But from Ledger and Trezor holders who took advantage of the shock to migrate to multisig, fearing they might be next on the list. For every dollar stolen, about a hundred dollars were moved out of caution, and Glassnode confirms the scale of the movement. The reserve of long-term holders dropped from nearly 15 million bitcoins to about 14.7 million. This is the largest weekly decline since December 2024. For Neuman, this is proof that distributed self-custody works like an immune system, not as a weakness.

The hacking of Coldcard's Bitcoin wallets now goes beyond a mere news item. On Bloomberg, Ian Rogers from Ledger explained that AI has changed the very nature of the threat. Not by creating new vulnerabilities. But by giving attackers radically faster discovery tools. Charles Guillemet, CTO of Ledger, goes further: this flaw had been dormant for five years in public code until an attacker used AI to spot it. Five years. Proof that being open source and being truly audited are not the same thing...

A public GitHub repository accessible since 2021 is useless as long as no one takes the time to really look at it. An incident that now sounds like a warning for all companies developing Bitcoin hardware or software. There should be an urgent review of sensitive code before a malicious AI takes care of it instead. Defense must now operate at the same speed as the attack. Which, let's admit, leaves little room for a nap between audits.

After the hacking of Coldcard's Bitcoin (BTC) wallets, the solution would be to diversify wallets among multiple manufacturers, which reduces risk, but never completely eliminates it. Nothing in crypto security is 100% guaranteed. The real line of defense is no longer limited to hardware today... It also involves the speed at which each player in the ecosystem audits their own code. This, before a malicious AI takes care of it first.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.