Coldcard pushes bitcoin back to exchanges: the anti-self-custody trade

The Coldcard exploit is not a hack in the way most people understand the word. Nobody broke into anything. Nobody phished anyone. Nobody stole a seed phrase from a sticky note. The devices generated weak private keys for five years, and an attacker figured out how to guess them. Summary Four coordinated attack waves have drained an estimated 1,816 BTC (approximately $118 million) from Coldcard hardware wallets since July 30, with Galaxy Research tracking 5,294 affected addresses and warning that every vulnerable device will eventually be emptied. The exploit stems from a firmware build error present since March 2021 that reduced seed entropy from 128 bits to approximately 40 bits on Mk3 devices and 72 bits on Mk4/Mk5/Q models, making private keys guessable through brute force. Unlike the FTX collapse, which drove bitcoin off exchanges into self-custody, the Coldcard crisis is producing the opposite flow: users are moving bitcoin back to regulated exchanges and institutional custodians they previously abandoned. The net transfer of bitcoin from self-custody wallets to exchange addresses has been positive every day since July 31 according to on-chain flow data, reversing a two-year t...