Unlike the FTX collapse, the $89 million Coldcard exploit has investors sending bitcoin back to exchanges
A vulnerability in Coldcard hardware wallets that led to the theft of roughly $88–89 million in bitcoin has triggered an unusual reaction from retail holders: instead of withdrawing funds to cold storage, blockchain analytics firms say smaller bitcoin holders are moving coins onto centralized exchanges for perceived safety. The on-chain flows mark a reversal of behavior seen after the FTX collapse in late 2022, when many users pulled funds off exchanges and sought self-custody.
On-chain flows and immediate market impact
Blockchain analytics providers monitoring addresses tied to the Coldcard exploit reported elevated inflows to multiple exchanges in the hours and days following the breach. Analysts attributed these moves to smaller holders seeking a quick way to safeguard or potentially liquidate assets amid uncertainty over the scope of the vulnerability and the security of hardware wallets more broadly. The roughly $88–89 million figure represents the value linked to the exploit and related movements that have drawn attention across on-chain and exchange-monitoring tools.
Market participants say this pattern differs materially from the response to FTX’s 2022 collapse, when customers broadly moved assets off centralized platforms and into self-custody. The post-exploit flows to exchanges raise the prospect of increased selling pressure on bitcoin in the near term and could add to volatility if sizeable positions are liquidated or if uncertain holder behavior persists.
Why this matters for markets, custody and liquidity
The Coldcard incident underscores a persistent tension in crypto custody: hardware wallets are marketed as secure offline solutions, but vulnerabilities and exploits can erode confidence and push users toward custodial services. For institutions and larger retail holders, the episode could prompt re-evaluations of operational security, insurance coverage and counterparty risk. For exchanges, inbound flows raise operational questions about deposit monitoring, sanctions screening and cooperation with on-chain tracing efforts.
From a market-structure perspective, elevated exchange balances can amplify short-term liquidity and execution capacity but also feed anxiety about concentrated selling if flows are tied to distressed holders. For major crypto assets such as BTC, sudden increases in exchange balances have historically correlated with periods of wider intraday price swings. The situation also highlights the role of blockchain analytics, forensic tracing and exchange compliance functions in identifying the provenance of funds and containing market fallout.
Regulators and custodians may interpret the episode through different lenses: some could see it as evidence that centralized custody remains an essential part of the ecosystem for risk-averse users, while others could point to the exploit as a reason to push for stronger device standards, disclosure requirements and incident-reporting frameworks. Institutional custodians that provide multi-layered security and insurance could see renewed demand, even as questions about third-party risk management persist.
Market participants are likely to watch several indicators in the hours and days ahead: on-chain metrics tracking exchange inflows and outflows, the pace at which exchanges identify and freeze suspect funds, any public advisories or patches from Coldcard and related vendors, and trading volumes or price volatility in BTC and other major tokens. How quickly exchanges and analytics teams can trace and, where appropriate, isolate stolen funds will influence both market sentiment and the broader debate over custody trade-offs.