The classic crypto playbook is playing out again: something scary happens, retail sells, and bigger wallets quietly load up. Since July 29, Bitcoin wallets holding between 10 and 10,000 BTC have collectively added 19,610 BTC to their stacks, a 0.14% increase, according to on-chain data from Santiment.
Meanwhile, the smallest retail wallets, those holding under 0.01 BTC, have trimmed their positions by 0.55% over the same window. The catalyst separating these two groups isn’t some macro event or Fed decision. It’s a firmware bug in a hardware wallet.
The Coldcard exploit changed the mood
On July 30, exploitation of a critical vulnerability in Coldcard hardware wallets began in earnest. The damage was significant: over 1,367 BTC stolen from compromised addresses, valued at roughly $87 to $89 million at the time of the thefts.
The underlying flaw originated from a firmware update pushed back in March 2021, primarily affecting the Mk3 model line, with lesser impacts on the Mk4, Mk5, and Q models.
Coinkite, the company behind Coldcard, moved quickly once the exploit went public. Hotfix firmware updates rolled out between July 31 and August 1. But existing seeds generated on vulnerable firmware remain at risk unless users migrate them entirely.
Retail sells, whales accumulate
The 19,610 BTC accumulated by wallets in the 10 to 10,000 BTC range since July 29 is not a trivial sum. At current prices, that represents well over a billion dollars in additional Bitcoin exposure taken on by this cohort.
The 0.55% reduction in holdings from wallets under 0.01 BTC reflects a behavioral shift among millions of addresses.
What this means for the broader market
The 1,367 BTC stolen in this exploit represents real, unrecoverable losses for the individuals affected. The fact that migrating seeds is the only true remediation means that some portion of Coldcard users may remain vulnerable if they don’t take active steps.