05.08.2026 16:40
Attackers exploited a firmware vulnerability unnoticed for five years to drain approximately 1,600 Bitcoin from Coldcard wallets, reigniting the debate over the security of self-custody. During the two days the attack lasted, spot Bitcoin ETFs traded in the US saw $382 million in inflows.
Attackers began draining Bitcoin from Coldcard hardware wallets last Thursday. A flaw in a March 2021 software update by Coinkite weakened randomness in private key generation and went unnoticed for five years. After three waves of attacks, nearly 1,600 Bitcoin were emptied from about 7,300 addresses. Verified losses exceed $100 million, according to Galaxy Research data, and with an unconfirmed fourth wave factored in, total losses are estimated to reach $130 million.
US-based Swan, which helps individuals buy, hold, and self-custody Bitcoin, halted withdrawals for affected customers. The company issued in-app alerts and extended migration support to at-risk users who were not customers. Swan CEO Cory Klippsten described receiving messages while at a wedding in Paris over the weekend when the attack emerged. Klippsten said, "At four in the morning, I was texting to help someone in Pacific time secure their Bitcoin."
The attack prompted some market commentators to revisit the risks of the self-custody model. These commentators argued that investors might consider buying Bitcoin through vehicles like exchange-traded funds (ETFs) rather than holding it themselves.
SWAN VAULT STANDS OUT AFTER THE 7,300-ADDRESS ATTACK
Klippsten said customers are not moving away from self-custody. In his view, investors are seeking ways to make access to their assets more secure rather than abandoning their wallets. At the center of this trend is Swan Vault, a shared multi-signature product where a vulnerability or failure in a single device cannot put all of a user's assets at risk. Klippsten said, "Rather than abandoning self-custody, most people are upgrading it."
The Swan CEO noted that people losing Bitcoin is bad, but security tools were strengthened within hours. Klippsten argued that the incident could turn into one of the best developments for self-custody.
$382 MILLION FLOWED INTO BITCOIN ETFs IN TWO DAYS
Strong ETF inflows were also seen during the days of the attack. According to ETF flow data, US-listed spot Bitcoin ETFs recorded net inflows of $211.5 million on Tuesday and $170 million on Monday.
BlackRock's iShares Bitcoin Trust (IBIT) led the recovery. IBIT received $111 million on Monday and $170 million on Tuesday. Fidelity's Wise Origin Bitcoin Fund (FBTC) also recorded inflows of approximately $33 million and $20 million over the two days. Invesco Galaxy Bitcoin ETF (BTCO) saw its first positive daily result since July 1, with $6.7 million in inflows on Monday.
ETF analyst Eric Balchunas assessed that the Coldcard attack could steer investors toward institutional custody. According to Balchunas, ETFs' reliance on traditional financial institutions to safeguard assets may increasingly be seen as an advantage. What some crypto users once considered a "flaw" could be viewed as a "feature" as investors compare institutional custodians with small crypto companies.
Bitcoin remained relatively calm despite the attack and other pressure sources, such as Strategy's sale of 1,638 Bitcoin. Approximately 90% of the stolen Bitcoin remains dormant on-chain. Galaxy Research shared verified attacker addresses with US federal law enforcement. Coinkite has released updated software for affected models. The traceability of funds on-chain could make it easier for law enforcement and exchanges to track movements.