Bitcoin Steadies Near $64,000 as Coldcard Hack Exposes ‘Brute-Forceable’ Cold Wallet Flaw

Bitcoin steadied near $64,267 on Tuesday, gaining 0.9% on renewed optimism over a potential reopening of the Strait of Hormuz and falling oil prices, according to Nasdaq. Ethereum rose 0.5% to $1,874.13, while Solana gained 0.6% to $74.13. The modest recovery came despite the ongoing Coldcard hack that has siphoned more than $100 million from cold storage wallets and remains a focus for investors, as reported by Nasdaq.

The attack, which targeted cold wallets hosted by Canada-based Coinkite, exploited a software bug that allowed attackers to reconstruct wallet seed phrases, according to Futurism, citing Bloomberg. The incident first emerged on July 29, when victim Johnathan Goodman told Bloomberg his three wallets were drained between 9:36 and 9:43 p.m. that evening. Galaxy Research initially estimated roughly $110 million stolen from about 5,000 wallets, a figure that grew to 7,300 wallets by Monday, multiple sources reported.

Blockchain analytics firm DefiLlama pegged losses tied to the exploit at $115 million, making it the biggest single event in July’s $247.4 million total crypto thefts — the second-worst month of 2026 after April’s $644 million, according to Cointelegraph, citing DefiLlama data. Galaxy Digital identified three confirmed attack waves and a suspected fourth that could bring total losses to about $130 million, the outlet reported. Research platform CryptoRank said in an X post, “July showed that even cold storage does not eliminate technological risks, which can put thousands of wallets at risk simultaneously.”

**Security Flaw Traced to 2021 Firmware Bug**

Blockchain intelligence firm TRM Labs traced the vulnerability to a firmware bug from March 2021 that weakened seed randomness on some Coldcard wallets, cutting key strength from 128 bits to 40 bits, making it “brute-forceable without physical access,” as reported by Cointelegraph. TRM Labs noted that “differences in transaction construction” during each attack wave hinted at multiple attackers, a finding consistent with Galaxy’s earlier identification of at least 15 distinct attackers.

In a separate development, about 64 Bitcoin ($4.17 million) and 200 Ether ($380,000) linked to the exploit were moved to mixing protocols, according to blockchain security firm CertiK. The Bitcoin was sent to Wasabi on Tuesday, and the Ether was transferred to Tornado Cash on Wednesday, data shared by CertiK showed. A CertiK spokesperson told Cointelegraph: “We think it might be a smaller exploiter. There’s likely a few copycats after the initial exploit.”

Dragonfly managing partner Haseeb Qureshi wrote that roughly “$2 of AI hardening” could have prevented the exploit, citing social media reports that some AI models rediscovered the vulnerability in less than 20 minutes, CoinTelegraph reported.

**Coinkite Response and Market Reaction**

Coinkite warned customers on July 30 of the bug, according to Futurism. The company told Bloomberg it was “not in a position to independently confirm total losses” and vowed to conduct a “post-mortem” at an unspecified future date. The firm also launched an “ongoing ecosystem-wide security audit” that has revealed “numerous critical bugs in key software systems across the ecosystem using frontier AI models,” according to the same source. Coinkite later suspended its automated data-blanking process due to “legal obligations arising from the security incident,” the company wrote on its website.

Despite the hack, institutional flows into Bitcoin ETFs remained positive. More than $170 million in net inflows entered spot Bitcoin ETFs on Monday, with the majority going to the iShares Bitcoin Trust, Nasdaq reported. However, a major Italian bank, Intesa Sanpaolo, significantly reduced its Bitcoin ETF position while tripling its holdings in the iShares Staked Ethereum Trust ETF. Hashdex announced it will close the Hashdex Bitcoin ETF due to insufficient funds.

**Whale Accumulation Continues**

Separate data from CryptoQuant, reported by Cointelegraph, showed that Bitcoin whale holdings (excluding exchanges and mining pools) rose to about 3.06 million BTC from 2.87 million in December 2025, with accumulation accelerating after Bitcoin dropped below $60,000 in June. “Rising whale balances into price weakness is the clearest smart-money tell,” CryptoQuant said, adding that the pattern has historically preceded market bottoms. Bitcoin traded at $63,935 at the time of the report, above its realized price of $52,900, while Ether at $1,858 traded below its realized price of about $2,450.

The hack has also prompted a broader uptick in phishing attacks, according to Nasdaq, making security a heightened concern for crypto holders.