Bitcoin users moved 39,600 BTC in transactions under 1 BTC this week, a direct response to the Coldcard hardware wallet hack. It's the biggest such shift of small-denomination bitcoin since the FTX meltdown in 2022. Researchers tracking the incident warned the attack remains active, meaning more funds could be at risk.
The scale of the move
39,600 BTC is a lot of bitcoin, even when broken into pieces smaller than one coin. At current prices, that's well over a billion dollars worth of the cryptocurrency. The transactions were spread across thousands of addresses, suggesting a coordinated or at least widespread reaction from Coldcard users who decided to move their holdings to other wallets.
This kind of fragmentation is unusual. Most large bitcoin movements come from exchanges or whales shifting big chunks. Here, the pattern is the opposite: many small transactions adding up to a huge total. The last time the network saw this much sub-1 BTC activity was during the panic after FTX collapsed, when users rushed to self-custody.
Why small transactions?
Coldcard is a popular hardware wallet, favored by security-conscious bitcoiners. When news of the hack broke, users likely wanted to get their funds out fast. Moving bitcoin in small increments can be a way to avoid drawing attention or to test the safety of a new address before sending larger amounts. It also suggests many individual users, not just a few big holders, were spooked.
The hack itself hasn't been fully detailed, but the response is clear: trust in the device took a hit. For a product marketed as ultra-secure, any breach is a big deal.
Attack still active, researchers say
Security researchers tracking the Coldcard hack say the attack vector hasn't been neutralized. They warned that the exploit remains live, meaning anyone still using an affected device could be vulnerable. The warning came as the 39,600 BTC movement was underway, adding urgency to the situation.
Coldcard's parent company, Coinkite, has not yet released a full post-mortem or a patch. Users are left to decide whether to keep using their devices or migrate to alternatives. The 39,600 BTC shift suggests many have already made that choice.
What's next? The ball is in Coinkite's court. Until they confirm the hack is contained and issue a fix, more users may follow suit. The 39,600 BTC figure could grow.
