{"id":76246,"date":"2026-08-01T21:48:41","date_gmt":"2026-08-01T21:48:41","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/coldcard-theft-balloons-to-88m-as-exchange-deposits-spike-old-btc-moves-bitcoin-news\/"},"modified":"2026-08-01T21:48:41","modified_gmt":"2026-08-01T21:48:41","slug":"coldcard-theft-balloons-to-88m-as-exchange-deposits-spike-old-btc-moves-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/coldcard-theft-balloons-to-88m-as-exchange-deposits-spike-old-btc-moves-bitcoin-news\/","title":{"rendered":"Coldcard Theft Balloons to $88M as Exchange Deposits Spike, Old BTC Moves \u2013 Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Galaxy tracked 1,367 BTC swept from 4,585 addresses across 3 waves.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Binance and other exchanges added a net 11,163 BTC on July 31.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Galaxy is watching 300 attacker addresses for the first outbound spend.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>A Third Wave Expands the Damage<\/h2>\n<p><a href=\"https:\/\/x.com\/glxyresearch\/status\/2083623500183421043?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">Galaxy Research disclosed on X<\/a> that the three suspected waves drained about 4,585 addresses and captured bitcoin worth approximately $88.6 million at the time of its analysis. The research group cautioned that its findings are preliminary and based entirely on publicly available Bitcoin blockchain data. Another dashboard called Coldcard Sweep Watch is <a href=\"https:\/\/coldcard-watch.vercel.app\" target=\"_blank\" rel=\"noopener noreferrer\">placing the theft at 1,158.8480 BTC<\/a> at 5 p.m. EDT on Saturday.<\/p>\n<p>According to Galaxy\u2019s researchers, the first wave was the largest, sweeping 1,082.65 BTC from 1,195 addresses in 41 minutes on July 30. A second operation collected 76.16 BTC from 1,478 addresses the following day. The third wave stretched from July 31 into Aug. 1 and drained roughly 208 BTC <a href=\"https:\/\/news.bitcoin.com\/a-beginners-guide-to-bitcoin-address-evolution\/\">from 1,912 addresses<\/a>.<\/p>\n<figure id=\"attachment_836036\" aria-describedby=\"caption-attachment-836036\" style=\"width:1200px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-836036\" class=\"wp-caption-text\">Image source: Galaxy Research thread on X.<\/figcaption><\/figure>\n<p>That third operation did not look like a simple continuation of the first two. Waves 1 and 2 funneled funds through a small number of collector and holding addresses. Wave 3 instead sent victims\u2019 funds into 293 separate P2WSH vaults, a type of bitcoin address that can hide its spending conditions until the coins move.<\/p>\n<p>The separate vaults make it harder for outside observers to group the funds together. Galaxy explained that the change could indicate that the original attacker rebuilt the operation after the first sweeps became public, or that another party found the same vulnerable pool of addresses. Blockchain records alone cannot determine which explanation is correct.<\/p>\n<p>Galaxy connected the activity to a <a href=\"https:\/\/news.bitcoin.com\/featured\/the-coldcard-exploit-explained-who-lost-bitcoin-and-whos-at-risk\/\">vulnerable Coinkite Coldcard firmware release<\/a> shipped on March 17, 2021. None of the affected coins were created before that release, and the median victim address had remained inactive for about 3.5 years, matching the behavior expected from long-term cold storage.<\/p>\n<h2>Exchange Deposits Add a Second Signal<\/h2>\n<p>As researchers mapped the suspected thefts, centralized cryptocurrency exchanges recorded a sharp increase in bitcoin deposits on July 31. <a href=\"https:\/\/x.com\/SaniExp\/status\/2083510334384414818?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">Data shared by Sani of Timechainindex.com showed net exchange inflows<\/a> of 11,163 BTC during the day.<\/p>\n<p>River received an estimated 3,679 BTC, followed by Binance with 3,224 BTC, Kraken with 2,848 BTC, and OKX with 1,291 BTC. Centralized entities collectively received 15,205 BTC from unidentified addresses, lifting their reported holdings massively in a single day.<\/p>\n<figure id=\"attachment_836039\" aria-describedby=\"caption-attachment-836039\" style=\"width:1812px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-836039 size-full\" title=\"Coldcard Theft Balloons to $88M as Exchange Deposits Spike, Old BTC Moves\" src=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/hoocpzex0aag7kn.jpeg\" alt=\"Sani from timechainindex.com on X screenshot. \" width=\"1812\" height=\"800\" srcset=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/hoocpzex0aag7kn-300x132.jpeg 300w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/hoocpzex0aag7kn-1024x452.jpeg 1024w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/hoocpzex0aag7kn-768x339.jpeg 768w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/hoocpzex0aag7kn-1536x678.jpeg 1536w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/hoocpzex0aag7kn.jpeg 1812w\" sizes=\"auto, (max-width: 1812px) 100vw, 1812px\"\/><figcaption id=\"caption-attachment-836039\" class=\"wp-caption-text\">Image source: Sani from timechainindex.com on X.<\/figcaption><\/figure>\n<p>Large exchange inflows often attract attention because coins deposited at trading platforms may be prepared for sale, collateral, or internal custody transfers. The data does not establish that the July 31 deposits came from Coldcard users, attackers or anyone responding directly to the incident.<\/p>\n<p>The timing is still quite notable. A<a href=\"https:\/\/news.bitcoin.com\/featured\/was-ai-responsible-for-finding-the-coldcard-security-flaw\/\"> security scare can most definitely prompt holder<\/a>s to reorganize storage, move coins to exchanges, or abandon wallet setups they no longer trust. It can also coincide with unrelated institutional transfers, customer deposits, and exchange bookkeeping, making the inflow spike important but inconclusive.<\/p>\n<h2>Lots of Dormant Bitcoin Starts Moving<\/h2>\n<p>A third development emerged as a large slew of addresses created between 2010 and 2017 began moving coins after nine to 16 years of inactivity, according to statistics Bitcoin.com News <a href=\"https:\/\/btcparser.com\" target=\"_blank\" rel=\"noopener noreferrer\">collected from btcparser.com<\/a>. Visible transactions from July 30 through Aug. 1 totaled about 306 BTC, including repeated transfers of 10 BTC and 30 BTC.<\/p>\n<p>One address created July 2, 2010, moved an old coinbase transaction of over 50 BTC. Other transactions included 37.8 BTC from a 2014 address and a coordinated group of transfers from three wallets created on July 29, 2017. Those three wallets moved 37.5 BTC and two separate 30 BTC amounts in the same block.<\/p>\n<p>The dormant activity cannot be tied to the Coldcard sweeps from the available data. In fact, Galaxy Research detailed that the suspected victims\u2019 coins were all created after the vulnerable firmware was released in 2021, while many of the newly <a href=\"https:\/\/news.bitcoin.com\/ghosts-of-the-silk-road-dormant-wallets-move-over-322m-in-bitcoin\/\">active dormant wallets<\/a> held bitcoin years before Coldcard existed.<\/p>\n<p>However, much like the exchange activity Sani reported, long-dormant <a href=\"https:\/\/markets.bitcoin.com\/crypto\/bitcoin\" target=\"_blank\" rel=\"noopener noreferrer\">bitcoin (BTC)<\/a> holders may be questioning their security setups and shifting funds to alternatives, including custodial services.<\/p>\n<p>As far as what we do know, Galaxy Research disclosed that it is monitoring seven holding addresses from the first two waves and 293 vaults from the third. The first spend from those vaults could expose their scripts and reveal whether the same signing keys or spending structure appear across multiple addresses.<\/p>\n<p>At press time, <a href=\"https:\/\/news.bitcoin.com\/market-updates\/coldcard-exploit-fuels-market-fear-as-2-bitcoin-forks-loom-ahead\/\">online sentiment remained deeply bearish<\/a>, with BTC trading below $63,000 at precisely $62,326 per coin.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/crypto-news\/coldcard-theft-balloons-to-88m-as-exchange-deposits-spike-old-btc-moves\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Galaxy tracked 1,367 BTC swept from 4,585 addresses across 3 waves. Binance and other exchanges added a net 11,163 BTC on July 31. Galaxy is watching 300 attacker addresses for the first outbound spend. A Third Wave Expands the Damage Galaxy Research disclosed on X that [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":76247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/76246"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=76246"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/76246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/76247"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=76246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=76246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=76246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}