A reported hack of Coldcard hardware wallets was followed by roughly $15 billion in Bitcoin being moved, an event that has put self-custody users on alert and drawn scrutiny to how quickly funds shifted after the exploit surfaced.
The Coldcard hack and the subsequent wave of Bitcoin transfers were detailed in reporting on the incident, which tied the large on-chain movement to safety-driven activity following the exploit disclosure.
Security firm TRM Labs described the incident as the largest hardware wallet exploit of 2026, framing it as a direct compromise affecting Coldcard users rather than an exchange or custodial breach.
The device maker itself flagged a related risk in a Coldcard Mk3 seed generation warning, which addressed conditions under which wallet keys could be exposed.
Why moving Bitcoin at this scale draws attention
A transfer of this size stands out because it dwarfs routine large-wallet activity, and it followed a specific security trigger rather than normal market rotation. That combination is what made the movement notable to on-chain watchers.
Large on-chain movement does not automatically equal selling. Funds shifting to fresh addresses can reflect users relocating holdings to safer setups, a pattern consistent with a jump in new Bitcoin addresses as users moved funds after the exploit report.
On-chain researchers tracked the broader network picture through Glassnode’s Week On-chain report for week 31 of 2026, which covered the period around the incident.
What it means for holders right now
For holders, the immediate question is whether the transfers were attacker-driven, precautionary, or operational, and the available reporting does not settle that. Treat motive as unconfirmed until wallet activity or an official statement clarifies it.
Estimated exposure has been placed in the range of nine figures, with potential losses from the Coldcard hack nearing $114 million, a figure separate from the total volume of Bitcoin relocated in response.
What to watch next: follow-up movement from the same addresses, any confirmation from Coldcard maker Coinkite, and whether affected coins reach exchange deposit addresses, which would be the clearest signal of intent to sell.
Security lessons from the incident
The episode has renewed debate over self-custody hygiene. Bitcoin advocate Cory Klippsten argued the exploit should drive a broad self-custody security overhaul rather than a retreat from holding one’s own keys.
The exploit also reopened questions about air-gapped Bitcoin wallet security, since air-gapping alone does not protect against flaws in how a device generates or stores seed material.
For users who suspect exposure, the standard response is to move funds to a wallet generated on a device confirmed unaffected, verify addresses on-device before sending, and avoid reusing any seed tied to a potentially compromised setup.
FAQ
What was hacked? Coldcard hardware wallets, according to the incident reporting and the device maker’s own seed generation warning, not an exchange.
Were user funds confirmed stolen? Exposure has been estimated near nine figures, but a full accounting of confirmed theft versus precautionary movement is not yet established.
Who moved the $15 billion in Bitcoin? That is unresolved. The movement has been tied to safety-driven activity after the exploit, but attribution between attackers and cautious users is not confirmed.
Was the Bitcoin sold? Moving coins to new addresses is not the same as selling. There is no confirmed evidence the relocated Bitcoin reached exchanges for sale.
What should holders do? Monitor for official statements from Coinkite, and if using a potentially affected device, migrate funds to a verified-secure wallet.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
