Coldcard Scandal Triggers Exodus: Biggest Sub-1 BTC Movement Since FTX Collapse

The suspected cyberattack targeting Coldcard wallets has triggered the most significant surge in small Bitcoin transactions since the catastrophic collapse of FTX, signaling a massive shift in user behavior and reigniting a fierce debate over the security of self-custody models.

A Movement Not Seen Since the FTX Era

According to data shared by CryptoQuant's head of research Julio Moreno, Bitcoin transfers below 1 BTC climbed to a daily high of 39,600 BTC on Friday, marking the highest level since November 2022. This volume fell just 300 BTC short of the 39,900 BTC recorded on Nov. 16, 2022, days after the exchange filed for bankruptcy. "The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse," Moreno noted, expressing encouragement at seeing users "taking action."

The Self-Custody Paradox and the $88.6 Million Toll

As researchers warn the attack remains active, the incident has become a critical stress test for the core crypto principle of holding one's own keys. Galaxy Research, the research arm of Galaxy Digital, reported a new wave of thefts totaling an additional 207.7 BTC (approx. $13.2 million), bringing the estimated losses to 1,367 BTC ($88.6 million) across 4,585 addresses.

■Alex Thorn, head of firmwide research at Galaxy Digital, warned the attack is ongoing and urged users to move funds immediately.

■Casa CEO Nick Neuman pushed back against claims that "self-custody is over," arguing its distributed nature gives users time to react.

■Eric Balchunas, senior ETF analyst at Bloomberg, argued that Bitcoin ETFs offer a safer and more convenient alternative, shifting the debate toward traditional finance.

From a technical standpoint, this incident exposes the friction between user sovereignty and hardware security. However, the migration of 39,600 BTC is not merely a panic reaction; it is a stress test of the network's resilience. Self-custody is not dead, but it is evolving. This event proves that the community's ability to mobilize and move funds swiftly remains the ultimate defense mechanism against centralized failures and technical exploits.