594 BTC Just Stolen in Coldcard Hack, and Sub-1 BTC Flows Are Flashing FTX-Level Alarm

Coldcard hack triggered fear-driven Bitcoin transfers, not just theft

The main risk here is not only the theft itself, but a wave of defensive moves that could pressure Bitcoin price if fear spreads. 39,600 BTC moved in transfers below 1 BTC, the strongest burst since the FTX fallout, while users are being warned after about 594 BTC stolen from nearly 500 single-signature wallets in roughly 25 minutes. That makes this both a security incident and a market-watch event.

Why traders are split on the read

Bulls can argue this is mainly precautionary migration: users moving funds to fresher wallets or custody setups they trust more, which is not the same as fresh selling. Bears have the cleaner near-term trading read: when investors think their "safe" storage is compromised, the first instinct is often to get funds onto an exchange quickly.

Why the $60,000 level matters now

Bitcoin is still above $60,000, but fears are building around a move below that area and a retest of the $58,000 zone. The key watchpoint is not just how much BTC was stolen, but whether exchange-bound flows stay elevated after the initial alarm fades. If they do, the incident starts to look like a liquidity event. If they normalize quickly, the market is more likely to absorb it.

Why the transfer surge happened: a seed-generation flaw turned cold storage into a recall event

This is not reading like a one-off exploit. It became a mass relocation story because the weakness appears to sit in seed generation itself.

Why users migrated instead of just backing up

Coldcard devices may have created seeds using a predictable periodic down-counter tied to the device's serial number and internal clock, rather than sufficient hardware randomness. That is a crucial distinction. If private-key material is easier to narrow down, the problem is not random luck; it can affect every wallet created under those conditions.

That turns a security bug into a portfolio decision. Users are not moving funds because one random address was drained. They are moving funds because the cold-storage premise failed at key generation. As Coinkite has advised, updating firmware does not repair an already-generated seed; users should create a new seed on a newer device and test a small transfer before moving the full balance.

Why the pressure kept building

The pressure did not end with the first headline theft. Galaxy said researchers identified three attack waves and that the exploit appeared to remain active at the time of reporting. That matters because ongoing drains create a moving deadline. If new victims are still turning up, affected users have less reason to wait for perfect clarity.

There is one calming signal: about 562 BTC was consolidated into one address and has yet to move. That suggests the attacker is still holding rather than dumping into the market. So the immediate market threat is less likely to be attacker-led spot selling than continued user-driven migration.

What matters for traders now: whether fear turns into sustained exchange inflows

The setup is still dynamic. If this remains a custody scare, Bitcoin can absorb the hit and recover. If it turns into a broader flow event, traders will have to price a faster move through support. Markets usually distinguish between headline panic and real selling pressure relatively quickly, and that window is open now.

A hack in one wallet path does not automatically mean Bitcoin spot demand collapses. It does force a fast decision about where trust flows first during stress. That is why timing matters: if the incident is still active at the time of publication, positioning can change before the market fully categorizes the event.

Bull case: price holds and flows normalize

If price holds above the key $60,000 support level while migration heat cools, the market can treat this as a temporary liquidity stretch rather than a trend break. In that scenario, the first buyers are likely to be those watching flow normalization rather than fixating on the hack headline.

Bear case: fear keeps coins moving toward exchanges

If fear continues driving coins to exchanges while the attack remains active, traders are more likely to test the late-June zone around $58,000. That is the cleaner bearish path if custody anxiety starts to look like sustained selling pressure rather than a short-lived scare.

What to watch over the next few sessions