Bitcoin Nears $64,000 as a Fourth Coldcard Sweep Keeps Fear High

Bitcoin near $63,500 is testing market support, not just sentiment

Bitcoin near $63,500 is more than a round number. It is a live test of who is still supporting the market. Price has held up better than many expected, but the support behind it may be thinner than the chart suggests. Bulls can read that as resilience; bears can read it as strength without enough institutional backing.

ETF demand has cooled, and that matters

That skepticism is not unfounded. US spot bitcoin ETFs took in just $205 million in net inflows for the month, the lowest monthly total on record, after $2.43 billion and $4.51 billion in outflows in May and June. That does not invalidate the rally, but it does suggest investors should care as much about who is buying as they do about the headline price.

The Coldcard sweeps add real supply risk

The exploit deepens that tension. A suspected fourth Coldcard sweep moved over 380 BTC from 462 suspected victim addresses, on top of roughly 1,367 BTC across 4,585 addresses already documented in earlier waves. Researchers said those stolen funds had an average dormancy of 3.18 years, which means this was not fresh speculator inventory hitting the market. If older coins are being removed while ETF demand has cooled, Bitcoin is not just testing a price level; it is testing whether buyers can absorb both fear and realized supply.

Why the fourth Coldcard wave matters more than the loss headline

The important point is not the one-off dollar loss. It is that the exploit still looks like an open attack surface, not a closed incident.

A weak-entropy flaw can keep producing targets

The root problem dates back to a March 2021 firmware integration error that routed seed generation to a software fallback instead of the hardware RNG. Block says the flaw meant reduced entropy and permanently compromised seeds, so an attacker who can narrow device state may be able to reproduce candidate seed streams offline. That changes the read from a simple theft event to a still-open vulnerability: earlier sweeps removed coins, but the underlying issue can keep creating targetable addresses.

The patch protects new seeds, not old ones

Coinkite shipped emergency firmware on July 31, but that does not repair an already-compromised seed. As installing it does not repair an existing seed, affected users are being urged to generate a new seed on patched firmware and move funds. In market terms, the risk is shrinking only as owners migrate. Until that happens, the vulnerable pool remains a live overhang rather than a fully settled loss.

Wave four created real time pressure

That is what makes the fourth wave more actionable than the earlier ones. Previous sweeps were mostly analyzed after the fact; wave four was flagged while it was still happening. Galaxy said attackers were moving funds at 13.8 per block, roughly 45 times the pre-incident rate, while similar transactions remain pending in the mempool with replace-by-fee enabled. Because pending transactions signal replace-by-fee, victims who spot their address in the mempool have minutes to pay a higher fee and move funds first. That turns the episode into a live race for confirmation, not just a post-mortem loss report.

Bears can argue the confirmed damage is still finite and that panic selling can be contained once users feel they can outbid attackers. Bulls can argue the bigger risk is repetition. If wave four stays contained, the market may treat it as noise. If similar sweeps keep showing up in real time, the pressure becomes less about sentiment and more about ongoing supply risk.

How traders are framing the setup from here

What to watch next

If price breaks below that low while exploit activity remains live, fear is starting to look more like actual selling pressure. If price holds, the market is choosing stability over panic. For now, that is the cleanest way to frame the setup: a stability test that depends on whether the fourth wave stays contained or keeps renewing.