Whales Are Buying While Retail Runs: Inside Bitcoin's Coldcard Confidence Crisis

Bitcoin is once again splitting into two very different stories depending on who's holding the coins. Over the past week, on-chain data has revealed a sharp divergence in behavior between large and small holders. According to analytics firm Santiment, wallets holding between 10 and 10,000 BTC — the classic "whale" cohort — added a combined 19,610 BTC since July 29, a 0.14% increase in their aggregate holdings. Over that same window, wallets holding less than 0.01 BTC trimmed their positions by 0.55%. In plain terms: small holders are heading for the exits, and bigger players are quietly buying what they're selling.

What's driving the retail exodus

The timing isn't a coincidence. This split emerged in the direct aftermath of a serious security failure at Coldcard, one of the most trusted names in Bitcoin hardware wallets. The root cause traces back to a 2021 firmware build error from Coinkite, Coldcard's manufacturer. That bug caused certain devices to generate seed phrases with far too little randomness, meaning the "random" recovery phrases protecting users' private keys were, in some cases, guessable. Attackers appear to have caught on, and began systematically draining affected wallets in late July. The scale of the theft has kept growing. Security researchers at Galaxy Research have tracked at least three distinct waves of attacks between July 30 and August 1, pulling roughly 1,367 BTC — around $88–89 million — from more than 4,500 addresses. Investigators say the sweeps look automated, possibly orchestrated with the help of large language models, and have warned that every vulnerable single-signature Coldcard address created after the 2021 update remains exposed. Coinkite has since released emergency firmware patches across its Mk2 through Mk5 and Q device lines, but for wallets that were already compromised, the fix comes too late. What makes this especially unsettling is who got hit. The average dormancy of the stolen coins was over three years, meaning these weren't active traders — they were long-term holders who did everything "right" by moving their coins into self-custody, in many cases years ago, and simply left them there.

A crisis of confidence, not just capital

That detail matters, because it explains why the fallout has rippled well beyond the directly affected wallets. Santiment's data suggests the retail selling isn't limited to Coldcard users who lost funds — it's a broader wave of anxiety about hardware wallet security in general. If a seed phrase generated years ago on a well-known, reputable device can turn out to have been unsafe the whole time, the core promise of self-custody — "not your keys, not your coins" — starts to feel a lot shakier. That phrase, ironically, became a rallying cry for the industry after the FTX collapse in 2022, when Coldcard sales surged as people rushed to get their coins off exchanges. Now the flow appears to be reversing. On-chain data from CryptoQuant shows the largest movement of small-holder Bitcoin back onto exchanges since the FTX panic — a sign that some retail investors are trading self-custody risk for exchange custody risk, at least for now.

Why whales are buying the dip

Meanwhile, larger holders don't seem rattled. Santiment noted that the accumulation isn't concentrated in one or two addresses — it spans the broader 10–10,000 BTC cohort, suggesting this is a genuine pattern of larger market participants absorbing supply rather than a single large buyer skewing the numbers. That said, on-chain accumulation isn't a guaranteed bullish signal. Analysts caution that wallet-balance growth among big holders can reflect several things beyond conviction buying: long-term storage strategy, market-making activity, arbitrage positioning, or simply funds being shuffled between custody setups. It's also worth noting that institutional demand has been mixed — spot Bitcoin ETFs closed out July with about $51.3 billion in cumulative net inflows since launch, but posted a weekly outflow of roughly $61.5 million at month's end, leaving 2026 net flows negative by more than $5 billion.

The bigger picture

Despite the security scare, a hawkish Fed, rising bond yields, and a broader unwind in AI-related trades, Bitcoin has held up better than many expected — consolidating above its bear-market lows rather than breaking down further. Bitfinex analysts point to positioning as a key reason: much of the leverage in the system was already flushed out during a late-June selloff that pushed BTC below $58,000, meaning there was simply less forced selling available to amplify this latest shock. Technically, the coming days may be telling. A decisive break above the 50-day EMA could open the door toward the 200-day EMA near $72,740. A rejection at resistance, on the other hand, risks a retest of support closer to $60,730 — with a breakdown potentially triggering a deeper pullback. For now, the Coldcard incident stands as a stark reminder that in Bitcoin, security failures don't just cost money — they cost trust. And the market is currently watching whether that trust erodes further, or whether the whales quietly buying the dip turn out to be right.