Roughly $15 billion in bitcoin moved to new wallets after hackers compromised hardware wallet maker Coldcard, according to a Decrypt report on the incident and the on-chain activity that followed it.

The figure stands out. Self-custody migrations of this scale are rare, and this one wasn't driven by market conditions — it was driven by fear that a device trusted to hold private keys offline had been breached. Coldcard, made by Canadian firm CoinKite, markets itself on the premise that its devices never touch the internet. A hack of the vendor rather than the chain itself puts that premise under direct pressure.

The episode is a reminder that hardware wallet risk doesn't only live in the chip or the firmware. It lives in the vendor's supply chain, its update infrastructure, its communications — every layer between the manufacturer and the device in a user's hand.

How big is $15 billion in moved bitcoin?

At the reported scale, the migration ranks among the largest self-custody reshuffles recorded. Every one of those transfers represents a user generating a new seed phrase, signing transactions, and re-securing funds — a manual, deliberate process that people don't undertake lightly.

That volume of movement carries its own operational weight:

• Exchange deposit addresses and analytics firms saw unusual spikes in wallet rotation activity.
• Users who had never practiced seed-phrase recovery were forced to do it under time pressure.
• Some funds likely landed on new hardware from rival manufacturers, reshuffling vendor market share.

The episode also stress-tested the industry's informal warning network. News of the compromise traveled faster than most users could act, and the gap between disclosure and migration is where losses would have happened — if they were going to.

What does this change for hardware wallet users?

The practical lesson is one veteran self-custody users already know: the vendor is part of your threat model. A device can be air-gapped and still be compromised at the point of manufacture, in a firmware update, or through the channels a company uses to ship and communicate.

Standard defenses held up here. Users who followed the core rule of hardware wallets — verify your receive address on the device itself, generate seeds on-device, never trust a computer display — had a narrower attack surface than those who cut corners.

For institutions and high-net-worth holders, the incident will accelerate a shift that was already underway: multisignature setups, duplicate devices from different vendors, and formal key-management policies that treat any single hardware supplier as a single point of failure.

What happens next?

Expect two follow-ons. First, hardware wallet makers will face harder questions about their security audits and supply-chain controls, and buyers will start asking for them by name. Second, on-chain analysts and exchanges will keep watching whether the $15 billion in moved coins settles into long-term storage or leaks toward exchanges — the tell for whether this was pure defensive rotation or something worse. Coldcard's response over the coming weeks, including any disclosed root cause, will determine whether the migration reverses or becomes permanent customer attrition.

By Daniel Okafor