Bitcoin fell below $63,000 on Monday even as geopolitical news that would typically lift risk assets broke in crypto’s favor, a reminder that internal security scares can override the macro tailwinds traders usually watch. The largest cryptocurrency dropped from a Sunday high of $63,600 to $62,800, down 1% on the day and 4% for the week, as an ongoing exploit targeting Coldcard hardware wallets kept sentiment on edge.
Ether fared worse, sliding more than 1% to $1,858 and shedding 5% over the week. The token has not closed above $1,900 since the prior week. XRP eased almost 1% to $1.07, Solana slipped 0.5% to near $73, and Dogecoin dipped 0.5% to just under 7 cents. BNB was the exception, holding flat on the day and adding 1.6% over the week. Hyperliquid’s HYPE token was the worst performer among the top ten, down 1% on the day and 12.8% over the week.
A Rare Case of Macro Being Ignored
The backdrop should have supported crypto prices. Reports emerged that President Trump had called off a planned strike on Iran in favor of proposed new talks, with Saudi Arabia pushing for the reopening of the Strait of Hormuz, a key artery for global oil shipments. Brent crude futures for October delivery responded by dropping as much as 7.3% to $81.55 a barrel. The 10-year Treasury yield eased 4 basis points to 4.69%, retreating after touching its highest level since January 2025 just last week. Equity futures also pointed higher, with Nasdaq 100 and European share futures both up 0.8%, and gold added 0.3% to trade near $4,060 an ounce.
In a typical market cycle, falling oil prices and easing bond yields alongside rising equity futures would be read as a green light for risk assets, crypto included. Instead, bitcoin and its peers moved lower, decoupling from the signals that have often driven digital-asset prices in lockstep with broader markets. The disconnect points to a specific, internal source of pressure: the Coldcard wallet exploit.
The Coldcard Exploit’s Toll
Since July 30, attackers have drained funds from Coldcard hardware wallets in three sequential waves, with total losses reaching 1,367 BTC, worth roughly $89 million, spread across 4,585 addresses. The first wave alone accounted for 1,083 BTC taken from 1,196 addresses. A third wave saw a smaller amount, 208 BTC, but spread across a much larger number of wallets, 1,912, suggesting attackers shifted tactics from targeting large-balance addresses toward smaller ones as the exploit progressed.
That shift is notable in itself. Moving from concentrated, high-value targets to a wider pool of smaller wallets often signals that the most lucrative targets have already been exhausted, while also complicating recovery efforts because losses are now dispersed across thousands of addresses rather than concentrated in a handful of large ones. As of the facts available, none of the losses from any of the three waves had been recovered.
What It Means for the Market
The episode illustrates a dynamic that crypto investors need to keep in view: security incidents affecting infrastructure, in this case a specific hardware wallet brand, can move markets independently of, and even in defiance of, favorable macro conditions. Hardware wallets are marketed as a more secure alternative to exchange custody or software wallets, precisely because they are supposed to keep private keys offline and insulated from remote attacks. An exploit undermining that premise strikes at a foundational assumption of self-custody, which helps explain why it weighed on sentiment broadly rather than being isolated to holders of the affected devices.
Fund flow data added another layer of nuance. Ether-focused funds recorded inflows on Friday even as bitcoin funds saw outflows, an atypical divergence from the pattern in which the two largest crypto assets tend to see correlated fund movements. Whether that divergence reflects investors rotating within crypto rather than exiting altogether, or a more specific reaction tied to the wallet exploit, is not established by the available data, but it underscores that flows into the two largest tokens are not moving in tandem right now.
What to Watch Next
- Whether Coldcard or affected custodians disclose further technical details on the exploit’s mechanism and whether any funds are eventually recovered or frozen.
- Whether additional waves of the exploit emerge, given the pattern of attackers moving to progressively smaller wallets.
- Whether the divergence in ether and bitcoin fund flows persists in coming weeks or proves to be a one-off.
- Whether the Iran talks and Strait of Hormuz developments materialize into concrete policy outcomes that could reassert typical macro correlations with crypto prices.
Source: CoinDesk
This content is for informational purposes only and does not constitute financial or investment advice.
Create a free account to comment and earn rewards.
Create account Log in