Bitcoin has seen a spike in very small transfers—moves of less than 1 BTC—that match the intensity last observed around the collapse of FTX. The renewed activity comes as researchers continue to track a suspected Coldcard wallet-related hack, underscoring how quickly users are reacting when self-custody tools appear compromised.

According to CryptoQuant head of research Julio Moreno, Friday recorded the highest daily level of sub-1 BTC transfers since November 2022, with 39,600 BTC moved. The total was just 300 BTC below 39,900 BTC transferred on Nov. 16, 2022, shortly after FTX filed for bankruptcy. Moreno framed the comparison as a sign of urgency and said users appear to be “taking action.”

Key takeaways

• Daily Bitcoin transfers below 1 BTC hit their highest level since November 2022, totaling 39,600 BTC, per CryptoQuant’s Julio Moreno.
• Galaxy Research says the suspected Coldcard incident caused estimated losses of 1,367 BTC across 4,585 addresses, after identifying a further 207.7 BTC taken in an additional wave.
• Galaxy’s Alex Thorn warned that the attack was still ongoing and urged affected users to move funds immediately from Coldcard-generated addresses.
• The incident is reigniting debate over whether self-custody is safer than relying on third-party platforms, with executives arguing the impact differs across user approaches.

Small-transfer surge echoes the post-FTX era

While large market moves often capture headlines, the current data point focuses on behavior at the granularity of everyday wallet operations: sub-1 BTC transfers. Moreno’s analysis suggests the market is seeing a level of small withdrawals not observed since the period following FTX’s bankruptcy filing.

The comparison matters because it points to reflexive user behavior—moving funds in smaller increments—rather than a single, coordinated “whale” action. In the wake of FTX, exchange-related uncertainty drove users toward faster, more defensive moves. Here, the catalyst is different: ongoing concerns tied to Coldcard-generated addresses.

Moreno’s observation that these transfers had not occurred at similar daily intensity since the FTX collapse suggests that the Coldcard incident may be triggering a comparable sense of immediate risk. That doesn’t prove equivalence in scale or cause, but it does show that user reaction can look similar even when the underlying event is distinct.

Galaxy Research details additional theft wave

Galaxy Research, part of Galaxy Digital, reported Saturday that it had identified another attack wave tied to the suspected Coldcard hack. In that wave, an additional 207.7 BTC was drained—valued at roughly $13.2 million at the time Galaxy cited.

Including the newly identified activity, Galaxy estimated total losses of 1,367 BTC, affecting 4,585 addresses. Galaxy’s reporting suggests the incident is not a single moment of exploitation, but an ongoing process where both victims and attacker infrastructure continue to emerge as investigators refine their tracking.

Galaxy also points readers to a Coldcard-focused tracking resource, “Coldcard Watch,” as part of the broader transparency around wallet activity connected to the suspected incident.

“Still ongoing” warnings push users toward immediate withdrawal

Alex Thorn, Galaxy Digital’s head of firmwide research, said in an X post on Sunday that the attack remained active. Thorn urged users to move funds from Coldcard-generated addresses immediately if they had not already done so.

Thorn added that his team continues to identify both new victim addresses and attacker addresses. He also noted that reports from users have helped investigators and authorities track stolen funds, reinforcing a practical implication for readers: in incidents where on-chain patterns are evolving, user-provided information can accelerate investigative work.

The warning is also a reminder that self-custody isn’t only about holding assets—it’s about operational readiness. When wallet-generated addresses are implicated, the “time to react” becomes part of the security model, whether users follow best practices or not.

Self-custody debate returns as commentators argue “failure” vs “risk control”

The suspected Coldcard hack has again pulled the conversation toward the long-running fault line in crypto security: self-custody versus third-party custody. Self-custody is a foundational principle in Bitcoin, emphasizing user control without dependence on intermediaries. Yet security incidents involving consumer-grade tools can complicate the narrative and raise fresh questions about usability and safety.

Nick Neuman, CEO of Bitcoin security company Casa, pushed back against claims that “self-custody is over.” He argued that because self-custody is distributed, users have time to respond as threats are identified. Neuman also estimated that potentially 10 times more Bitcoin was protected through self-custody than was stolen and identified so far in the attack.

That position reframes the debate from whether an incident can occur at all to how the system responds once the risk becomes visible. In Neuman’s view, the existence of ongoing victims does not negate the defensive advantage that self-custody can provide—especially when users monitor, verify, and act on warnings.

Others took the issue in a different direction. Eric Balchunas, a senior ETF analyst at Bloomberg, argued via X that Bitcoin exchange-traded funds may offer a safer and more convenient alternative for many users, pointing to the longer operating history of ETFs.

In contrast, critics of that argument say the Coldcard episode reflects a failure of a specific wallet provider or implementation rather than a fundamental breakdown of self-custody itself. The tension here is important for readers to recognize: “self-custody” is not a single technology—it’s a set of practices and tools—so incidents can be interpreted as either systemic or localized depending on what readers believe broke down.

What to watch next

With Galaxy saying the attack is still unfolding and continuing to identify new victim and attacker addresses, the next key signal will be whether transfer patterns and wallet-specific indicators stabilize as users move funds. For investors and builders, the bigger question is how quickly the broader community can validate affected addresses and coordinate response—because in cases like this, speed is part of the security outcome.

“Seems people really moved their Bitcoin out of extreme caution after the coldcard hack,” Moreno said.

Small Bitcoin transactions tell a similar story. According to CryptoQuant, the combined volume of all transfers smaller than 1 BTC reached 39,600 BTC on Friday, just shy of the 39,900 BTC moved on November 16, 2022, the day after FTX filed for bankruptcy.

“The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse,” Moreno said, adding that he liked to see people “taking action.”

Blockchain sleuth Timechainindex made a similar observation, noting that total net inflows to exchanges totaled 11,163 BTC on July 31, most of which flowed into major exchanges and firms like Binance, River, Kraken, and OKX.

“These are plebs who are scared,” the handle said on X, explaining the nature of the BTC inflow.

The total number of BTC held in wallets tied to centralized exchanges has increased to 2.715 million from 2.703837 million before the Coldcard exploit.

Reverse of FTX

Following FTX’s failure, the dominant risk was exchange insolvency and withdrawal freezes. Holders responded by moving bitcoin into self-custody, reducing exchange balances.

The current episode centers on self-custody risk associated with a single hardware wallet. The vulnerability has prompted some holders to temporarily shift smaller balances onto exchanges.

BNB Chain said on Aug. 1 that it was pursuing legal action against a former employee who allegedly retained unauthorized access to a seed phrase and later used the associated wallet address with a new memecoin. 

The network said it was cooperating with authorities but did not identify the individual, jurisdiction, agency or court.

The wallet was created for a company video tutorial showing how to generate a token, according to BNB Chain’s statement. The organization said the former employee later generated a new private key from the retained seed phrase. It denied creating, authorizing, promoting or participating in the new token.

BNB Chain distances itself from ASTEROID

BNB Chain described the address’s later use as independent activity and said the token was not affiliated with or endorsed by the ecosystem. Its announcement did not provide a complaint, case number, named regulator or details about where the planned legal action would be brought.

Changpeng “CZ” Zhao reposted the statement and called the former employee “basically a scammer,” while telling users to “Stay SAFU.” His description is an allegation, not a court finding. BNB Chain did not disclose whether it is seeking asset recovery, damages or criminal charges.

Four wallets allegedly controlled nearly 80% of supply

On-chain analytics account Lookonchain linked the launch to a token called Asteroid Shiba, or ASTEROID. It alleged that four newly created wallets spent about $10,000 to acquire 796.7 million tokens, equal to 79.67% of the stated one billion-token supply.

Lookonchain said the wallets later sold 718.8 million ASTEROID for 1,103 BNB, valued at about $638,000, producing an estimated $628,000 profit. It published the four addresses for review on BscScan. However, blockchain records show wallet activity, not the legal identity controlling it. The employee attribution therefore remains an allegation supported by BNB Chain’s statement and Lookonchain’s analysis.

A seed can generate the private keys used within a deterministic wallet. Removing one private key from a device does not invalidate a retained copy of the underlying seed, which can be used to derive wallet keys again. The case raises questions about how tutorial wallets and recovery phrases were handled when employees left.

BNB Chain has not disclosed when the employee departed, how long the seed remained accessible or when it discovered the retained access. It also has not said whether other tutorial wallets are under review.

Crypto.news reported in 2025 that Binance suspended an employee following an investigation into alleged token front-running involving knowledge from a previous BNB Chain role. The latest statement does not say whether the incidents involve the same person.

Separately, as crypto.news reported, investigators have used fresh wallet clusters and concentrated ownership to examine suspected memecoin manipulation. Such patterns can establish connections between addresses, but identity claims may still require exchange records or other off-chain evidence.

Legal action and wallet tracing come next

BNB Chain said it is working with relevant authorities, but its statement did not name an agency that had opened an investigation. A formal complaint or enforcement notice would clarify the legal claims, venue and requested remedies. Until then, the company statement and on-chain analysis remain the main public records.

The wallets and any destinations receiving the 1,103 BNB may provide a trail for investigators. Recovery would depend on whether funds reach identifiable exchange accounts or services able to respond to lawful requests. BNB Chain has not announced a freeze, recovery or repayment.

No token-price reaction is included because multiple assets use the ASTEROID name and BNB Chain did not publish a contract address. Using market data for another token could misstate the event. The next verified development would be a company update, regulator notice or public court filing.

Trump Media & Technology Group, the parent company behind the Truth Social platform, has continued trimming its Bitcoin exposure, according to on-chain tracking shared by Lookonchain. The latest activity adds to a months-long pattern of sales that have significantly reduced the company’s reported BTC balance.

In transfers identified by Lookonchain using Arkham data, Trump Media-linked wallets sent 2,628 BTC to Crypto.com. The move is reported to be worth roughly $165 million, extending a selling cycle that began about seven months ago.

Key takeaways

• Trump Media-linked wallets reportedly transferred 2,628 BTC (about $165M) to Crypto.com, per Lookonchain’s analysis of Arkham data.
• Lookonchain estimates Trump Media has sold a total of 7,281 BTC over the past seven months, worth roughly $545M.
• Arkham wallet data cited by Lookonchain shows remaining holdings of 4,261 BTC, worth about $269.8M at the time of reporting.
• Current scrutiny is taking place alongside broader legislative debate over the CLARITY Act, which has drawn attention for its ethics provisions around digital asset activity.

New Crypto.com transfers cut into remaining Bitcoin

Lookonchain reported that Trump Media has executed another batch of Bitcoin sales via transfers to Crypto.com. The analysis attributes the transactions to Trump Media-linked wallets and cites Arkham’s wallet and transaction information.

In this most recent set of moves, Arkham data referenced by Lookonchain points to two transfers: one for 2,429 BTC and another for 198.9 BTC.

Taken together, Lookonchain said these transfers total 2,628 BTC, valued at about $165 million based on the prevailing price assumptions used in its reporting. This latest reduction follows earlier transfers to Crypto.com reported on May 22, when the company-linked wallets moved a combined 2,650 BTC, worth roughly $205 million.

Seven-month selling spree shrinks reported holdings

Lookonchain frames the most recent transfer as the continuation of a broader liquidation strategy. The tracker said Trump Media purchased 11,542 BTC at an average price of $118,522 before beginning to sell portions of its holdings around seven months ago.

Based on the same dataset, Lookonchain estimates cumulative sales of 7,281 BTC over that period, worth approximately $545 million. The analysis also calculates an average selling price of $74,855 per BTC for those transactions.

After the latest outflows, Arkham data referenced in the report indicates Trump Media’s remaining Bitcoin holdings stand at 4,261 BTC, valued at about $269.8 million at the time of publication. That implies the company’s reported BTC balance has fallen by roughly 63% compared with the initial purchase total cited by Lookonchain.

Why the timing matters amid ethics and ownership debates

Beyond the on-chain mechanics, the sales arrive as lawmakers debate the Digital Asset Market Clarity (CLARITY) Act, a proposal that has attracted scrutiny for its approach to ethics rules and the question of whether officials’ digital asset activity could create conflicts of interest.

Critics have pointed to a range of Trump-linked crypto initiatives discussed in the broader public policy debate, including memecoins such as Official Trump (TRUMP) and Melania (MELANIA), as well as World Liberty Financial’s governance token WLFI and a USD1 stablecoin. The controversy centers on the overlap between political influence and private crypto holdings or products.

Recent CLARITY Act discussions, as described in coverage referenced by Cointelegraph, have focused on tightening ethics provisions—particularly rules governing when officials could issue or sponsor digital assets. However, as the source notes, the legislation remains under consideration and does not mandate that companies sell existing holdings.

That distinction is important for investors and compliance watchers: even if a law ultimately changes future behavior for officials or connected entities, it may not retroactively affect the ability of companies to keep, liquidate, or otherwise manage already-held crypto.

What to watch next for Trump Media-linked wallets

For market participants, the key signal in this story is not simply that Bitcoin is being sold, but how steadily it is being done and through which counterparties—here, Crypto.com—based on wallet and transaction clustering reported through Arkham data by Lookonchain.

Readers should watch for whether additional transfers continue to appear from the same Trump Media-linked wallet set, and whether the remaining 4,261 BTC balance changes further. At the same time, political and regulatory attention around the CLARITY Act suggests that disclosure, governance, and ethics standards for digital asset participation may remain a live topic even if near-term changes do not compel immediate sales.

Trump Media & Technology Group, the parent of Truth Social, has continued to reduce its reported Bitcoin exposure with another batch of transfers to exchange infrastructure. According to Lookonchain, the company sold 2,628 BTC—valued at roughly $165 million at the time of the transfers—via movements to Crypto.com, based on blockchain data compiled from Arkham.

The latest activity adds to a broader pattern of selling observed over the past seven months, shrinking the company’s reported holdings and feeding into ongoing political scrutiny of Trump-linked crypto projects and the ethics questions surrounding digital asset ownership.

Key takeaways

• Trump Media-linked wallets transferred 2,628 BTC (about $165 million) to Crypto.com, according to Lookonchain’s analysis using Arkham data.
• Over the past seven months, reported Bitcoin sales total 7,281 BTC (about $545 million), per Lookonchain.
• Arkham wallet data shows remaining holdings of 4,261 BTC (worth about $269.8 million at the time of reporting).
• Recent transfers include an Arkham-documented transaction for 2,429 BTC and another for 198.9 BTC moving to Crypto.com.
• The selling comes amid congressional discussion of the CLARITY Act, which targets ethics and digital asset rules but does not compel companies to liquidate existing holdings.

Another Crypto.com-linked transfer reduces reported BTC

In a Sunday post on X, Lookonchain said Trump Media sold 2,628 BTC through transfers to Crypto.com. The analysis was based on on-chain visibility attributed to Trump Media-linked entities, with Arkham used as the data layer for identifying the wallet activity.

Lookonchain further reported that Trump Media had purchased 11,542 BTC at an average price of $118,522 before starting to sell portions of its holdings about seven months prior to the latest transactions.

How much Bitcoin has been sold—and what remains

Lookonchain’s tally places total reported sales over the same seven-month window at 7,281 BTC, valued around $545 million, with an average selling price of $74,855 per BTC based on its methodology.

Arkham’s wallet figures cited by the analysis indicate that Trump Media’s remaining Bitcoin holdings were 4,261 BTC at the time of publication, worth approximately $269.8 million.

The most recent movements to Crypto.com, according to Arkham wallet data referenced in the report, included two notable transfers: one transaction of 2,429 BTC and another of 198.9 BTC. These transfers follow earlier activity that Lookonchain linked to the same selling program, including two movements recorded on May 22 totaling 2,650 BTC (worth about $205 million at the time).

Why repeated selling matters for investors watching disclosures

For market participants, the practical significance of these transactions is less about the immediate price impact of any single sale and more about consistency, transparency, and how quickly a large holder can reduce exposure. When a corporate-linked balance sheet shows continued liquidation of a major volatile asset like Bitcoin, investors often interpret it as a shift in treasury strategy, liquidity planning, or a risk-management decision.

Just as importantly, the reported activity draws attention to how on-chain transfers by identifiable entities can affect expectations around future flows. If more transfers to exchange-linked addresses continue, traders may look for repeated liquidity events that can complicate execution for both spot and derivatives participants—particularly if the market perceives the sales as part of a longer unwinding rather than one-off diversification.

CLARITY Act debate keeps ethics questions in focus

Beyond the on-chain movements, the latest Bitcoin sales land at a time when lawmakers are weighing the Digital Asset Market Clarity (CLARITY) Act. In the broader debate, attention has turned to ethics provisions, conflicts of interest, and how public officials should handle relationships with digital asset issuers and related ventures.

Critics have pointed to a cluster of Trump-linked crypto interests discussed in policy circles, including the Official Trump (TRUMP) and Melania (MELANIA) memecoins, as well as World Liberty Financial’s WLFI governance token and USD1 stablecoin. The issue raised by opponents is the overlap between political influence and private crypto holdings—particularly where governance or issuance incentives could be perceived as benefiting affiliated interests.

While current CLARITY Act discussions have focused on tightening ethics rules—such as restrictions on officials issuing or sponsoring digital assets—the legislation remains under consideration and, according to the report’s framing, does not require companies to sell existing crypto holdings.

That distinction is likely to matter in how the market interprets these developments. Even if policymakers move toward stricter disclosure or conflict-of-interest standards, treasury actions already in motion—like the sell-through described by Lookonchain and supported by Arkham wallet data—may continue on a timetable driven by corporate liquidity decisions rather than by immediate regulatory requirements.

What to watch next

Readers should watch for whether additional exchange-linked transfers continue from the same Trump Media-linked wallets and whether lawmakers’ CLARITY Act deliberations progress in a way that clarifies disclosure and ethics obligations for officials and affiliated entities. Until then, the main signal remains the on-chain pattern: reported Bitcoin balances appear to be shrinking in measured batches, supported by repeated wallet movements documented through Arkham and aggregated by Lookonchain.