Coldcard Exploit Triggers Massive Bitcoin On-Chain Activity as Hot Supply Nearly Doubles
A Coldcard hardware wallet exploit triggered a massive surge in Bitcoin onchain activity over the past week, with hot supply nearly doubling while the price remained largely unchanged. The incident stems from a firmware vulnerability introduced in March 2021 that could generate wallet seeds with insufficient randomness, allowing attackers to reconstruct private keys remotely.
According to a research report by K33, approximately 890,000 BTC moved over the seven-day period ending Aug. 4, marking the highest seven-day active supply recorded in 2026. K33 identified the Coldcard attacks as the likely cause, estimating about 1,596 BTC had been stolen from roughly 7,300 addresses at the time of the report. Coordinated sweeps began July 30, and a possible fourth wave has pushed total losses near 2,000 BTC, worth over $116 million.
Data from Newhedge.io shows Bitcoin’s hot supply – coins active in the preceding seven days – jumped from 403,101.95 BTC on July 28 to 797,407.72 BTC on Aug. 4, a 98% increase. In contrast, Bitcoin’s price slipped only about 0.5% from $64,000 to the low $63,000 range, then recovered above $64,000. This disconnect suggests the added activity stemmed from theft sweeps, defensive wallet migrations, and holders preparing coins for potential sale rather than enthusiastic buying.
Timechainindex.com reported that exchanges received a net inflow of 22,052 BTC since the hack on July 30. Holders may be using exchanges as temporary safe havens while replacing vulnerable wallets, though large exchange inflows can also increase selling pressure.
Dormant wallet movements added to the activity. Onchain data from Btcparser.com shows 39 previously inactive addresses moved a combined 1,486 BTC between July 30 and Aug. 5, including one address from 2010 transferring 50 BTC and five 2013 addresses moving 620 BTC. While not all dormant transfers can be tied to the exploit, the timing reinforces the pattern of repositioning.
Blockchair data indicates sustained network use, with daily transactions averaging 662,577 over the two weeks ending Aug. 4, and 11 of 14 days above 600,000. July 26 was the busiest day with 758,094 transactions.
Coinkite released emergency firmware updates and urged exposed users to move funds to new wallets, as updating the device cannot repair seeds generated with weak randomness. The next developments will depend on whether stolen bitcoin sweeps continue, exchange inflows reverse, and whether the jump in active supply breaks Bitcoin out of its tight price range.