Coldcard exploit drives BTC onchain record

TLDR

A Coldcard hardware wallet exploit has driven a record spike in Bitcoin (BTC) onchain activity as users scramble to secure funds, while BTCs price has barely moved.

1. Researchers link nearly 890,000 BTC moving in seven days and a near doubling of hot supply directly to the Coldcard flaw, with around $100130 million in BTC stolen.
2. Despite this panic, BTC remains in an unusually tight price range, but exchange inflows and awakened dormant wallets show significant stress in how holders manage custody.
3. The next key signals are further attack waves, movement of the stolen coins, and whether this custody shock pushes more users toward regulated products and stricter wallet standards.

Deep Dive

1. Exploit And Record Flows

The Coldcard incident stems from a firmware flaw introduced in 2021 that generated wallet seeds with weak randomness, letting attackers reconstruct private keys and drain affected single-signature wallets.

K33 Research reports that nearly 890,000 BTC moved onchain over seven days, the highest seven day active supply recorded in 2026, as users relocated funds after the exploit was disclosed, with seven day hot supply almost doubling in that window. This surge came alongside estimates of around 1,5962,055 BTC stolen, worth roughly $100130 million, across about 7,300 addresses linked to the vulnerability.

Confidence: high because multiple independent research firms and media outlets converge on similar loss and activity figures.

2. Market And Custody Impact

Remarkably, BTCs price has stayed within one of its narrowest 30 day ranges since 2023, with realized volatility even below the Nasdaq 100, while onchain measures show panic visible onchain through defensive transfers and exchange inflows.

Newhedge.io data shows hot supply jumping roughly 98 percent in a week and Timechainindex reports net exchange inflows of about 22,052 BTC, suggesting many affected or worried holders are using exchanges or new setups as temporary refuges. At the same time, analysts argue the breach could boost demand for regulated BTC exposure and custodial solutions such as spot ETFs, since some users may no longer trust hardware wallet firmware alone for self custody.

3. What To Watch Next

Investigators say roughly 90 percent of the stolen BTC has not yet moved, while a smaller attacker has begun routing modest amounts through mixers, making future laundering attempts an important onchain signal.

Historically, K33 notes that spikes in seven day active supply like this often appear near local market tops or bottoms, though they do not guarantee direction. The longer term impact will hinge on whether further exploit waves emerge, how aggressively exchanges and law enforcement track flagged coins, and whether hardware wallet providers and users adopt stronger practices such as multisig and independently generated entropy.

Conclusion

The Coldcard exploit has not harmed Bitcoins protocol, but it has triggered record onchain movement as holders rush to repair a broken custody layer.

If most stolen coins remain frozen under surveillance while regular users migrate to safer setups, the incident could ultimately harden BTCs security ecosystem, even though it briefly exposed how fragile poor entropy and single point of failure wallets can be.