Coldcard hack drives BTC onchain activity surge

TLDR

A serious Coldcard hardware wallet exploit has pushed Bitcoin users to move coins frantically onchain, creating a big activity spike without a matching price breakout.

1. Coldcard (a Bitcoin hardware wallet) suffered a firmware flaw that let attackers drain roughly 1,600 to 2,055 BTC from thousands of addresses.
2. The incident doubled Bitcoins seven day hot supply and drove about 890,000 BTC to move onchain, with mempool and small transactions spiking.
3. The surge reflects panic-driven custody changes and may mark a market turning point, so watching active supply, exchange inflows and further sweeps is critical.

Deep Dive

1. Exploit Mechanics And Scale

Reports show a flaw introduced in March 2021 firmware caused some Coldcard devices to generate wallet seeds with too little randomness, letting attackers reconstruct private keys without touching the device or seed phrase. Researchers at Galaxy estimate about 1,596 BTC have been confirmed stolen, with candidate losses up to roughly 2,055 BTC, affecting around 7,300 addresses and totaling about 130 million dollars in value, according to multiple analyses such as Damage from Coldcard hack reaches 130 million dollars.

The attacks came in several coordinated waves starting July 30, targeting single signature setups. Coinkite has shipped emergency firmware updates, but they only protect newly generated seeds, so vulnerable users must create fresh wallets and move funds.

2. How It Drove The Onchain Surge

K33 Research reports that roughly 890,000 BTC moved over seven days, the highest seven day active supply of 2026, with active supply almost doubling from about 403,000 BTC to nearly 797,000 BTC according to Coldcard crisis doubles Bitcoins hot supply. That hot supply measures coins that moved recently, so a 98 percent jump is a clear sign of unusual stress.

Onchain data also show elevated daily transaction counts, a packed mempool and a spike in sub 1 BTC transfers that analytics firms compare to levels seen right after the FTX collapse. Despite this, price has stayed in an unusually tight 30 day range, suggesting the spike is more about defensive repositioning than speculative mania.

3. Custody Shifts And What To Watch

The exploit is pushing holders away from weak setups and into safer or more convenient custody. Exchange reserves rose by tens of thousands of BTC, with Binance and other venues seeing net inflows, as highlighted in Coldcard hardware wallet exploit triggered unprecedented bitcoin movement. Some users are upgrading to multisignature wallets, while others are considering spot Bitcoin ETFs and institutional custody, a trend analysts discuss in Coldcard exploit could boost demand for regulated bitcoin exposure.

At the same time, most stolen BTC remains parked in attacker addresses, with only limited mixing via tools like Wasabi and Tornado Cash so far. Investigators and exchanges are monitoring those wallets, and victims are even sending OP_RETURN messages onchain to plead for funds. The key near term risks are additional sweep waves, larger laundering attempts, and any policy changes from exchanges or hardware vendors.

Conclusion

The Coldcard hack shows that self custody risk is not just about user mistakes but also about hidden hardware and firmware flaws. It has ignited one of the biggest bursts of Bitcoin onchain activity in years, driven by panic migrations and defensive moves rather than pure speculation. Whether this episode marks a major market turning point will depend on how exchange inflows, active supply and the fate of the stolen coins evolve in the coming weeks.