Coldcard exploit doubles BTC hot wallet supply

TLDR

A major Coldcard hardware wallet exploit pushed long-dormant Bitcoin (BTC) into motion, nearly doubling BTCs hot supply in a week while the price stayed in a tight range.

1. The Coldcard firmware flaw let attackers reconstruct seeds, stealing roughly 1,6002,000 BTC and triggering about 890,000 BTC of onchain movement.
2. BTC hot supply jumped about 98 percent and exchanges saw over 22,000 BTC net inflows, raising short-term liquidity and potential sell pressure without an immediate price crash.
3. Next, the key signals are further sweep attacks, hardware wallet responses, and whether this extreme onchain activity coincides with a market turning point or a shift toward regulated custody.

Deep Dive

1. Exploit And Onchain Shock

The incident stems from a Coldcard firmware bug introduced in 2021 that generated wallet seeds with weak randomness, making some private keys guessable. Analysts estimate between about 1,600 and 2,055 BTC - roughly $100130 million - have been stolen across several attack waves so far, affecting thousands of addresses, based on research from Galaxy, TRM Labs, and media reports such as this summary of losses.

In response, owners of potentially vulnerable Coldcard wallets rushed to move funds. K33 Research and others report around 890,000 BTC moved onchain over seven days - the highest seven-day active supply in 2026 - with Newhedge.io measuring BTCs hot supply jumping from about 403,000 BTC to nearly 797,000 BTC, a 98 percent increase, according to onchain data analysis. Timechainindex data cited in the same research shows exchanges gained roughly 22,052 BTC net since the hack began.

2. Hot Supply, Flows, And Price

Hot supply refers to BTC that is actively moving or sitting in more immediately spendable environments such as exchanges and short-term custody, rather than deep cold storage. Doubling that pool in a week means far more BTC is now positioned where it can be traded or sold quickly, even if owners only intended a defensive migration.

Despite this stress, BTC price action has been muted. The onchain analyses above note that BTC stayed around 64,000 USD and moved less than 1 percent over the week, even as active supply and transaction counts hit yearly highs. That decoupling suggests the move was mostly about risk management by self-custody users rather than broad speculative selling.

3. Market Structure And What To Watch

Hardware wallet security is under intense scrutiny. Detailed technical writeups on the entropy flaw stress that other major devices like Ledger and Trezor are not directly affected, but the Coldcard bug highlights how a single implementation mistake can compromise self-custody, as explored in this industry overview.

Analysts expect some users to shift toward regulated BTC exposure and professional custody, with spot Bitcoin ETFs and custodians potentially benefiting from flows out of compromised self-custody, according to custody and ETF commentary. Meanwhile, K33 notes that similar spikes in seven-day active supply have historically occurred near local tops and bottoms, making this an important regime-change watchpoint rather than a clear directional signal.

Conclusion

The Coldcard exploit is a self-custody and hardware security shock that briefly turned a quiet BTC market into one of the most active onchain weeks in years without an immediate price breakdown. It has doubled BTCs hot supply, pushed coins onto exchanges, and raised hard questions about how keys are generated and stored. For crypto users, the key is not panic but monitoring custody choices, exchange inflows, and any break from BTCs tight trading range as the industry adapts.