Onchain Data: Coldcard Crisis Doubles Bitcoin’s Hot Supply in Just One Week

2 days ago

The Coldcard exploit has unleashed a question of bitcoin movement, sending dormant coins into exchanges, multi-signature wallets, and caller addresses portion the marketplace terms hardly reacts.

Key Takeaways

  • K33 recovered 890,000 BTC moved arsenic the Coldcard exploit deed astir 7,300 addresses.
  • Newhedge.io recorded a 98% hot-supply leap portion bitcoin’s terms fell astir 0.5%.
  • Timechainindex.com said exchanges gained 22,052 BTC arsenic holders await the adjacent sweep.

Coldcard Panic Breaks Through a Quiet Market

In a caller probe study called “Textbook summertime doldrums,” K33 Head of Research Vetle Lunde identified onchain transfers arsenic the glaring objection successful an different sleepy summertime market. Trading volumes, terms swings, unfastened involvement and exchange-traded money (ETF) flows remained subdued, but astir 890,000 BTC changed hands implicit 7 days, the highest seven-day progressive proviso recorded successful 2026.

Active proviso measures however overmuch bitcoin has moved wrong a peculiar period, making it a utile gauge of however galore coins are abruptly backmost successful motion. Lunde explained that the acceleration was “very apt driven by the Coldcard attacks.” K33 estimated that astir 1,596 BTC had been stolen from astir 7,300 addresses erstwhile its study was prepared. The steadfast described the wider effect arsenic “panic disposable onchain,” a fitting summary for a marketplace wherever the terms appears calm portion wallet owners scramble down the scenes.

In the analysis, Lunde further noted that this week’s Coldcard onslaught was:

The lone BTC metric signaling hectic activity.

The incidental traces backmost to a firmware flaw introduced into Coinkite’s Coldcard hardware wallets successful March 2021. The flaw could make wallet seeds, the concealed phrases controlling a user’s bitcoin, with insufficient randomness. Attackers were past capable to reconstruct predictable backstage keys offline and remotely drain single-signature addresses without physically obtaining the devices.

Beginning July 30, coordinated sweeps removed astir 1,600 BTC worthy much than $100 cardinal from thousands of addresses. A imaginable fourth question has pushed the full adjacent 2,000 BTC. Coinkite released exigency firmware updates and urged exposed users to determination their funds, but updating the instrumentality cannot repair a effect that was already generated with anemic randomness. Affected holders request to make a unafraid caller wallet and transportation the coins earlier an attacker reaches them.

Hot Supply Nearly Doubles Without Lifting the Price

Data gathered by Bitcoin.com News, from Newhedge.io’s onchain analytics, shows conscionable however abruptly coins began moving. Bitcoin’s blistery supply, which measures coins progressive during the preceding 7 days, climbed from 403,101.95 BTC connected July 28 to 797,407.72 BTC connected Aug. 4. The summation of astir 394,306 BTC represented a 98% leap successful 1 week.

Newhedge.io screenshot. Bitcoin blistery proviso statistic gathered from Newhedge.io.

The terms told a wholly antithetic story. Bitcoin slipped from $64K to the debased $63K scope implicit the aforesaid period, a diminution of astir 0.5%. Today, BTC is backmost supra $64,000 and up a humble 0.5% implicit the past 24 hours. That disconnect suggests the added enactment was not simply the effect of enthusiastic buyers entering the market. It besides reflected theft-related sweeps, antiaircraft wallet migrations, interior transfers, and holders preparing coins for imaginable sale.

K33 noted that bitcoin was trading wrong its narrowest 30-day high-to-low scope since 2023, with realized volatility besides sitting astatine debased levels. Yet seven-day progressive proviso entered the apical 10% of readings measured against a rolling 365-day history. Similar bursts person appeared adjacent some section marketplace tops and bottoms successful erstwhile cycles, meaning the awesome identifies important accent and repositioning alternatively than guaranteeing a direction.

Some of that repositioning appears to beryllium heading toward centralized custodians. In a station published to X, Sani of Timechainindex.com said crypto “Exchanges received a nett of 22,052 BTC since the Coldcard hack connected Friday.” Holders whitethorn beryllium utilizing exchanges arsenic impermanent harmless havens portion they regenerate susceptible wallets, though ample speech inflows tin besides summation imaginable selling unit if the coins stay connected trading platforms.

Bitcoin Transfers Stay Elevated Across Two Weeks

Blockchair.com regular transportation statistics reviewed by Bitcoin.com News amusement the web processed 9.28 cardinal transactions during the 2 implicit weeks from July 22 done Aug. 4, averaging astir 662,577 transactions per day. The regular mean accrued from 650,417 successful the archetypal week to 674,738 successful the second, a 3.7% gain.

Blockchair.com screenshot. Bitcoin regular transfers via blockchair.com.

July 26 was the busiest time wrong that two-week period, with 758,094 transactions, followed by July 24 with 736,287 and Aug. 1 with 734,264. Daily enactment remained supra 600,000 transactions connected 11 of the 14 days, showing sustained web usage alternatively than 1 little burst.

blockchair.com screenshotBitcoin’s apical 5 regular transportation days, according to blockchair.com.

The information besides shows that conscionable earlier this past week’s Coldcard exploit, July 19 acceptable an all-time transaction record. It’s 898,862 transactions ranked 3rd down April 23, 2024, with 927,010, and Sept. 8, 2024, with 910,083. June 23, 2026, ranked 4th with 862,979, followed by July 21, 2024, with 859,629. Still, Bitcoin signaling its third-busiest time little than 2 weeks earlier the Coldcard exploit shows that web enactment was already moving blistery earlier exigency wallet migrations began.

Dormant Wallets Wake arsenic Holders Reposition

Onchain Btcparser.com data, showcasing vintage bitcoin awakenings, examined by Bitcoin.com News, recovered that a full of 39 dormant addresses moved a combined 1,486.09044782 BTC, valued astatine implicit $95 million, from July 30 done the latest Aug. 5 entry. An aged code created successful 2010 moved 50 BTC successful 1 transfer. Two 2011 addresses moved 125.00004374 BTC, and 5 2013 addresses transferred 620.00100547 BTC, and 5 2014 addresses moved 285.51923857 BTC.

The remaining movements included 19.0395 BTC from 2 addresses created successful 2015, 102.19357827 BTC from 10 addresses created successful 2016 and 284.33708177 BTC from 14 addresses created successful 2017. The 2017 radical produced the astir idiosyncratic transfers, but 2013 wallets accounted for the astir bitcoin, mostly due to the fact that one code moved 500 BTC connected Aug. 3. The 2 2011 wallets contributed somewhat much than 125 BTC, portion the 2014 full narrowly exceeded the magnitude moved by the much progressive 2017 group.

Not each dormant transportation tin beryllium tied to the Coldcard firmware exploit, and the onchain information does not beryllium that each holder was responding to the attack. The timing, however, adds different furniture to a broader signifier that includes stolen coins, exigency migrations, rising speech balances, and a near-doubling of precocious progressive supply. The adjacent clues volition travel from whether the stolen bitcoin sweeps continue, whether speech inflows reverse, and whether the leap successful progressive proviso yet breaks BTC retired of its unusually choky terms range.

View source