Coldcard Exploit Triggers Massive BTC Shuffle, Nearly Doubling "Hot Supply" in a Week

Bitcoin's market price has barely budged, but onchain activity has surged after an exploit tied to Coinkite's Coldcard hardware wallet set off what analysts describe as visible panic on the blockchain. K33 said about 890,000 BTC moved over a seven-day window as the Coldcard incident affected roughly 7,300 addresses. The firm estimated around 1,596 BTC had been stolen at the time of publication. Newhedge.io data shows a sharp expansion in "hot supply"—coins active in the prior seven days—while Timechainindex.com reported notable net inflows to exchanges. K33 Head of Research Vetle Lunde flagged the transfers as the standout development in an otherwise subdued summer market. Trading volumes, price volatility, open interest and ETF flows have stayed muted, yet seven-day active supply hit the highest level recorded in 2026. Lunde said the jump was "very likely driven by the Coldcard attacks." The issue traces to a firmware flaw introduced in March 2021 that could generate wallet seeds with insufficient randomness. That weakness made some private keys more predictable, enabling attackers to reconstruct keys offline and drain single-signature addresses without needing physical access to the device. Starting July 30, coordinated sweeps removed roughly 1,600 BTC—worth more than $100 million—from thousands of addresses. A possible fourth wave has lifted the total close to 2,000 BTC. Coinkite issued emergency firmware updates and urged potentially exposed users to move funds. Still, updating the device cannot fix a seed that was already created with weak randomness. Users believed to be affected must generate a new, secure wallet and transfer assets before attackers reach them. Onchain data compiled by Bitcoin.com News from Newhedge.io illustrates how abruptly activity accelerated. Bitcoin's hot supply rose from 403,101.95 BTC on July 28 to 797,407.72 BTC on Aug. 4, an increase of about 394,306 BTC, or 98% in one week. Price action did not match the onchain surge. Over the same span, BTC slipped from around $64,000 into the low $63,000s, a decline of roughly 0.5%. Bitcoin has since moved back above $64,000 and is up about 0.5% over the past 24 hours. The divergence suggests the activity was not driven solely by fresh buying demand. The flow likely reflects theft-related sweeps, emergency wallet migrations, internal transfers, and holders positioning coins for potential sale. K33 noted bitcoin has traded in its tightest 30-day high-to-low range since 2023 and realized volatility remains low, even as seven-day active supply pushed into the top decile versus a rolling 365-day history. Some of the repositioning appears to be moving toward centralized venues. In a post on X, Sani of Timechainindex.com said exchanges "received a net of 22,052 BTC" since the Coldcard hack on Friday. The deposits may represent users seeking temporary custody while replacing vulnerable wallets, though sustained exchange inflows can also raise potential sell-pressure if coins remain on trading platforms. Network usage has stayed elevated across two full weeks, based on Blockchair.com transaction data reviewed by Bitcoin.com News. From July 22 through Aug. 4, bitcoin processed 9.28 million transactions, averaging about 662,577 per day. The daily average rose from 650,417 in the first week to 674,738 in the second, a 3.7% increase. Within that two-week period, July 26 was the busiest day with 758,094 transactions, followed by July 24 with 736,287 and Aug. 1 with 734,264. Daily volume topped 600,000 transactions on 11 of the 14 days. The data also shows activity was already unusually strong before the Coldcard incident. On July 19, bitcoin posted 898,862 transactions, ranking third all-time behind April 23, 2024 (927,010) and Sept. 8, 2024 (910,083). June 23, 2026 ranks fourth with 862,979, followed by July 21, 2024 with 859,629. Separately, Btcparser.com data tracking long-dormant wallets found 39 inactive addresses moved a combined 1,486.09044782 BTC—worth more than $95 million—from July 30 through the latest Aug. 5 entry. A 2010-era address moved 50 BTC in one transfer. Two 2011 addresses moved 125.00004374 BTC. Five 2013 addresses transferred 620.00100547 BTC, and five 2014 addresses moved 285.51923857 BTC. Additional transfers included 19.0395 BTC from two 2015 addresses, 102.19357827 BTC from 10 addresses created in 2016, and 284.33708177 BTC from 14 addresses created in 2017. The 2017 set produced the most individual transfers, while 2013 wallets accounted for the largest BTC total, largely due to a single 500 BTC move on Aug. 3. The timing does not prove the dormant movements were caused by the Coldcard exploit, but it adds to a broader pattern that includes theft-related sweeps, defensive migrations, rising exchange balances and a near-doubling of recently active supply. Market focus now turns to whether additional sweep activity emerges, whether exchange inflows reverse, and whether the spike in active supply ultimately breaks bitcoin out of its unusually tight trading range.