The spike coincided with the Coldcard security crisis, which
may have contributed to increased wallet creation, fund transfers and changes
in custody behavior.
What Happened: The Coldcard Exploit
The drama began on July 30, when attackers began draining
bitcoin from thousands of Coldcard hardware wallets. The incident was linked to
a firmware flaw introduced in a March 2021 update that quietly weakened the
randomness used to generate seed phrases.
Instead of drawing from a robust source of entropy, the flaw
redirected seed generation to a software-based pseudorandom number generator.
Translation: the "random" numbers weren't random enough, making it
mathematically feasible for attackers to reconstruct private keys without ever
touching the physical device.
The reported losses were significant:
- Galaxy
Research estimated confirmed losses at approximately 1,596
BTC across three attack waves, with a suspected fourth wave that
could bring the total to roughly 2,055 BTC (over $130
million)
- TRM
Labs identified multiple attack waves, with the first wave
sweeping roughly 594 BTC (about $38 million) in roughly
25 minutes
- The
vulnerability affected multiple Coldcard models running vulnerable
firmware versions, with Mk3 devices dropping to as little as 40
bits of effective entropy — low enough to brute force
Important context: The vulnerability was
initially traced to older Mk2/Mk3 firmware versions, while subsequent
investigation identified broader exposure across newer models and prompted
emergency firmware updates. Coinkite has since released patched firmware
versions for affected devices.
The On-Chain Response: A Defensive Shuffle
When a security scare hits the hardware wallet market,
Bitcoin users don't sit around waiting for a patch. They move their coins — and
fast.
The 2.27 million new addresses created in a
single week represent a concentrated burst, not a gradual trend. This spike in
address creation came alongside the strongest network activity recorded in 10
months.
Santiment said the security crisis likely contributed to
increased wallet creation, fund transfers, and changes in custody behavior.
The data reflects a specific pattern: when users suspect
their custody setup is compromised, the standard playbook is to generate a
fresh wallet, sweep funds to the new address, and figure out the rest later. Do
that across a large portion of the self-custody community simultaneously, and
the on-chain footprint can show a sharp increase in address creation and
transaction activity.
210,000 BTC on the Move: Long-Term Holders React
The fallout is also visible in the behavior of long-term
holders. According to Glassnode data, roughly 210,000 BTC have
moved out of long-term holder wallets over the past week — the largest weekly
decline since December 2024.
Long-term holder supply now stands at approximately 14.7
million BTC, down from just under 15 million BTC before the Coldcard
incident.
Crucially, analysts say this isn't necessarily panic
selling.
Historically, sharp declines in long-term holder holdings
have often appeared during strong market rallies or around major market tops —
when experienced holders take profits into rising demand.
However, the on-chain data alone cannot establish that the
Coldcard incident caused these movements.
Bitcoin was trading near $64,000 at the time of the
analysis, roughly 50% below its October 2025 all-time high.
"The recent movement may therefore have a different
explanation from traditional long-term holder profit-taking."
— Glassnode analysis
The movement may reflect custody migration rather than
outright selling, although the on-chain data alone cannot conclusively
determine the reason for every transfer. Some holders are transferring bitcoin
from older wallets into newly generated addresses with stronger custody
arrangements. Others may be moving their assets to regulated custodians or spot
bitcoin ETFs.
Self-Custody Under Pressure: What Happens Next?
The Coldcard exploit has revived a debate that never really
went away: Is self-custody worth the risk?
Cantor Fitzgerald analysts said the incident
could drive Coldcard users toward managed custody providers, potentially
benefiting firms like Coinbase, Robinhood, and BitGo through increased customer
inflows. "The read-through is second-order but we would expect that token
flows to custodians and exchanges will increase following the hack," said
Nico Pasquariello, a digital asset specialist at Cantor.
FRNT Financial echoed that view, noting that the
exploit exposed a key tradeoff in self-custody. For investors unwilling to
accept the operational risks of managing private keys, the growing availability
of spot bitcoin ETFs provides an increasingly attractive alternative.
But not everyone is abandoning self-custody.
Cory Klippsten, CEO of Swan Bitcoin, said clients are
not retreating from self-custody — they're upgrading it. "People are
moving into Swan Vault right now," he said, referring to the firm's
collaborative multisig product, where no single device can put a user's funds
at risk. "Instead of abandoning self-custody, many are upgrading it."
Klippsten's verdict on the week: measured optimism.
"It is awful that people lost coins, and they did
everything right according to what a lot of well-known people in the industry
told them. But Bitcoin is antifragile and the tools are getting stronger by the
hour. This might end up being the best thing that ever happened to
self-custody."
— Cory Klippsten, CEO of Swan Bitcoin
Bitcoin ETFs See Strong Inflows
U.S. spot Bitcoin ETFs recorded approximately $754
million in net inflows over the past week, with BlackRock's iShares
Bitcoin Trust (IBIT) accounting for the majority of those inflows.
The ETF flows provide context for the possibility that some
investors are reconsidering self-custody, although the available data does not
establish that Coldcard users were directly responsible for these inflows. Some
of the decline in long-term holder supply could reflect users moving their
assets to regulated custodians or spot bitcoin ETFs as they weigh the risks of
self-custody.
Coldcard's Response
Coinkite, the maker of Coldcard, has been transparent about
the scope of the incident. The company destroyed all remaining inventory of
devices manufactured with vulnerable firmware and halted shipments when the
vulnerability was confirmed.
CEO Rodolfo Novak issued a public apology:
"I'm sorry and I'm devastated. Our team is
heartbroken."
— Rodolfo Novak, CEO of Coinkite
The company has been actively contacting customers to assist
with transferring still-secure funds and providing recovery guidance. Coinkite
confirmed that new mnemonics are secure following a firmware update, but older
ones remain at risk. Users are advised to generate entirely new seeds on
patched firmware and move all funds to wallets derived from those new seeds.
Important: Updating firmware alone does not fix
already-generated seeds. Only seeds generated on vulnerable firmware versions
are at risk — imported seeds and those created with sufficient independent
randomness are not affected.
What This Means for Bitcoin Prices
Santiment analysts are cautiously optimistic. The firm noted
that when retail investors are shaken and trading volume surges, large Bitcoin
holders often use the turmoil to accumulate more aggressively.
"Both fear and greed drive users to trade and
rebalance positions, which can revive previously subdued demand."
— Santiment Intelligence
Santiment said similar combinations of rising network
activity and accumulation have historically coincided with stronger Bitcoin
demand, although past patterns do not guarantee future price performance.
The Bottom Line
The Coldcard chaos delivered a stress test to the Bitcoin
ecosystem — and the network responded with record address creation and historic
on-chain activity.
The key takeaways:
- 2.27
million new addresses created in a single week — a 12-month high
- 751,000
active addresses — the highest in 10 months
- 210,000
BTC moved from long-term holder wallets — likely custody
migration, but on-chain data alone can't confirm every transfer
- $754
million in ETF inflows as some holders pivot to regulated custody
The incident may accelerate adoption of stronger
self-custody practices, including multisignature setups and improved
wallet-security procedures.
CoinaiNews provides independent market analysis and
coverage of cryptocurrency, technology, and financial markets. The information
presented does not constitute financial advice.
0 Comments