Bitcoin Activity Explodes As Coldcard Fears Shake Holders

Network Metrics Hit Multi-Month Highs

Bitcoin network activity surged sharply in the seven days ending August 4, according to on-chain analytics firm Santiment. Active $BTC addresses climbed to 712,000, a three-month high, while whale transactions above $100,000 reached 61,800, a five-month high. Santiment pointed directly to the unfolding Coldcard crisis as the driving force behind both metrics.

Reports tie the late-July sweeps to weak Coldcard-generated keys, with losses estimated above 2,055 $BTC and $130 million, as affected users rushed to move funds, consolidate wallets, and reduce exposure.

What Went Wrong With Coldcard

The vulnerability was introduced in Coldcard firmware 4.0.0 in March 2021, causing devices to skip their hardware randomness generator and fall back to predictable software-based key generation seeded by non-secret chip data.The flaw, which affected firmware versions 4.0.1 through 4.1.9, caused the wallets to generate recovery seeds with approximately 40 bits of entropy instead of the intended 128 bits. In practical terms, that made private keys reproducible offline without any physical access to the device.

The attack began on July 30, 2026, when an unknown attacker started draining Bitcoin from Coldcard hardware wallets. During the first wave, 594 BTC, worth approximately $38 million, vanished from around 500 wallets in just 25 minutes.Three distinct waves of attacks ultimately swept 1,367 bitcoin, nearly $89 million at recent prices, from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.

A firmware update fixes the seed-generation process going forward, but it does not rewrite the words that already control a user's Bitcoin. If the device used weak randomness when it generated the seed, updating the firmware later does not make the old key stronger.Users must update the device, generate a completely new seed on the patched firmware, and transfer all Bitcoin from the old addresses to addresses derived from the new seed.

The episode has reignited broader questions about self-custody risk. According to blockchain security firm Blockaid, most losses in the first half of 2026 came not from smart contract hacks but from compromised keys and operational security failures.Over the coming weeks, fear could pressure retail selling, but sustained whale accumulation and security-driven coin migration may also tighten liquid supply if stronger holders keep absorbing the panic.

Sources:Santiment: Bitcoin Active Addresses and Whale Transactions Surge on Coldcard FUDCoinDesk: Bitcoin Cold-Wallet Attack Spreads to 4,500 AddressesCoinDesk: Major Bitcoin Wallet Flaw Drains 594 BTC in 25-Minute Sweep