Key Takeaways
K33 found 890,000 BTC moved as the Coldcard exploit hit about 7,300 addresses.Newhedge.io recorded a 98% hot-supply jump while bitcoin’s price fell about 0.5%.Timechainindex.com said exchanges gained 22,052 BTC as holders await the next sweep.
Coldcard Panic Breaks Through a Quiet Market
In a recent research report called “Textbook summer doldrums,” K33 Head of Research Vetle Lunde identified onchain transfers as the glaring exception in an otherwise sleepy summer market. Trading volumes, price swings, open interest and exchange-traded fund (ETF) flows remained subdued, but roughly 890,000 BTC changed hands over seven days, the highest seven-day active supply recorded in 2026.
Active supply measures how much bitcoin has moved within a particular period, making it a useful gauge of how many coins are suddenly back in motion. Lunde explained that the acceleration was “very likely driven by the Coldcard attacks.” K33 estimated that roughly 1,596 BTC had been stolen from about 7,300 addresses when its report was prepared. The firm described the wider response as “panic visible onchain,” a fitting summary for a market where the price appears calm while wallet owners scramble behind the scenes.
In the analysis, Lunde further noted that this week’s Coldcard attack was:
The only BTC metric signaling hectic activity.
The incident traces back to a firmware flaw introduced into Coinkite’s Coldcard hardware wallets in March 2021. The flaw could generate wallet seeds, the secret phrases controlling a user’s bitcoin, with insufficient randomness. Attackers were then able to reconstruct predictable private keys offline and remotely drain single-signature addresses without physically obtaining the devices.
Beginning July 30, coordinated sweeps removed roughly 1,600 BTC worth more than $100 million from thousands of addresses. A possible fourth wave has pushed the total near 2,000 BTC. Coinkite released emergency firmware updates and urged exposed users to move their funds, but updating the device cannot repair a seed that was already generated with weak randomness. Affected holders need to create a secure new wallet and transfer the coins before an attacker reaches them.
Hot Supply Nearly Doubles Without Lifting the Price
Data gathered by Bitcoin.com News, from Newhedge.io’s onchain analytics, shows just how abruptly coins began moving. Bitcoin’s hot supply, which measures coins active during the preceding seven days, climbed from 403,101.95 BTC on July 28 to 797,407.72 BTC on Aug. 4. The increase of approximately 394,306 BTC represented a 98% jump in one week.
The price told a completely different story. Bitcoin slipped from $64K to the low $63K range over the same period, a decline of roughly 0.5%. Today, BTC is back above $64,000 and up a modest 0.5% over the last 24 hours. That disconnect suggests the added activity was not simply the result of enthusiastic buyers entering the market. It also reflected theft-related sweeps, defensive wallet migrations, internal transfers, and holders preparing coins for possible sale.
K33 noted that bitcoin was trading within its narrowest 30-day high-to-low range since 2023, with realized volatility also sitting at low levels. Yet seven-day active supply entered the top 10% of readings measured against a rolling 365-day history. Similar bursts have appeared near both local market tops and bottoms in previous cycles, meaning the signal identifies significant stress and repositioning rather than guaranteeing a direction.
Some of that repositioning appears to be heading toward centralized custodians. In a post published to X, Sani of Timechainindex.com said crypto “Exchanges received a net of 22,052 BTC since the Coldcard hack on Friday.” Holders may be using exchanges as temporary safe havens while they replace vulnerable wallets, although large exchange inflows can also increase potential selling pressure if the coins remain on trading platforms.
Bitcoin Transfers Stay Elevated Across Two Weeks
Blockchair.com daily transfer statistics reviewed by Bitcoin.com News show the network processed 9.28 million transactions during the two complete weeks from July 22 through Aug. 4, averaging approximately 662,577 transactions per day. The daily average increased from 650,417 in the first week to 674,738 in the second, a 3.7% gain.
July 26 was the busiest day within that two-week period, with 758,094 transactions, followed by July 24 with 736,287 and Aug. 1 with 734,264. Daily activity remained above 600,000 transactions on 11 of the 14 days, showing sustained network use rather than one brief burst.
The data also shows that just before this past week’s Coldcard exploit, July 19 set an all-time transaction record. It’s 898,862 transactions ranked third behind April 23, 2024, with 927,010, and Sept. 8, 2024, with 910,083. June 23, 2026, ranked fourth with 862,979, followed by July 21, 2024, with 859,629. Still, Bitcoin recording its third-busiest day less than two weeks before the Coldcard exploit shows that network activity was already running hot before emergency wallet migrations began.
Dormant Wallets Wake as Holders Reposition
Onchain Btcparser.com data, showcasing vintage bitcoin awakenings, examined by Bitcoin.com News, found that a total of 39 dormant addresses moved a combined 1,486.09044782 BTC, valued at over $95 million, from July 30 through the latest Aug. 5 entry. An old address created in 2010 moved 50 BTC in one transfer. Two 2011 addresses moved 125.00004374 BTC, and five 2013 addresses transferred 620.00100547 BTC, and five 2014 addresses moved 285.51923857 BTC.
The remaining movements included 19.0395 BTC from two addresses created in 2015, 102.19357827 BTC from 10 addresses created in 2016 and 284.33708177 BTC from 14 addresses created in 2017. The 2017 group produced the most individual transfers, but 2013 wallets accounted for the most bitcoin, largely because one address moved 500 BTC on Aug. 3. The two 2011 wallets contributed slightly more than 125 BTC, while the 2014 total narrowly exceeded the amount moved by the more active 2017 group.
Not every dormant transfer can be tied to the Coldcard firmware exploit, and the onchain data does not prove that each holder was responding to the attack. The timing, however, adds another layer to a broader pattern that includes stolen coins, emergency migrations, rising exchange balances, and a near-doubling of recently active supply. The next clues will come from whether the stolen bitcoin sweeps continue, whether exchange inflows reverse, and whether the jump in active supply finally breaks BTC out of its unusually tight price range.
