Bitcoin's daily active addresses surged to nearly 980,000 on July 31, representing a 50%+ increase from the previous day's 645,000 according to Glassnode data. This marked the highest reading since December 10, 2024, when bitcoin traded near $100,000 during a euphoric rally. The spike came as attackers began draining Coldcard hardware wallets through a flawed random number generator, with 1,367 BTC worth $88.6 million stolen from 4,585 addresses across three confirmed attack waves. A suspected fourth wave has since swept over 380 BTC more, bringing total losses to nearly 1.75 BTC worth $127 million. Recent data shows the momentum has continued, with 712K active BTC addresses recorded over the past week - a 3-month high that demonstrates sustained user panic. According to CoinDesk, the number of transactions sitting in Bitcoin's memory pool awaiting confirmation from miners has spiked to 89,031 on Tuesday, the most since February 2025.
The security crisis triggered immediate exchange activity, with about 10,000 net BTC flowing into exchanges the day after the exploit was reported. By on-chain transfer volume, about 200K BTC moved, representing the third most observed on-chain activity this year. As reported by CryptoQuant's Spent Output Value Bands, transfers below 1 BTC totaled 39,600 BTC on July 31, the only comparable daily reading since November 16, 2022, when FTX collapsed. These bands capture retail-sized wallets, exactly matching Coldcard's user base profile. One holder lost 18.25 BTC worth $1.6 million in under seven minutes, with thousands of users acting similarly. According to K33 Research, nearly 890,000 BTC has moved onchain over the past seven days, the highest seven-day active supply recorded this year, even as Bitcoin has continued trading within one of its tightest price ranges in recent years. The research note arrives as investigators continue expanding the scope of the Coldcard hardware wallet breach, with Galaxy Research confirming 15 different attackers have now exploited the vulnerability.
Despite the record address activity, transfer counts remained within ordinary ranges at 761,796 transfers on July 31, far below previous peaks of 1 million transfers on December 13, 2024, April 19, 2025, and May 9, 2026. According to Galaxy Research head Alex Thorn, sweep transactions ran at 13.8 per block, roughly 45 times the pre-incident baseline. The divergence between address activity and transfer counts indicates an emergency sweep rather than normal market activity, with users moving coins to fewer destinations. According to K33 Research, the pace of Bitcoin transfers has accelerated sharply, with the incident likely heightening concerns about other hardware wallets, including Ledger and Trezor, prompting some owners to consider centralized custodians or multisignature setups. According to CoinDesk, whale transactions from large holders climbed to a five-month high of 61,800, while the number of active addresses hit a three-month high of 712,000.
The fallout from the Coldcard security breach is now surfacing on-chain through significant shifts in long-term holder behavior. According to Glassnode data, roughly 210,000 BTC have moved out of long-term holder wallets over the past week, representing the largest decline since December 2024 when bitcoin approached $100,000 for the first time. Glassnode classifies long-term holders as entities whose coins have remained dormant for approximately 155 days, or just over five months, often considered the market's "smart money" because its members tend to hold through short-term volatility. Before the Coldcard incident, long-term holder supply was just under 15 million BTC, close to an all-time high, but now stands at approximately 14.7 million BTC. This movement occurs near bitcoin's current price of around $64,000, roughly 50% below its October all-time high, marking a significant departure from previous distribution waves that occurred near market peaks. The breach stemmed from weak randomness in affected Coldcard firmware, which allowed attackers to reconstruct some users' wallet recovery phrases and drain their bitcoin, with estimated losses reaching as much as $114 million.
The episode represents the first time since the FTX collapse that retail holders moved such significant amounts of BTC in a single day, with losses estimated above 2,055 BTC worth $130 million as affected users rushed to move funds, consolidate wallets, and reduce exposure. As noted by CryptoQuant Head of Research Julio Moreno, sending addresses drove nearly all growth while receiving addresses barely moved, suggesting consolidation rather than new demand. Near-term volatility risk remains elevated as fear can pressure retail selling, but sustained whale accumulation and security-driven coin migration can also tighten liquid supply over the coming months if stronger holders keep absorbing the panic. According to K33 Research, similar bursts of onchain activity have repeatedly appeared around major market reversals, with periods when seven-day active supply entered the top 10% of observations compared with its rolling 365-day history aligning with local tops and bottoms during the 2022 bear market, 2024 bull markets, and 2026 bear market. The reversal feeds the self-custody debate that Binance founder Changpeng Zhao reignited this week, with analysts continuing to point to the fate of the Clarity Act as the immediate catalyst. ETF flows offer some support, with U.S. spot bitcoin ETFs attracting approximately $754 million over the past week, with BlackRock's iShares Bitcoin Trust accounting for most of those inflows.
