K33 Research says 890,000 BTC moved onchain after Coldcard wallet exploit

K33 Research found nearly 890,000 BTC moved onchain over the past seven days, the highest seven-day active supply recorded in 2026. Head of Research Vetle Lunde said the surge was ‘very likely driven by the Coldcard attacks,’ the hardware wallet exploit that has prompted a wave of emergency fund transfers since last week.

While Bitcoin has remained locked in one of its tightest trading ranges in years, blockchain data paints a far more active picture beneath the surface.

According to K33 Research, nearly 890,000 BTC moved onchain during the past seven days, marking the highest seven-day active supply recorded this year.

Head of Research Vetle Lunde said the unusual surge was “very likely driven by the Coldcard attacks,” noting that growing concerns have spread beyond Coldcard users to owners of other hardware wallets, including Ledger and Trezor.

Bitcoin onchain activity climbs as Coldcard exploit expands

The spike in Bitcoin onchain activity comes as investigators continue uncovering the scale of the Coldcard exploit.

According to Galaxy Research, at least 15 separate attackers have exploited the firmware vulnerability. The firm’s latest confirmed estimate shows approximately 1,596 BTC stolen from roughly 7,300 wallet addresses across three verified attack waves.

If a suspected fourth wave is confirmed, total losses could climb to 2,055 BTC, valued at roughly $130 million.

Despite the theft, Galaxy Research noted that nearly 90% of the stolen Bitcoin has remained unmoved, giving blockchain investigators, cryptocurrency exchanges, blockchain analytics firms, and U.S. law enforcement additional time to monitor suspicious wallets and coordinate potential responses.

Bitcoin onchain activity reflects changing custody preferences

The surge in Bitcoin onchain activity has also revealed a dramatic shift in how investors think about securing digital assets.

Speaking to crypto.news, OKX Chief Compliance Officer Jonathan Brockmeier said the exchange has experienced record inflows following the Coldcard incident.

“We’re seeing record levels of inflows now to centralized exchanges post-Coldcard. It’s interesting—it’s sort of the flip side of FTX. FTX happens, and everybody moves their money into self-custody, and it’s coming back now.”

Brockmeier explained that many investors now value the dedicated security teams and continuous monitoring offered by regulated exchanges, although he emphasized that self-custody remains appropriate for users comfortable managing their own operational security.

Bitcoin onchain activity has historically signaled market turning points

Beyond the immediate security concerns, Bitcoin onchain activity is attracting attention because of its historical relationship with major market reversals.

K33 Research found that periods where seven-day active supply entered the top 10% of its rolling 365-day history frequently coincided with local tops and bottoms during the 2022 bear market, the 2024 and 2025 bull markets, and the 2026 market downturn.

“The intuition behind this observation is clear: panic is visible onchain,” Lunde wrote.

According to the report, declining markets often push investors to transfer coins onto exchanges to reduce exposure, while strong rallies encourage both profit-taking and fear-of-missing-out purchases. However, K33 cautioned that elevated Bitcoin onchain activity alone should not be viewed as a standalone predictive indicator.

Coldcard firmware bug exposed critical seed generation weakness

The security incident originated from a firmware flaw disclosed by Coinkite, the manufacturer of Coldcard wallets.

The company revealed that affected devices mistakenly generated wallet recovery seeds using a deterministic pseudo-random number generator instead of the intended hardware-based true random number generator. The vulnerability was introduced during firmware development in March 2021 while integrating a new cryptographic library.

Independent analysis by Block’s Bitcoin Engineering and Security Team reached the same conclusion, confirming that vulnerable wallets relied on MicroPython’s deterministic generator during wallet creation.

Coinkite estimates older Mk2 and Mk3 devices may have provided only 40 bits of effective entropy, while Mk4, Mk5, and Coldcard Q models generated roughly 72 bits—well below the intended 128-bit security standard.

Emergency firmware updates have now been released across all affected models. However, Coinkite warned that installing updated firmware protects only newly created wallets.

Users whose seed phrases were generated using vulnerable firmware have been instructed to create entirely new wallets and transfer funds after verifying destination addresses with test transactions.

Industry leaders call for stronger hardware wallet verification

The Coldcard exploit has intensified industry debate over firmware verification standards.

Kraken Chief Security Officer Nick Percoco argued on X that hardware wallet manufacturers should adopt independent validation processes similar to NIST SP 800-90B and Germany’s BSI AIS-31 standards to ensure secure random-number generation before firmware reaches customers.

Meanwhile, Ripple CTO Emeritus David Schwartz described the breach as a reminder that even self-custody carries technological risks.

Schwartz compared the incident to the collapse of MF Global, arguing that while self-custody removes dependence on financial intermediaries, users still rely heavily on secure hardware and correctly functioning firmware.

Unlike customers of regulated financial institutions, affected wallet owners currently have no comparable recovery mechanism once compromised seed phrases are exploited.

As the investigation continues, analysts believe Bitcoin onchain activity will remain one of the most closely watched indicators in the crypto market.

Whether the current surge proves to be a temporary response to the Coldcard exploit or the beginning of a broader market shift, the unprecedented rise in Bitcoin onchain activity has become a key signal investors cannot afford to ignore.