Active Addresses Spike: Bitcoin daily active addresses surged to ~0.98 million on July 31, 2026—the highest level since December 2024. Glassnode characterized this as a "fear-driven operational response" as users scrambled to secure funds.
Coldcard Vulnerability: The activity was triggered by a firmware flaw in Coinkite’s Coldcard devices (Mk2, Mk3, Mk4, Mk5, and Q series), where seeds generated prior to recent patch updates suffered from weakened randomness (reduced entropy).
Significant Losses: Attackers began sweeping compromised single-signature addresses starting July 30. Galaxy Research confirmed at least 1,596 BTC stolen (~$100M+ value), with total losses possibly reaching over 2,055 BTC across thousands of addresses.
Exchange Inflows: Bitcoin held on centralized exchanges increased by over 22,000 BTC around the incident, indicating some users moved assets to exchanges while setting up new wallets.