Coldcard Exploit Sends Bitcoin Active Addresses to Highest Since 2024

Bitcoin on-chain activity climbed to its highest level since December 2024 after a firmware exploit affecting Coldcard hardware wallets triggered a wave of security-related wallet activity, according to blockchain analytics firm Glassnode.

Posting on X, the firm said that active Bitcoin addresses rose to about 980,000 a day as users transferred funds and strengthened wallet security.

“Following the Coldcard firmware exploit, the number of active Bitcoin addresses surged to 0.98M/day, the highest since December 2024,” Glassnode said. The firm added that the increase reflected “an operational security response, not a change in market conviction.”

Related: Crypto Market 2026: Why Bitcoin and Altcoins Are Still Struggling?

Security Response Drives Activity

A firmware flaw introduced in March 2021 generated weak recovery seeds on affected Coldcard devices, allowing attackers to exploit predictable keys and drain vulnerable wallets.

Security experts said updating the firmware alone does not protect wallets created with the flawed software and advised affected users to move their funds to newly generated wallets.

Losses Continue to Climb

Glassnode week 31 report linked the surge in on-chain activity to the July 31 theft of 594 Bitcoin, worth about $38 million at the time. The firm said dormant Bitcoin worth nearly 200 times the value of the stolen funds later moved across the network, suggesting many holders were transferring assets as a precaution.

Separately, Galaxy Research estimated confirmed losses exceeded 1,596 Bitcoin, valued at more than $100 million, with total losses potentially exceeding $130 million.

Related: Can Bitcoin Upgrade Without Consensus? What the BIP-110 Debate Means

(adsbygoog