Bitcoin active addresses hit highest level since December 2024 after Coldcard exploit: Glassnode
Meanwhile, US spot Bitcoin ETFs have attracted $620 million in inflows since the incident.
Active Bitcoin addresses rose to around 980,000 daily after the Coldcard firmware exploit, marking the highest reading since December 2024, according to Glassnode. The increase was fueled by users transferring funds and migrating seed phrases following the security incident.
Following the Coldcard firmware exploit, the number of active Bitcoin addresses surged to 0.98M/day, the highest since December 2024.
This is fear-driven on-chain activity. Holders migrating seeds and moving funds to alternative custody reflects an operational security response,… pic.twitter.com/BoKql7UpDH
— glassnode (@glassnode) August 6, 2026
Hackers have stolen an estimated $130 million in Bitcoin by exploiting a flaw in older Coldcard hardware wallets that allowed attackers to predict users’ seed phrases, according to Galaxy Research and blockchain analytics firm Elliptic.
Security researchers believe multiple hacker groups are taking advantage of predictable seed phrase generation in affected devices.
Researchers at Block found the vulnerability to be related to the way certain Coldcard devices generate recovery seed phrases.
Rather than breaking into offline wallets directly, attackers were able to brute-force predictable seed phrases and gain access to victims’ Bitcoin. Coinkite has urged affected users to update their devices and migrate funds to newly generated seed phrases.
The elevated network activity is viewed as security-driven rather than market-driven. According to Glassnode, instead of reflecting stronger demand or higher adoption, the increase suggests Bitcoin holders were responding to the exploit by moving assets to safer custody arrangements.
Meanwhile, US-listed spot Bitcoin ETFs have taken in $620 million since the Coldcard wallet exploit, with inflows recorded every day and increasing as the week progressed, Farside Investors data shows.
According to Bloomberg ETF analyst Eric Balchunas, there is no evidence directly connecting the two events but some investors could ultimately choose ETF custody over self-custody following the hack.
$IBIT, $FBTC, $BITC, $ARKB, $MSBT have all seen inflows every single day (and growing each day) since the Coldcard Hack this wknd for a total of $620m. I'm not saying it's connected, we just don't know, altho long-term I can't imagine there aren't some who migrate over, but it's… pic.twitter.com/Y63ZUKsVJD
— Eric Balchunas (@EricBalchunas) August 6, 2026