A security flaw in older Coldcard firmware triggered a sharp rise in Bitcoin on-chain activity after attackers began draining vulnerable wallets on July 30. Santiment data indicates the response was predominantly a migration to new addresses rather than a broad rush to exchanges, presenting a more nuanced picture of market stress. Coldcard, manufactured by Coinkite, is a Bitcoin-only hardware wallet widely used by self-custody advocates who prioritize keeping private keys entirely offline.

Bitcoin Active Addresses Surge to 978,570 on July 31

Bitcoin active addresses reached 978,570 on July 31, according to Santiment data, approximately 1.6 times July's average and 43% above the month's previous busiest day. From August 1 through August 6, Bitcoin averaged roughly 720,000 daily addresses.

Santiment defines daily active addresses as unique addresses involved in transactions. The spike reflects unusually high Bitcoin transfer activity during the security scare rather than an indication of selling pressure. On-chain analysts routinely distinguish between address counts and transaction volume, as a single holder generating new addresses for consolidation can inflate the metric without signaling broader market activity.

Sentiment Balance Drops to -540

Santiment's sentiment balance fell to -540 on August 1, its lowest reading since February, before recovering most of the decline. The metric measures the difference between positive and negative sentiment, serving as a gauge of social pessimism.

The reaction is notable because Coldcard is designed for Bitcoin self-custody. Coinkite, the device's manufacturer, states that its hardware wallets keep private keys offline and can operate without exposing them to the internet. The incident underscores that offline storage still relies on secure firmware and key generation. Hardware wallet vulnerabilities have periodically surfaced across the industry, with researchers previously disclosing flaws in devices from multiple manufacturers, reinforcing that air-gapped designs reduce but do not fully eliminate attack surfaces.

No Matching Surge in Exchange Inflows

Despite the activity spike, exchange inflows did not show a corresponding increase. Santiment data supplied for this analysis placed average Bitcoin exchange inflows at approximately $1.55 billion from August 1 through August 6, below the roughly $1.67 billion July average. That gap weakens the case for widespread selling.

The distinction is significant because on-chain movement is not synonymous with selling. If holders moved coins into newly generated self-custody addresses, the activity represents defensive repositioning rather than an attempt to liquidate holdings. Exchange flows are therefore more informative than raw address activity for assessing market impact. This behavioral pattern aligns with trends observed since the 2022 collapse of major exchanges, after which a segment of Bitcoin holders increasingly migrated funds to self-custody solutions.

Custody Lessons and Next Signals

A key signal going forward is whether active addresses normalize as the incident recedes. A sustained increase in exchange inflows would suggest more holders are moving Bitcoin toward trading venues, while continued transfers between self-custody addresses would support the migration interpretation.

The episode highlights a broader custody lesson: self-custody reduces exchange counterparty risk but does not eliminate firmware or key-generation risks. Coinkite's current guidance includes firmware verification and update procedures, making those steps relevant for users assessing their devices or seed phrases. The event also illustrates how a single-vendor firmware issue can produce measurable on-chain effects, as affected users rush to move funds faster than attackers can exploit exposed keys.