Bitcoin On-Chain Activity Hits 8-Month High as Coldcard Users Race to Migrate Wallets

What Happened

Coinkite, the Canadian maker of the Coldcard hardware wallet, disclosed that seeds generated on certain firmware versions carried significantly weaker randomness than intended. On Mk2 and Mk3 devices, the flaw affects seeds created with firmware version 4.0.1 through 4.1.9 — a window stretching back to a March 2021 release. On Mk4, Mk5, and Q devices, affected seeds were generated with roughly 72 bits of entropy instead of the 128 bits the design called for, making them meaningfully easier for an attacker to guess.

Fixes are already out: version 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, and 1.5.0Q for the Q device. But installing the patch does not retroactively secure a seed that was already generated on the vulnerable software ⚠️ per Coinkite's own guidance — Coinkite said a passphrase does not repair an already-affected seed. Anyone who generated a seed on the affected firmware has been told to move their coins to a brand-new seed created on patched hardware, not simply to add a passphrase or update the firmware in place.

One exception: seeds built from at least 50 fair, independent, private dice rolls drew their entropy from the dice itself rather than the flawed firmware random-number generator, so those seeds were not weakened by the bug.

Attackers moved quickly. The first documented sweep took 594.5 BTC across 1,324 UTXOs from roughly 500 single-signature addresses, executed across four consecutive blocks on July 30. The median loss per victim in that sweep was 0.41 BTC, while the single largest loss was 29.9 BTC.

Why It Matters

The Numbers

Market Reaction

Transaction counts moved in the opposite direction from active addresses: the network processed 607,581 transactions on July 31, below the July average of 656,321, even as the address count ran 54% above its monthly average. That gap is consistent with many smaller, address-consolidation-style moves (sweeping funds to new wallets) rather than a broad increase in overall transaction volume.

Social sentiment tilted cautious. Santiment measured 0.58 bullish comments for every bearish one across social channels — the lowest positive-to-negative ratio the firm has recorded since it began tracking that metric. ⚠️ The source does not specify Santiment's tracking start date, so "lowest since tracking began" should be read as a relative, not absolute, historical claim.

Exchange balances rose by 22,135 BTC (0.83%) between July 29 and August 3 before partly reversing, easing to 2,667,058 BTC by August 5 — leaving about 12,200 of the added coins still sitting on exchanges. Bitcoin itself traded at $64,606 on August 6.

What's Next / Things to Watch

Coinkite's guidance to affected owners is unambiguous: migrate every seed generated on the vulnerable firmware to a new seed created on patched hardware (4.2.0 for Mk2/Mk3, 5.6.0 for Mk4/Mk5, 1.5.0Q for Q) — a passphrase alone does not fix an already-compromised seed. The pace of active addresses running above the July average for seven straight days through August 5 suggests migrations were still underway as of the source's publication date.

The gap between Galaxy Research's confirmed (1,596 BTC) and confirmed-plus-suspected (2,055 BTC) totals implies the final theft count could still move as more sweeps are identified or ruled out. Coin Metrics' address and exchange-balance series are the metrics to watch for signs of whether migration activity is winding down or continuing.