Bitcoin’s seven-day active supply has climbed to its highest level of 2026 after roughly 890,000 BTC moved during the past week, according to K33 Research, which linked the unusual onchain activity to the expanding Coldcard security incident and the movement of funds from affected wallets.
The spike arrived during one of Bitcoin’s quietest trading stretches in years. K33 said Bitcoin’s 30-day high-to-low range was its narrowest since 2023, while realized volatility fell below that of the Nasdaq 100. The contrast between subdued price action and a sharp increase in coin movement places attention on the source of the transfers rather than on routine market speculation.
Galaxy Research said on Tuesday that reports indicate at least 15 separate attackers have exploited the vulnerability. Estimates of the losses have risen as additional victims have come forward, suggesting that the incident has developed beyond an isolated wallet compromise into a broader effort to identify and drain vulnerable addresses.
Loss estimates rise as victims report thefts
Galaxy Research initially estimated Coldcard-related losses at more than $100 million before lifting its estimate to about $130 million, equivalent to roughly 2,000 BTC. That figure includes suspected thefts that have not been fully confirmed.
K33’s estimate is more conservative: the firm said approximately 1,596 BTC had been stolen from around 7,300 addresses. The gap between the estimates reflects the difficulty of separating confirmed thefts from addresses that may be linked to the exploit but have not yet been conclusively attributed to attackers.
The reported vulnerability involves weak entropy in the generation of private keys. Entropy refers to the randomness used to create a secret cryptographic key; insufficient randomness can make keys far easier to guess or reproduce than they should be. The source material says affected devices generated private keys with only 40 bits of randomness, well below the level generally expected for wallet recovery phrases.
As owners move funds away from potentially affected wallets, the blockchain can record a large number of transactions without showing a corresponding surge in exchange selling. A transfer from an old address to a newly generated wallet, for example, increases active supply metrics even when the holder has no intention of selling Bitcoin.
That distinction is central to interpreting the current activity. The elevated number of moved coins may reflect urgent security measures, thefts, consolidation by attackers, or a combination of all three. It does not, by itself, establish that a comparable volume of Bitcoin is heading to trading venues.
An unusual signal during a quiet market
K33’s seven-day active supply metric measures the amount of Bitcoin that has moved at least once in the preceding week. The firm said readings in the top 10% of the metric’s rolling 365-day history have previously appeared near local market turning points.
According to K33, those elevated readings coincided with local tops and bottoms during the 2022 bear market, the 2024 and 2025 bull markets, and the 2026 bear market. Two of the largest active-supply spikes this year also occurred during Bitcoin selloffs in February and June.
The historical relationship does not make active supply a standalone price signal. Coins become active for many reasons, including exchange transfers, internal wallet reorganizations, long-term holders shifting custody, institutional settlements, and security incidents. Yet the Coldcard episode gives the latest spike a more specific explanation than many previous bursts of activity.
K33 contrasted the current movement with an increase in late April, which it attributed to routine transfers and address rotations rather than exchange-related flows. That comparison suggests analysts should examine the destination of the coins and the behavior of receiving addresses before treating the current activity as a broad change in market positioning.
A sustained flow of stolen coins toward known exchange deposit addresses could create short-term selling pressure if attackers seek to convert the assets. Conversely, transfers into new self-custody wallets, multisignature arrangements, or addresses associated with recovery efforts would point more strongly toward users securing their funds.
Wallet holders face a security-focused response
The incident has also created an opening for secondary scams. Wallet owners seeking urgent technical help can be targeted through fake firmware updates, fraudulent recovery tools, and messages requesting seed phrases or private keys. Hardware-wallet providers and legitimate support teams do not need a customer’s recovery phrase to diagnose an issue.
Users who believe their wallet may be affected should verify notices through the manufacturer’s official website and authenticated support channels, rather than links received through email, direct messages, or social media. Moving funds requires care: a rushed transfer to an improperly verified address can compound an existing loss.
For larger balances, transferring coins to a newly generated wallet on verified hardware or using multisignature custody can reduce dependence on a single device or key. Multisignature setups require approval from more than one private key before funds can move, limiting the damage if one key is compromised.
The immediate market question is whether the 890,000 BTC in recent activity proves temporary security-driven churn or develops into a persistent rise in exchange-bound supply. K33’s data shows that Bitcoin’s network activity has broken sharply away from its otherwise muted market behavior, while Galaxy’s rising loss estimates indicate the underlying incident may still be unfolding.
Worried about wallet exploits? Learn how to improve your crypto safety and protect BTC from security breaches now.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
