980,000 Bitcoin Addresses Moved After Coldcard Hacks - But This Wasn't Bullish

Coldcard fear, not demand, drove Bitcoin's address spike

Bitcoin's daily active addresses jumped from 645,000 on July 30 to about 980,000 on July 31, while BTC was still trading around $60,000. By contrast, the last time this many addresses moved, on December 10, 2024, bitcoin traded near $100,000 during a euphoric rally. Same metric, very different context.

The surge came amid the Coldcard breaches, not a fresh wave of buying. Reports linked the attacks to 1,367 BTC stolen from 4,585 addresses, with a suspected fourth wave has since swept over 380 BTC more. In that setup, holders were mainly moving coins out of caution. That can create a large one-day spike in activity, but it does not by itself signal a bullish breakout.

Sending addresses drove the move, which points to stress rather than accumulation

On July 31, sending addresses drove nearly all of the growth, while the growth in active receiving addresses was relatively modest. That pattern is closer to defensive relocation than to demand-led expansion.

Why the flow split matters

When new money enters the market, receiving activity usually broadens as coins move through exchanges, wallets, and downstream destinations. Here, the network looked more like many wallets pushing coins toward a narrower set of destinations. That can still become support later, but it is not the same as clear accumulation.

This was an outlier event, not a new baseline

Active addresses had mostly churned between 550,000 and 750,000 for most of 2026, so July 31 stands out as a one-off spike rather than proof of a new uptrend. Transfer data also pointed to retail-sized moves: Transfers below 1 BTC totaled 39,600 BTC on July 31, which fits a panic-driven response more than slow institutional buying.

The next read depends on whether the panic settles or keeps spreading

Galaxy Research said the attacker now targeted smaller balances. That matters because the event may not be over: smaller sweeps can keep triggering defensive transfers over the next few days.

What to watch now

• If fear fades: elevated transfer activity stops translating into continued wallet churn, and price holds the low $60,000 area, the market is probably absorbing the event.
• If stress persists: another wave of sweeps or uneven flows could keep addresses high without improving the market.

The main call remains simple. The spike was real, but the Coldcard panic, not new demand, drove it. For now, price resilience matters more than the headline number. Another useful check is whether receiving addresses also rising becomes broader. If it does, the setup improves. If not, this remains more of a risk-management story than a bullish breakout.