Coldcard Hack Pushes 39,600 BTC Into Moves as Bitcoin Wallets Hit a 2026 High

Coldcard fallout drove a major move in Bitcoin flows before price reacted

The signal here is in the transfers, not the headline. 39,600 BTC in sub-1 BTC transfers moved in a day - roughly $2.5 billion - at a level last seen near the FTX collapse. That kind of activity matters because market plumbing often moves before price does.

This still looks more like a custody scramble than confirmed sell pressure

The bullish interpretation is straightforward: users may be moving coins for safety, not dumping them on the market. Bitcoin was only down 0.7% from $62,724 as the flow spike hit, which argues against an obvious forced liquidation. But the bearish counterpoint is real too. Some of the activity did drift toward liquidity, with exchange deposits from sub-10 BTC transfers reaching 7,300 BTC, the highest level since early February. That is not proof of sell pressure yet. It is a custody scramble that could turn into it.

The attack footprint is smaller than the transfer spike

The known theft footprint is still modest in macro terms: about 1,816 BTC across more than 5,200 addresses across four waves of thefts. Those losses should not be conflated with the full 39,600 BTC flow spike. The more important tell is behavior. Daily active addresses rose from 645,000 to almost a million, and the jump was concentrated in sending addresses rather than receiving ones. That looks more like owners reacting to a threat than a coordinated liquidation.

If this remains a precautionary relocation, the flow may fade quickly. If exchange-bound activity keeps building while price fails to absorb it, the market will need buyers fast.

Why the Coldcard flaw matters more than a routine security alert

The key issue is the mechanism. A Coldcard flaw turned a device marketed for offline security into a catalyst for mass relocations, which can affect market plumbing before it affects price.

A weak-seed bug forces migration, not just an update

The problem is structural, not episodic. A March 2021 firmware build error caused seed generation to fall back on a weak software random number generator, reducing effective key strength from 128 bits to as little as 40 bits. That moves the risk from "hard to crack" to "feasible to brute force with modern compute." More important, updating firmware does not fix already-issued wallets. Owners of seeds created during that window are being told to treat them as compromised and migrate to a new seed.

That is what makes this more than a standard patch. When the flaw sits at the wallet's origin, copying the seed to a new device does not remove the problem. It moves the coins. If enough holders react at once, the transfer flow itself becomes the risk.

Custody moves can start to look like supply

This is where the flow starts to matter for traders. Over the past week, roughly 200,000 BTC moved from long-term holder wallets, which is large enough to matter for order flow even if the intent is still custody preservation. Then came the sharper indicator: 7,300 BTC in exchange deposits from sub-10 BTC transfers in a single day, the highest level since early February. That is the clearest bridge from "moving for safety" to "coins landing where they can be sold."

The bullish defense still stands: price stayed relatively stable despite the activity. But stability can break if holders keep relocating and a meaningful share of those coins drift through exchanges. In that scenario, passive demand could be tested much faster than the headline theft losses suggest.

What would keep the pressure building?

The live danger is that new attack waves raise the urgency to move again. Another sweep would not need to steal much to trigger another round of relocations, especially since researchers had already identified multiple suspected waves of suspicious activity. Flows can keep rising on fear long before they show up as a clean liquidation event.

What to watch next: whether self-custody moves turn into sell pressure

The live question is no longer whether wallets are moving. It is whether those coins stay inside self-custody or start pooling where they can be sold.

The bullish read: relocation without liquidation

If this is still a defensive shuffle, the next read should improve rather than worsen. Daily active addresses near 1 million was the highest since December 2024, but the surge was concentrated in sending addresses rather than receiving ones. That still fits relocation more than an organized liquidation wave.

The bearish read: fear turning into tradable supply

Bears do not need a dramatic hack headline. They need clearer signs that fear is turning into tradable supply:

• Exchange deposits from sub-10 BTC transfers rise again instead of fading.
• Price starts failing around the $62,724 area as exchange-bound BTC builds, showing the market is no longer absorbing pressure cleanly.
• The debate over whether users are safer outside third-party platforms pushes exposed holders toward exchange-based products instead of hardware wallets, increasing exchange-exposed float.

The signpost that matters most

For now, the market is still giving the bull case room. Bitcoin barely moved even as deposits climbed, and long-term holder wallets shifted roughly 200,000 BTC in a way that still looks more like custody migration than forced selling.

What changes the read is simple: stable or falling exchange deposits keep the self-custody scramble thesis intact, while rising exchange deposits plus price weakness around $62,724 would make the supply risk much harder to ignore.