Coldcard's Bad RNG Sent 1M Bitcoin Wallets Running for the Exits 🏃

Bitcoin's on-chain activity spiked to its highest level in roughly 20 months on July 31, but the surge was driven by distress rather than demand, according to Glassnode and CryptoQuant data. Daily active addresses climbed from 645,000 on July 30 to approximately 980,000 on July 31, the highest reading since December 10, 2024, when BTC traded near $100,000. At press time, BTC stood at $60,347, up 1.24% over 24 hours, per BeInCrypto figures. The jump coincided with three confirmed attack waves against Coldcard hardware wallets tied to a flawed random number generator, which have drained 1,367 BTC, worth $88.6 million, from 4,585 addresses. A suspected fourth wave has swept over an additional 380 BTC.

CryptoQuant Head of Research Julio Moreno noted on X that sending addresses accounted for nearly all of the growth, while receiving addresses remained proportionally flat, indicating consolidation toward a smaller set of destinations. For most of 2026, active addresses had ranged between 550,000 and 750,000, framing the spike as a one-off event. CryptoQuant's Spent Output Value Bands show that transfers below 1 BTC totaled 39,600 BTC on July 31, the largest such reading since November 16, 2022, when 39,900 BTC moved days after the FTX collapse. One holder lost 18.25 BTC, valued at $1.6 million, in under seven minutes. Moreno wrote on X on August 1, "The Bitcoin plebs had not move[d] this amount of BTC in a day since the FTX collapse… I like to see that people seem to be taking action."

The direction of the migration has reversed from 2022, when users pulled coins off exchanges into cold storage; this time, a cold storage failure pushed coins in the opposite direction, a tension Binance founder Changpeng Zhao reignited in the ongoing self-custody debate. The third metric completes the picture: Glassnode counted 761,796 transfers on July 31, a local spike but well below prior peaks of more than 1 million transfers on December 13, 2024, April 19, 2025, and May 9, 2026. The divergence between a 20-month high in active addresses and a merely elevated transfer count indicates wide participation across many wallets rather than a few large actors. Ongoing on-chain monitoring will determine whether the activity marks a one-time response to the Coldcard incident or a sustained shift in user behavior.