Bitcoin Onchain Activity Hits 2026 High as Coldcard Attack Spreads

Key Point

Bitcoin onchain activity climbed to its highest level of 2026 as the ongoing Coldcard attack continued to unfold. K33 Head of Research Vetle Lunde said about 890,000 BTC moved over the past seven days. Galaxy Research said victim reports continue to uncover new theft patterns, with at least 15 attackers exploiting the vulnerability. K33 estimates about 1,596 BTC has been stolen from roughly 7,300 addresses. Lunde said high active supply coincided with local tops and bottoms during the 2022 bear market, the 2024 and 2025 bull markets, and the 2026 bear market.

Why it matters: The attack may turn a custody incident into a market-liquidity signal if holders keep moving coins defensively.

Market Sentiment

Cautiously Bearish, Risk-off, Event-driven, Volatile.

Reason: K33 linked the active supply surge to the Coldcard attacks, which can make traders cautious about custody risk.

Similar Past Cases

In 2022, Sky Mavis raised $150 million to reimburse users affected by the Ronin Bridge hack after Ronin losses totaled over $600 million. (Axios) The difference is that Ronin was a bridge failure, while the current incident centers on hardware-wallet vulnerability and Bitcoin holder behavior.

Ripple Effect

Custody fear can move coins from self-custody toward centralized custodians or multisignature setups. If exchange-bound movement increases after hardware-wallet concerns spread, then selling pressure may become more visible. If movement slows, then the event may remain contained as an operational security incident.

Opportunities & Risks

Opportunities: If coin movement stabilizes and custody concerns ease, then staged re-entry can reduce timing risk for traders who waited for panic to fade.

Risks: If victim reports keep expanding the theft estimate, then reducing single-device custody exposure can limit operational risk for self-custody users.