The ongoing Coldcard attack is driving a significant rise in Bitcoin onchain activity, reaching its highest level of 2026 according to a report by research firm K33. This surge mirrors patterns resembling local market tops and bottoms, the firm’s analysis suggests.
K33’s head of research, Vetle Lunde, observed this heightened movement, stating that “Panic is visible onchain.” The firm estimates approximately 890,000 BTC has been moved over the past week, impacting roughly 7,300 addresses. This activity follows previous estimates which indicated Coincard-related losses had risen to around $130 million – equivalent to approximately 2,000 BTC.
Galaxy Research currently estimates at least fifteen separate attackers are exploiting the vulnerability. Initial figures pointed towards losses exceeding $100 million, but this has subsequently increased. K33’s own research suggests that approximately 1,596 BTC has been stolen, representing a considerable sum within the broader Bitcoin ecosystem.
The current situation is characterised by notably narrow trading ranges for Bitcoin, with the tightest 30-day high-to-low movement recorded since 2023. Furthermore, realized volatility has fallen below that of the Nasdaq 100 index. Two spikes in active supply were detected in February and June, coinciding with selloffs.
The analysis utilizes a rolling 365-day history for observation, identifying instances where active supply enters the top 10% of observations. It is believed that the April increase may be attributable to routine transfers rather than exchange activity or fraudulent transactions.
Despite these findings, uncertainties remain regarding the precise number of attackers involved – currently estimated at least fifteen – and potential additional thefts which have not yet been confirmed. The firm notes that address rotations likely contribute to some observed movement but are not definitively linked to exchange flows.
The market is responding to this escalation in onchain activity with heightened volatility, reflecting investor concern over the ongoing Coldcard attack. Continued monitoring of Bitcoin’s behavior remains crucial for understanding the unfolding situation.
Written by Daniel Brooks
Security Desk
