Bitcoin's daily active addresses surged to nearly 1 million on July 31 — the highest since December 10, 2024 — but the spike wasn't a sign of fresh demand. It was a panic. Attackers exploited a flawed random number generator in Coldcard hardware wallets, draining funds from thousands of users and triggering an emergency migration of coins.
The numbers
Glassnode data shows about 980,000 active addresses on July 31, up more than 50% from 645,000 the day before. CryptoQuant Head of Research Julio Moreno noted that sending addresses drove nearly all the growth; receiving addresses barely moved, suggesting consolidation. Thousands of wallets emptied toward a much smaller set of destinations. Historically, active addresses churned between 550,000 and 750,000 for most of 2026.
Transfers below 1 BTC totaled 39,600 BTC on July 31 — comparable to the 39,900 BTC moved on November 16, 2022, after the FTX collapse. But the direction was reversed: in 2022, users pulled coins off exchanges into cold storage; now cold storage failure sent coins the other way.
What happened to Coldcard
Three confirmed attack waves linked to 1,367 BTC ($88.6 million) stolen from 4,585 addresses. A suspected fourth wave swept over 380 BTC more. Galaxy Research head Alex Thorn observed sweep transactions at 13.8 per block, roughly 45 times the pre-incident baseline. Many wallets moved but each made only one or a few transactions — a mass emergency sweep, not organic activity.
Glassnode counted 761,796 transfers on July 31, a local spike but far from record (prior peaks over 1 million). Active addresses hit a 20-month high while transfer counts stayed inside their ordinary range, reinforcing the picture of a coordinated panic rather than broad network usage.
Price barely flinched
Bitcoin traded at $60,347 at press time, up 1.24% in 24 hours. Through its most active day in 20 months, the price held near $60,000. The market absorbed the news without a selloff — likely because the stolen coins were already moved by attackers, not dumped on exchanges in a panic.
Developers postponed the BIP-110 soft fork activation, citing the incident. The next signal for analysts is whether migrated coins stay put — a security story — or start selling, which would become a market story. For now, the network saw its busiest day in 20 months for all the wrong reasons.
