--- title: "Market Pulse - August 2: Bitcoin's Active Address Count Jumped Toward a Million, and the Coldcard Fix Looks Exactly Like a Panic On-Chain" published: 2026-08-03T12:23:22.541257+00:00 type: market_pulse scope: crypto_market canonical: https://moonwire.org/insights/market-pulse-2026-08-02.html tags: [market-pulse, coldcard, self-custody, on-chain, active-addresses, bitcoin, treasury, security] --- # Market Pulse - August 2: Bitcoin's Active Address Count Jumped Toward a Million, and the Coldcard Fix Looks Exactly Like a Panic On-Chain > The published remedy for the Coldcard firmware flaw is to generate a new seed and move funds, which is also what a rush for the exit looks like on-chain - and on Sunday bitcoin's active address count jumped from 645,000 toward a million. The count cannot separate the two, and three days on neither the migration nor the drain is finished. Three of the movements the day recorded were transfers rather than sales, and the sale that was announced had not been executed. ## Key takeaways - Bitcoin's active address count jumped from 645K toward 1M after the Coldcard bug - but the published remedy is to generate a new seed and move funds, so a migration and a panic leave the identical on-chain footprint [[2]](/s/lAf5p3AeS52-ztZumoKBlw)[[1]](/s/un7VenHVTCqcq0bU49xHHA). - The stolen total has not settled: $38M on Friday, more than 1,000 wallets and over $70M on Sunday morning, above $88M by Sunday night and described as still ongoing [[3]](/s/5XF6Ve7iT7a4z0K6fPj2Dw)[[4]](/s/3sdLp6ddTye9Q_tpleEFUg)[[5]](/s/CWq33LA5RfiOJwDVmlvtiw). - The curated responses moved from the device to the backup - XO on seed entropy and not trusting a device's TRNG alone, CZ on the four ways a written seed backup fails [[8]](/s/5XAXofAKQEK1_xCJViG95w)[[9]](/s/-9hhBCzET5WmgAaip1_bvg). - Cointelegraph carried a plan by Strategy to sell up to $5B in crypto - announced, not executed - the same day a long-form breakdown put Bitmine's quarterly staking revenue at $45.7M "without selling a single coin" [[5]](/s/CWq33LA5RfiOJwDVmlvtiw)[[6]](/s/SwropG7TS3OTUXiaubPqog). - Late in the window Michael Saylor posted that bitcoin sits almost exactly on its 200-week moving average, a level it has traded above 92% of the time since that average became available [[7]](/s/EeHA7nVESWSn87a5TrH1dg). The remedy that has been circulating since Friday for the Coldcard firmware flaw is to generate a new seed and move funds to it [[1]](/s/un7VenHVTCqcq0bU49xHHA). On Sunday, bitcoin's active address count jumped from 645,000 toward a million, and the publication that posted the spike pinned it to the hack [[2]](/s/lAf5p3AeS52-ztZumoKBlw). Those two sentences describe the same on-chain action. A holder following the guidance and a holder fleeing produce an identical footprint — new addresses, new transactions — and the count that measured Sunday cannot tell them apart. ## The guidance is movement, so the measurement of movement is ambiguous Cointelegraph's Friday update carried the maker's own instruction after Coldcard said an RNG flaw may have weakened seeds generated on affected Mk3, Mk4, Mk5 and Q firmware: "Users should update, generate a new seed and migrate funds." The post it quoted, relaying Block's Max Guise, put it more bluntly — affected users were "urged to move funds to a new, unaffected wallet as soon as safely possible" [[1]](/s/un7VenHVTCqcq0bU49xHHA). Two days later the same feed published the response as a number: "Bitcoin Active Addresses spike from 645K to almost 1M after the Coldcard hack" [[2]](/s/lAf5p3AeS52-ztZumoKBlw). Nothing about that figure separates a migration from an exit. It is ambiguous by construction, because the fix and the panic are the same keystrokes. ## The count of what was actually taken has not settled Friday, Decrypt: "$38M in Bitcoin drained by Coldcard Key flaw," with Coinkite saying it is likely an attacker used AI to review previous versions of its open-source firmware to uncover a vulnerability [[3]](/s/5XF6Ve7iT7a4z0K6fPj2Dw). Sunday morning: "More than 1,000 Bitcoin wallets were affected in the Coldcard incident, with losses already estimated over $70M" [[4]](/s/3sdLp6ddTye9Q_tpleEFUg). Later Sunday, an update put the figure above $88M, attributed it to Alex Thorn, and described the incident as still ongoing [[5]](/s/CWq33LA5RfiOJwDVmlvtiw). That progression is the practical reason the address spike stays ambiguous. Three days after the first alert neither process is finished — not the migration, and not the drain — so the same chain activity is being generated by both at once. ## The publication that posted the number also spent the day arguing that reactions outrun moves Across the weekend the same feed ran an interview series on exactly this problem of reading movement. One post: "The idea that institutions have 'diamond hands' may be one of Bitcoin's biggest myths," with the framing that "what matters is not the headline. It's the size of the move" [[4]](/s/3sdLp6ddTye9Q_tpleEFUg). Another: "Institutions aren't immune to taking profits," and "the fear is often bigger than the sell pressure" [[2]](/s/lAf5p3AeS52-ztZumoKBlw). The argument was aimed at institutional selling, not at hardware wallets. It applies to Sunday's own numbers without modification. ## Two more movements in the window, neither of them a sale Cointelegraph reported that Trump Media "has sent over 2,600 $BTC to Crypto com" [[5]](/s/CWq33LA5RfiOJwDVmlvtiw) — a transfer between a holder and a venue, which is a step a sale requires but is not itself one. The same feed posted that ETH supply on exchanges "keep dropping," attached to the question "Where do you keep your crypto?" [[4]](/s/3sdLp6ddTye9Q_tpleEFUg) — coins moving in the opposite direction, off venues rather than onto them, on the weekend that self-custody was the story. ## The sale that was announced had not happened yet Cointelegraph's post: "Strategy announced a plan to sell up to $5B in crypto," followed by the question of what happens on Monday [[5]](/s/CWq33LA5RfiOJwDVmlvtiw). Announced, dated to nothing, and not yet an execution. Set against it, from a long-form breakdown published by Coin Bureau the same day: Bitmine "earned $45.7 million without selling a single coin" in a single quarter, described as 98% of its revenue, with Tom Lee quoted saying the figure climbs to $284 million a year "once everything is switched on" [[6]](/s/SwropG7TS3OTUXiaubPqog). Two treasury vehicles, one reported as preparing to sell coin and one earning revenue from coin it does not sell. Late in the window, Michael Saylor posted that Strategy has begun tracking bitcoin's 200-week moving average, that bitcoin has traded above that average 92% of the time since it became available, and that "today, it sits almost exactly on the line" [[7]](/s/EeHA7nVESWSn87a5TrH1dg). ## The responses moved from the device to the backup On Friday the curated responses to the Coldcard failure were about what layer to add — a second secret, a quorum, a custodian. Sunday's moved one step further back, to the copy of the secret itself. XO wrote that the attack was "caused by a firmware bug that left seeds with critically low entropy" and that it reinforced a long-held view: understand how a hardware wallet generates its seed before trusting it with funds. He described his own arrangement — multisig for longer-term holdings, air-gapped wallets with an added passphrase for trading capital, and deliberately not letting the seed be generated solely from the device's TRNG, "the dedicated hardware circuit that creates genuine randomness from physical sources," because "relying only on the device's TRNG leaves you exposed if that hardware ever fails or is bypassed by a bug" [[8]](/s/5XAXofAKQEK1_xCJViG95w). In the evening, CZ posted four constraints on the written backup: "Securing the backup seed phrase is hard. Can't have someone else read it and say, 'oh, that's a nice seed phrase'. Can't have it destroyed by fire, flood, etc. Can't have a hacker gain access to it. And most importantly, can't lose it yourself." He was quoting a user account describing a hardware wallet that stopped signing transactions after a firmware update — recovered only because the seed had been written down elsewhere — and older device screens that fade until the PIN can no longer be entered [[9]](/s/-9hhBCzET5WmgAaip1_bvg). Neither response is directional. Both treat the failure as an engineering problem in where a secret lives, which is what a security-primitive failure produces instead of a repricing. ## What the tracked voices said about the tape CredibleCrypto's own text pointed at relative strength rather than direction for the majors: BTC and ETH carry "a series of unswept lows" while CRV carries unswept highs, so CRV "looks more primed for upside/relief" while "BTC and ETH look more primed for a further correction" [[10]](/s/KXkTM_QvSU-BON_sNWwl2w). The constructive side came from Ansem, who called it a "hated rally" [[11]](/s/Fa-OXXiWRQ2fnlt_xIxmAg) and answered a clip of himself explaining why he turns bullish before a bottom is confirmed with two words: "called my shot" [[12]](/s/uN2DMynwSKeid4ULVMxpgQ). ## Elsewhere in the window Russia "banned crypto mining in Moscow until 2032, saying the power grid can't handle the demand" [[4]](/s/3sdLp6ddTye9Q_tpleEFUg). The same feed relayed that a bipartisan deal could decide the CLARITY Act's fate next week, per Eleanor Terrett, and that crypto advocates have now contacted lawmakers 1,000,000 times pushing the bill [[4]](/s/3sdLp6ddTye9Q_tpleEFUg). ## What would settle the ambiguity If active address readings fall back toward their prior level while the stolen total stops rising, Sunday's spike was migration completing and nothing more. If the readings fall back while the total keeps climbing, the spike measured neither process cleanly and should not be read as either. The clean separator is not on-chain at all: a named exchange or custodian reporting inflows over the same days would distinguish coins moved to a venue from coins moved between self-custodied wallets. Until one does, the address count is a picture of activity, not of intent. --- *MoonWire surfaces and summarizes public crypto news.* **General information only — not financial advice.** MoonWire Ltd. is not licensed by ASIC and holds no AFSL. This content does not consider your objectives, financial situation, or needs, and is not a recommendation to buy, sell, or hold any asset. *This analysis is generated by artificial intelligence and may be inaccurate, incomplete, or fabricated. Independently verify before acting.* © 2026 MoonWire Ltd. · [Terms](https://moonwire.org/legal/TOS) · [Risk Disclosure](https://moonwire.org/legal/RISK_DISCLOSURE)