Coldcard seed bug drives a spike in new Bitcoin addresses as users flee 2021-era wallets

New Bitcoin addresses jumped from roughly 260,000 to more than 330,000 in the week to August 11, breaking a decline that had held for most of 2026, according to The Block's Data & Insights newsletter. The outlet attributes the reversal to wallet migrations prompted by the ongoing exploit of Coinkite's Coldcard hardware wallets.

The underlying flaw is old. The Block reports a 2021 firmware bug caused affected devices to generate seed phrases using a weak software random number generator rather than the device's hardware entropy source. That narrowed the effective key strength enough for attackers to brute-force the resulting wallets offline — no phishing, no malware on the user's machine, no interaction required. Anyone who generated a wallet on vulnerable firmware was exposed from the moment they wrote the seed down.

Losses stand at a minimum of 1,816 BTC, about $116 million, across four separate theft waves beginning July 30, per The Block. That implied price of roughly $63,900 per coin is consistent with the sub-$64,000 level The Block was reporting for bitcoin the same day. Coinkite has told users who generated wallets between March 2021 and the security patch to move funds to freshly created ones; that advisory is what appears to be showing up in the address data.

Key facts

• New Bitcoin addresses rose from ~260,000 to 330,000+ in a week, reversing 2026's downtrend — The Block Data & Insights
• At least 1,816 BTC (~$116 million) stolen across four waves since July 30 — The Block
• Cause: 2021 firmware bug substituting a weak software RNG for hardware entropy, enabling offline brute-forcing — The Block
• Coinkite's remediation: users with wallets generated from March 2021 to the patch should migrate to new wallets — The Block, citing Coinkite

The real-world read

The 70,000-address jump is an inference, not a measurement. The Block's own language — "apparent" migrations, "contributed to" the rise — is doing careful work. New-address counts are noisy and move for many reasons; nobody can label an address "Coldcard refugee."

"At least 1,816 BTC" is a floor traced by observers, not a total confirmed by Coinkite. No public accounting from the company has surfaced, no patch date is specified, and the affected window is defined by an event readers can't date. Also unaddressed: whether Coinkite is compensating anyone, and who the attackers are.

Note where the framing lands. The same newsletter excerpt pivots from the exploit to readers "evaluating the benefits of self-custody versus custodial options such as centralized exchanges or ETF vehicles" — a conclusion that flatters custodians, published by an outlet whose majority investor, Foresight Ventures, counts the exchange Bitget as an anchor LP. The Block discloses this and says it operates independently. The narrower point survives the framing: self-custody removes counterparty risk, not implementation risk.

Opinion, and whose

The self-custody-as-stress-test reading, and the suggestion that holders are reweighting toward exchanges and ETFs, are The Block's analysts' — Ivan Wu and Bryan Samsoedin — not established fact. No survey or flow data supporting a custodial shift accompanies the claim.

Sources

• The Block, "New Bitcoin addresses jump as Coldcard exploit pushes users to move funds" (Aug 11, 2026), by Ivan Wu and Bryan Samsoedin — address counts, loss figures, bug mechanics, Coinkite's advisory, and the self-custody analysis. Excerpted from The Block's Data & Insights newsletter. The Block discloses that Foresight Ventures is its majority investor and that Bitget is an anchor LP in that fund.

Coinkite's own advisory is reported here secondhand; no primary statement from the company was available at publication.

Not financial advice.