New Bitcoin addresses jump as Coldcard exploit pushes users to move funds

The number of new Bitcoin addresses climbed from roughly 260,000 to more than 330,000 last week, sharply reversing a downward trend that had persisted for most of the year, amid apparent wallet migrations linked to the ongoing Coldcard exploit.

Coinkite's hardware wallet users have lost at least 1,816 BTC (~$116 million) across four theft waves since July 30, traced to a 2021 firmware bug that generated seeds using a weak software random number generator instead of the device's hardware entropy source. Attackers were able to collapse the effective key strength enough to brute-force offline wallet generations.

Coinkite has advised any users who generated wallets between March 2021 and the security patch to move to freshly created wallets. This has contributed to the rise in new addresses being used on the network. 

The Coldcard exploit is a useful stress test of self-custody. The allure of self-custody has included the removal of counterparty risk. However, it doesn't remove implementation risk, and events like this surface the risks that holders still face even when following best self-custody practices. 

As exploits have surged this year, users and holders are increasingly evaluating the benefits of self-custody versus custodial options such as centralized exchanges or ETF vehicles for exposure.

This is an excerpt from The Block's Data & Insights newsletter. Dig into the numbers making up the industry's most thought-provoking trends.