Bitcoin onchain activity has climbed to its highest level of 2026 as the ongoing Coldcard attack continues to unfold, with K33 arguing that the surge in coin movement during the past week resembles a pattern historically seen around local market tops and bottoms.

The research and brokerage firm's report comes as the number of attackers and funds stolen from the exploit continues to expand. Galaxy Research said Tuesday that victim reports continue to uncover new theft patterns, with the firm now estimating that at least 15 different attackers have exploited the vulnerability. Galaxy previously estimated Coincard-related losses had exceeded $100 million, rising to about $130 million, or roughly 2,000 BTC, including suspected but unconfirmed thefts. K33 estimates the exploit has so far resulted in about 1,596 BTC being stolen from roughly 7,300 addresses.

'Panic is visible onchain'

In the report, K33 Head of Research Vetle Lunde said around 890,000 BTC has been moved over the past seven days, marking the highest level of active supply recorded this year. Lunde said the acceleration came despite subdued price action, with bitcoin recording its narrowest 30-day high-to-low trading range since 2023 while realized volatility fell below that of the Nasdaq 100.

Against that backdrop, the analyst argued the spike in transaction activity was "very likely driven by the Coldcard attacks," but has also "likely heightened concerns about other hardware wallets, including Ledger and Trezor, prompting some owners to consider centralized custodians or multisignature setups."

Lunde argued that such elevated onchain activity has repeatedly appeared near local market turning points. Periods when seven-day active supply entered the top 10% of observations relative to its rolling 365-day history coincided with local tops and bottoms during the 2022 bear market, the 2024 and 2025 bull markets, and the 2026 bear market, according to the report.

"The intuition behind this observation is clear: panic is visible onchain," Lunde wrote, adding that market declines often prompt holders to move coins to exchanges to avoid further losses, while rallies encourage both fear of missing out among buyers and profit-taking by existing holders. He noted that two of this year's largest spikes in active supply coincided with selloffs in February and June, while an increase in late April was likely driven by routine transfers and address rotations rather than exchange-related flows.