Onchain analytics platform Santiment reported that bitcoin this week saw the largest creation of new wallets in a year and the highest number of active wallets in ten months, a move attributed to the fallout from the firmware bug in Coinkite's Coldcard hardware wallets.
There were 2.27 million new wallets in the week. Active wallets stood at 751,000 per day in the opening week of August, compared with an average of 610,000 in July, after hitting a peak of 978,000 on July 31, about 1.6 times the month's daily average.
The advance, however, was not accompanied by an increase in transfers to exchanges. Daily inflows in these venues totaled US$ 1.55 billion in the period, slightly below July's average of US$ 1.67 billion. For the platform, the divergence indicates defensive behavior, with users moving funds and creating wallets without necessarily buying bitcoin.
Coldcard flaw
The origin of the movement is a vulnerability in Coinkite's hardware wallets. A bug present in versions 4.0.1 to 4.1.9, since March 2021, caused seed phrase generation to use a software-based random number generator instead of the dedicated entropy chip. In the most affected Mk3 units, actual randomness was around 40 bits, versus the expected 128 bits; in some later models, the level reached 72 bits.
Bitcoin.com News documented losses of more than US$ 116 million, with a fourth wave of thefts still underway days after the initial disclosure. Coinkite sent a firmware fix and published a statement detailing the entropy generated by the devices. In an emergency audit, independent researchers found nearly 5,000 vulnerabilities in hundreds of bitcoin-related projects in just over a day of testing.
Geographic data from affected wallets indicates that Canadian users account for about a quarter of the losses, which may reflect Coinkite's initial customer base in the country. Experts stress that the problem is not in the bitcoin protocol, but in the self-custody supply chain, as it is a specific firmware flaw from a manufacturer.
