Dormant Bitcoin Wallets Wake as Coldcard Hack Spurs $1B Move
A bitcoin wallet dormant since 2013 transferred 500 BTC, worth $31.3 million, on Monday, joining a wave of old coins moving on-chain amid the ongoing security crisis surrounding Coldcard hardware wallets. The transaction, flagged by blockchain tracker Whale Alert, involved the wallet labeled 18TExP, which had held the coins since 2013 when they were worth roughly $500,000.
The move was not isolated. On-chain data from CryptoQuant shows a clear spike in the movement of bitcoin that had been dormant for seven to ten years or more. Coins inactive for over a decade saw roughly 935 BTC move on August 3, the largest single-day total since March 20, while coins dormant for five to seven years saw 6,388 BTC move on July 31.
A Billion-Dollar Transfer Adds to the Trend
Just a day earlier, on August 3, a wallet holding 16,400 BTC — worth about $1.04 billion at current prices — moved its entire balance after seven months of inactivity. The transfer, first flagged by Lookonchain, went to a new wallet rather than a known exchange, suggesting a custody reshuffle or over-the-counter trade rather than an imminent sale. That transaction represents roughly 0.078% of Bitcoin’s total supply and ranks among the largest transfers of the past three months.
These movements come as Bitcoin trades near $62,800, almost 50% below its October 2025 record high of $126,198. The combination of old coins waking up during a security scare has analysts and investors watching closely for signs of panic selling or strategic repositioning.
Context: The Coldcard Hack Shakes Confidence
The catalyst for this wave of activity appears to be the Coldcard hack that began on July 30. Security researchers at Galaxy Research say attackers exploited a vulnerability in firmware released on March 17, 2021, draining bitcoin from thousands of wallets. The first wave swept 1,082.65 BTC from 1,195 addresses in just 41 minutes. Two subsequent waves brought total estimated losses to roughly $88.6 million, affecting around 4,585 addresses.
The attack has raised serious questions about self-custody security. Coldcard is a popular bitcoin-only hardware wallet, favored by users who prioritize offline storage. The flaw, which dates back more than five years, allowed attackers to compromise wallets generated during that period. Galaxy cautioned that its findings are preliminary and based solely on blockchain analysis, and that not all affected wallets have been confirmed as Coldcard-generated.
Exchange Deposits Spike as Users Reassess
In the days following the hack, centralized exchanges saw a sharp increase in bitcoin deposits. On July 31 alone, net exchange inflows reached 11,163 BTC, with major platforms like River, Binance, Kraken, and OKX receiving significant sums. This suggests that some users, worried about the security of their hardware wallets, moved funds to exchange accounts for safekeeping or to liquidate positions.
The spike in old-coin movements may be linked to this same anxiety. Wallet owners who have held bitcoin for years might be transferring to new addresses they believe are safer, or consolidating funds in response to the breach. The 2013 whale’s move, timed during the hack, is being read by analysts like Lookonchain as a security precaution: “The owner may have moved the funds to a new wallet due to security concerns following the Coldcard hack.”
Perspective: What This Means for Bitcoin’s Market and Trust
The current wave of dormant wallet activity is a reminder that bitcoin’s on-chain behavior often reflects real-world events. While individual transfers do not reveal intent, the clustering of old-coin movements around a security crisis suggests that long-term holders are not immune to fear. The billion-dollar transfer, in particular, could be a major institutional player repositioning assets, which might signal confidence in bitcoin’s long-term value even as prices remain depressed.
At the same time, the hack has exposed vulnerabilities in self-custody, the very feature that draws many to bitcoin. The fact that a hardware wallet—designed to be the gold standard of security—could be compromised is unsettling for the community. If more users decide that exchange custody is safer, we could see a shift in how bitcoin is held, potentially increasing centralization risks that the ecosystem has long fought against.
The spike in exchange inflows suggests that some of that shift is already happening. But the billion-dollar move to a non-exchange address indicates that not all whales are fleeing to centralized platforms. Some are simply tightening their own security, moving coins to fresh wallets with updated protocols.
For the average investor, the takeaway is clear: the Coldcard incident has introduced a new layer of uncertainty, and the movement of old coins is a visible reaction. Whether this is a short-term panic or a longer-term change in behavior will depend on how the situation unfolds. As Galaxy researchers continue to monitor the attacker’s addresses, and as analysts track further old-coin spikes, the market will be watching for signs of deeper distress or, conversely, a vote of confidence from those who have held through multiple cycles.
In the meantime, the image of a 2013 wallet—one that survived the Mt. Gox era, the 2017 boom, and the 2021 crash—finally moving its coins is a stark illustration of how external events can pierce even the most patient holding strategies. Whether these movements are the beginning of a broader sell-off or just a prudent reallocation remains to be seen, but they are a signal that no bitcoin is truly asleep forever.
Comments