A long-dormant bitcoin $BTC$64,011.28 wallet woke up Monday, and it wasn’t alone. Several old coins have moved on-chain in the same narrow window, all since the Coldcard hack began on July 30.
The wallet labeled 18TExP, dormant since 2013, moved 500 $BTC, worth $31.3 million, in a transaction first flagged by on-chain tracker Whale Alert. The coins were worth roughly $500,000 when they last moved, 12.7 years ago.
Coins moving from one wallet to another doesn’t, on its own, reveal anything, except that someone holding a decade-old private key decided it was time to move.
And the timing is interesting. The reactivation happened in the middle of an unfolding security crisis around Coldcard, a popular Bitcoin-only hardware wallet, and it’s being read as a security move.
“Wallet 18TExP, holding 500 $BTC($31.27M), transferred all 500 $BTC to a new wallet 1 hour ago after over 12 years of inactivity. The owner may have moved the funds to a new wallet due to security concerns following the Coldcard hack,” blockchain sleuth Lookonchain said on X.
Since July 30, attackers have drained thousands of $BTC from Coldcard-generated wallets, exploiting a flaw dating back to March 2021. According to researchers at Galaxy, total damage so far is about $130 million in $BTC.
Over the weekend, some analysts pointed to increased inflows of $BTC onto exchanges as the hack dented confidence in self-custody safety.
The 500 $BTC isn’t an isolated case
On-chain data from CryptoQuant tracking the so-called spent output age bands, an indicator which groups all bitcoin moved on a given day by how long each coin had sat dormant before being spent, reveals a clear spike in old-coin movement around the same window.
Coins that had been dormant for 10 years or longer saw roughly 935 $BTC move on Aug. 3, the largest single-day total since March 20. Separately, coins dormant for five to seven years saw a much larger spike, with roughly 6,388 $BTC moving on July 31.
Old coins move for all kinds of reasons, such as estate transfers, exchange consolidations, custodial migrations that have nothing to do with any single hack.
But the clustering of large, long-dormant movements in the days immediately following the Coldcard incident gives the impression of holders proactively migrating funds for security reasons.