The Coldcard hardware-wallet theft set off one of the clearest natural experiments in Bitcoin holder behavior this cycle, according to on-chain analytics firm Glassnode. In its Week 31 report, Glassnode found that the roughly 594 BTC theft, worth about $38 million and executed in around 25 minutes on July 31, triggered a movement of dormant coins some 200 times larger, as holders across the network rushed to rotate funds off potentially compromised wallets.
Crucially, Glassnode’s data suggests that scramble was defensive, not a sell-off. Only about 10% of the moved coins ended up on exchanges, a pattern the firm reads as a migration into fresh cold storage rather than a liquidation, and one the spot market barely noticed.
A 25-Min Theft, a 3-Day Scramble
In the early hours of Friday, July 31, an attacker exploiting a roughly five-year-old key-generation flaw in Coldcard hardware wallets swept about 594 BTC from some 500 self-custodied wallets in around 25 minutes. The theft itself was over almost as soon as it started; the reaction ran for days.
Glassnode measured that reaction using a metric it calls Revived Supply 1y+, which tracks the volume of coins moving after sitting untouched for at least a year. That figure surged to roughly 119,000 BTC over the three days following the theft, about 200 times the amount stolen, as holders “rotated coins off potentially compromised seeds,” the firm wrote. Set against three weeks of ordinary network traffic, the surge appears as a single, isolated spike.
Migration, Not Liquidation
The more consequential finding is where those coins went. By Glassnode’s analysis, only about a tenth of the revived supply stuck to exchanges, the venues where coins typically land when holders intend to sell. Two other signals reinforced its read that the movement was defensive: the count of new addresses returned to its baseline within three days, and the amount of Bitcoin held in wallets less than a month old has climbed 40% since the event and was still rising at the time of the report. Glassnode characterized the episode as “a migration into fresh cold storage, not a liquidation.”
The spot market, the firm added, “barely registered the event.” What it described as the largest forced movement of old coins this cycle produced no measurable selling pressure and no discernible price response, a stillness Glassnode framed as evidence of a market with, in its words, neither a live bid nor a live offer.
The Bigger Backdrop
Glassnode placed the episode inside a broader picture of an unusually quiet Bitcoin market. In the report, titled “Priced For Nothing, Reacting To Everything,” the firm noted that both major US equity indices and gold broke to records over the week while Bitcoin traded roughly flat, following the Federal Reserve’s July 29 decision to hold interest rates steady.
On the demand side, Glassnode said the institutional channels that powered the last bull market have been running in reverse: US spot Bitcoin ETFs returned roughly 65,800 BTC in June, which it called their worst month on record, against a peak of more than 218,000 BTC absorbed in a single month in late 2024. The firm also highlighted that upside implied volatility in Bitcoin options had fallen to a record low near 23%, describing an options market “priced for nothing” even as short-term sentiment swung sharply on small price moves.
The report’s overall assessment was that Bitcoin’s bottoming conditions are “assembling but incomplete,” reaching familiar territory “through boredom, not capitulation.” The firm noted that deep volatility squeezes like the current one have historically tended to resolve upward, while cautioning that this one is forming without the structural demand that accompanied past examples. As with all such analysis, these are Glassnode’s interpretations of the data, and the report itself states it does not constitute investment advice.
Why It Matters
For the wider market, the report reframes what looked like an alarming on-chain event. A surge of long-dormant Bitcoin suddenly moving can, in other contexts, signal that early holders are heading for the exits.
The current data indicates the opposite here: the coins moved out of fear of theft, not desire to sell, and overwhelmingly into new self-custody rather than onto exchanges. It is also a data-driven counterpart to what The Crypto Times examined earlier, a wave of dormant wallets and long-term holders stirring in response to the Coldcard exploit, now quantified by one of the industry’s most-watched analytics firms.
Also Read: Coldcard Hacker’s Wallet Turns Into On-Chain Public Bulletin Board
