Following reports of a vulnerability in Coldcard hardware wallets, the Bitcoin network exhibited unusual activity across several metrics. Holders were transferring funds to new addresses rather than exchanges, according to Glassnode analysts.
An extreme day for bitcoin:native : As the Coldcard hack news broke on Friday, eight on-chain metrics printed values well above their two-year median.
The data indicates holders are migrating their coins to new wallets rather than sending to exchangeshttps://t.co/jjjyrPFpyl pic.twitter.com/3sJlOI1hZr
— glassnode (@glassnode) August 2, 2026
Experts compared eight on-chain indicators with their two-year median values.
The most significant deviations were observed in metrics tracking long-dormant coins: the volume of bitcoins untouched for over a year exceeded its median by about ten times. There was moderate growth in the number of active and new addresses, as well as total fees.
Transfers to exchanges and the overall number of transactions remained unchanged.
Lookonchain noted a wallet that had been inactive for 12 years. Its owner transferred all 500 BTC (approximately $31.3 million) to a new address, linking the move to concerns over the incident.
Wallet 18TExP, holding 500 $BTC($31.27M), transferred all 500 $BTC to a new wallet 1 hour ago after over 12 years of inactivity.
The owner may have moved the funds to a new wallet due to security concerns following the #Coldcard hack.https://t.co/1gQtI6XbwG pic.twitter.com/pVyPVBYaW0
— Lookonchain (@lookonchain) August 3, 2026
Exchange Inflows Remain Normal
CryptoQuant also confirmed that the Coldcard breach did not trigger a mass transfer of digital assets to trading platforms. On July 31, net inflows totaled 34,932 BTC, and on August 2, they were 8,768 BTC. These volumes fall within the range observed over the past month.
The situation was most evident in the dynamics of deposit transactions: on Friday, exchanges processed 31,217 incoming transfers — one of the highest since March. However, by Sunday, the figure had dropped to 19,537. CryptoQuant’s Head of Research Julio Moreno explained that the surge was driven by transactions ranging from 1 to 10 BTC, totaling about 7,300, the highest since early February.
Daily exchange deposits of Bitcoin transfers < 10 BTC spiked yesterday to 7.3K BTC, the highest since February 6.
Could be related to the coldcard hack, as people move their holdings looking for safety. pic.twitter.com/Ne64Raevka
— Julio Moreno (@jjcmoreno) August 1, 2026
Meanwhile, long-term holders remain in an accumulation phase, noted CryptoQuant. Over the past 30 days, this group has acquired about 220,400 BTC, more than it has sold.
Small Addresses Reduce Holdings
Santiment described a different scenario. Since July 29, wallets with balances from 10 to 10,000 BTC have increased by 19,610 coins — a 0.14% rise. Simultaneously, addresses with less than 0.01 BTC reduced their holdings by 0.55%.
🐋 Bitcoin’s 10 to 10K BTC wallets have added 19,610 more coins (+0.14%) since July 29th. Small retail wallets under 0.01 BTC now hold 0.55% less.
🔐 The timing lines up with the Coldcard fallout. A firmware entropy flaw put affected wallets at risk, with estimated losses now… pic.twitter.com/vwWVCNLoxK
— Santiment Intelligence (@SantimentData) August 3, 2026
Analysts linked this trend to the incident’s aftermath: they estimate that trust in hardware wallets has been shaken, prompting some retail holders, even those not directly affected by the attack, to reduce their positions. Large addresses, on the other hand, are absorbing the supply entering the market.
On August 3, Galaxy Research head Alex Thorn reported a suspected fourth wave of attacks on Coldcard owners. The new estimate suggests that the number of affected addresses has reached 709, with losses exceeding 448 BTC.
