By The fallout from the Coldcard hardware wallet breach has now shown up on-chain, and Glassnode has put a number on it. Roughly 210,000 BTC left long-term holder wallets over the past week, according to Glassnode data via Coindesk, pushing the cohort’s total supply down from just under 15 million BTC to about 14.7 million. It is the largest weekly decline in long-held Bitcoin since December 2024.
That headline alone would normally signal a market top. Long-term holders, entities whose coins have sat dormant for at least 155 days, are the market’s patient money, and when they are distributed in size, it has historically been to sell into strength. This time is different, and the difference is the story. The breach, which stemmed from a weak random-number flaw in Coldcard firmware dating to 2021 and was exploited from late July, has triggered the largest Bitcoin migration since FTX, and almost none of it is profit-taking.
Long-term holder supply (orange) fell sharply to about 14.7 million BTC even as price (black) sits roughly 50% below its 2025 peak, inverting the usual pattern where distribution occurs at market tops. Source: GlassnodeWhy This Isn’t Distribution
The tell is in the conditions. Heavy long-term-holder spending clustered around the market peaks of March 2021, March 2024 and December 2024, when experienced holders sold into rising demand and took profits. This wave is happening with Bitcoin near $64,000, roughly 50% below its October record high. Seasoned holders do not typically sell in size at half their asset’s peak value. Something other than profit-taking is moving these coins.
That something is forced custody migration. After the breach, Coldcard advised affected users to generate entirely new wallets and move their Bitcoin immediately, and holders did, at scale. The most striking measure comes from Glassnode’s own reading: roughly 119,000 BTC that had been dormant for at least a year moved within three days of the exploit, a volume around 200 times the small amount actually drained in the attack. A tiny theft triggered an enormous defensive relocation.
The destination confirms the intent. Only about one-tenth of the revived coins reached exchanges, with the rest flowing into freshly generated cold-storage addresses or regulated custody. Spot markets showed no measurable sell pressure, Bitcoin did not make new lows after the hack, and daily active addresses climbed to about 980,000, the highest since December 2024. Every one of those signals points the same way: this is coins changing wallets, not owners.
Investor Takeaway
The 210,000 BTC decline looks like a distribution top on the chart but is the opposite, so reading it as bearish would misjudge the entire move.
What It Means for Self-Custody and Price
The episode has reopened a debate the industry thought it had settled: whether self-custody with a hardware wallet is truly safer than handing coins to a regulated custodian. A firmware flaw that sat undiscovered for years, then drained wallets once exploited, is exactly the failure mode self-custody advocates insist can’t happen to them.
The migration shows some holders are voting with their coins, moving toward newly secured wallets, and in some cases toward custodians and ETFs. US spot Bitcoin ETFs drew roughly $754 million in the same week, and the funds have been on a sustained inflow streak, a trend the Coldcard scare can only reinforce.
For price, the reassuring signal is what didn’t happen. A 210,000 BTC exit from long-term wallets that was genuine selling would have hit the market hard. Instead, Bitcoin absorbed the largest such move in eighteen months and recovered, trading near $65,000 as of Friday, up on the day and holding well above the sub-$63,000 levels it saw earlier in the month. The market read the migration correctly, as a change in storage rather than a change in conviction, which is why the largest LTH decline since December 2024 passed without a sell-off.
Bitcoin recovered toward $65,000 through the week, holding firm despite the largest long-term-holder supply decline since December 2024. Source: TradingViewThe open question is whether the migration is finished or still underway. As long as coins keep leaving compromised wallets for secure storage without reaching exchanges, the on-chain picture will keep looking dramatic while the price stays stable, an unusual divergence that, for now, says more about how Bitcoin is being stored than about where it is heading.
Investor Takeaway
Watch whether moved coins stay off exchanges: as long as they flow to cold storage rather than order books, the LTH drop is storage noise, not a selling signal.