Following reports of vulnerabilities in Coldcard wallets, the Bitcoin network exhibited unusual activity across several metrics. Analysts from Glassnode noted that holders were transferring their assets to new addresses instead of exchanges.
An extreme day for bitcoin:native : As the Coldcard hack news broke on Friday, eight on-chain metrics printed values well above their two-year median.
The data indicates holders are migrating their coins to new wallets rather than sending to exchangeshttps://t.co/jjjyrPFpyl pic.twitter.com/3sJlOI1hZr
— glassnode (@glassnode) August 2, 2026
Experts analyzed eight on-chain indicators, comparing them with their median values over the past two years.
The most significant deviation from normal levels was observed in metrics tracking the movement of long-dormant coins: the amount of Bitcoin that had remained untouched for over a year surged approximately tenfold. There was moderate growth in the number of active and new addresses, as well as total fees.
Conversely, transfers to exchanges and the overall number of transactions remained stable.
Lookonchain highlighted a wallet that had been inactive for 12 years, from which the owner transferred all 500 BTC (around $31.3 million) to a new address—an operation linked to concerns arising from the incident.
— Lookonchain (@lookonchain) August 3, 2026
Exchange Inflows Remain Normal
CryptoQuant also confirmed that the Coldcard hack did not lead to a mass transfer of digital assets to trading platforms. On July 31, the net inflow was 34,932 BTC, and on August 2, it was 8,768 BTC. These figures fall within the range observed over the past month.
Source: CryptoQuant.The situation was most evident in the dynamics of deposit transactions: on Friday, exchanges processed 31,217 incoming transfers—one of the highest numbers since March. However, by Sunday, this figure dropped to 19,537. Julio Moreno, head of research at CryptoQuant, explained that the spike was driven by transactions between 1 and 10 BTC—around 7,300 such transfers occurred, marking the highest level since early February.
Daily exchange deposits of Bitcoin transfers < 10 BTC spiked yesterday to 7.3K BTC, the highest since February 6.
Could be related to the coldcard hack, as people move their holdings looking for safety. pic.twitter.com/Ne64Raevka
— Julio Moreno (@jjcmoreno) August 1, 2026
Long-term holders, meanwhile, are still in an accumulation phase, as noted by CryptoQuant. Over the past 30 days, approximately 220,400 BTC have transitioned into this group, exceeding the amount that left.
Smaller Addresses Reduce Holdings
In contrast, Santiment reported a different trend. Since July 29, wallets holding between 10 and 10,000 BTC increased by 19,610 coins—a rise of 0.14%. Meanwhile, addresses with balances below 0.01 BTC decreased their holdings by 0.55%.
🐋 Bitcoin’s 10 to 10K BTC wallets have added 19,610 more coins (+0.14%) since July 29th. Small retail wallets under 0.01 BTC now hold 0.55% less.
🔐 The timing lines up with the Coldcard fallout. A firmware entropy flaw put affected wallets at risk, with estimated losses now… pic.twitter.com/vwWVCNLoxK
— Santiment Intelligence (@SantimentData) August 3, 2026
Analysts linked this trend to the aftermath of the incident, suggesting that confidence in hardware wallets has been shaken, prompting some retail holders, even those not directly affected by the attack, to reduce their positions. In contrast, larger addresses are absorbing the available supply in the market.
It is worth noting that on August 3, Alex Thorn, head of Galaxy Research, reported an estimated fourth wave of attacks targeting Coldcard owners. According to new estimates, the number of affected addresses reached 709, with losses exceeding 448 BTC.