Dormant Bitcoin Wallets Reactivate After Coldcard Hack as Security Fears Spur Transfers

Long-dormant Bitcoin wallets are being reactivated after the Coldcard hardware wallet hack, with some addresses that had been idle for more than a decade moving funds.

CoinDesk reported on Aug. 4 that 500 BTC was moved from wallet "18TExP," which had been dormant since 2013. Whale Alert first flagged the transaction. The coins are now worth about $31.3 million, up from roughly $500,000 when they last moved 12 years ago.

Lookonchain wrote on X that the 18TExP wallet had been inactive for more than 12 years before transferring all 500 BTC to a new wallet about an hour earlier. The platform said the move was likely prompted by security concerns following the Coldcard hack.

The Coldcard hack began on July 30. Blockchain research firm Galaxy said attackers exploited a vulnerability dating back to March 2021 and have so far stolen about $130 million worth of Bitcoin from Coldcard-generated wallets.

The 500 BTC transfer was not an isolated case. Data from on-chain analytics platform CryptoQuant showed a clear jump in long-dormant coin movements immediately after the Coldcard hack. On July 31, about 6,388 BTC that had been dormant for five to seven years was moved. On Aug. 3, about 935 BTC that had been idle for more than 10 years moved in a single day. That was the largest one-day movement since March 20.

Long-dormant coins can move for many reasons, including inheritance processing, exchange consolidation and transfers to custodial services. In this case, however, several large dormant wallets were activated within days of the Coldcard hack, raising the possibility that holders were moving assets preemptively because of security concerns.