Coldcard Breach Triggers 210,000 BTC Movement From Long-Term Holder Wallets

The impact of the recent Coldcard security breach is beginning to appear in Bitcoin’s on-chain data, with a significant amount of BTC moving out of wallets classified as long-term holdings.

According to Glassnode data, around 210,000 BTC have left long-term holder (LTH) wallets over the past week. This marks the largest weekly decline in LTH supply since December 2024, when Bitcoin was approaching the $100,000 level for the first time.

Glassnode defines long-term holders as entities that have kept their Bitcoin dormant for roughly 155 days, or just over five months. This group is often viewed as the market’s “smart money” because these holders typically remain invested through periods of short-term volatility.

The total Bitcoin supply held by long-term investors has now dropped to approximately 14.7 million BTC, compared with just under 15 million BTC before the Coldcard incident.

Historically, sharp declines in LTH holdings have often appeared during strong market rallies or around major market tops. Similar distribution patterns were recorded near the peaks of March 2021, March 2024 and December 2024, when long-term investors reduced their exposure as demand increased.

The current situation is notably different, however. Bitcoin is trading near $64,000, roughly 50% below its all-time high reached in October.

The recent movement may therefore have a different explanation from traditional long-term holder profit-taking.

The Coldcard breach was linked to insufficient randomness in affected firmware, potentially allowing attackers to reconstruct wallet recovery phrases and gain access to users’ funds. Thousands of addresses were reportedly impacted, with total losses estimated at up to $114 million.

Coldcard subsequently advised affected users to create new wallets and transfer their Bitcoin, warning that simply updating the firmware would not protect keys that may already have been compromised.

As a result, part of the decline in LTH supply could represent Bitcoin being transferred from older wallets into newly generated addresses rather than being sold.

The incident could also be prompting some investors to reconsider how they store their Bitcoin.

Some holders may be moving their assets to newly generated self-custody wallets, while others could be turning to regulated custodians or spot Bitcoin ETFs as they reassess the risks associated with managing private keys themselves.

Recent ETF activity provides some support for this possibility. U.S. spot Bitcoin ETFs attracted roughly $754 million in net inflows over the past week, with BlackRock’s iShares Bitcoin Trust (IBIT) accounting for the majority of those inflows.

The decline in long-term holder supply should therefore not automatically be interpreted as a bearish signal.

While large-scale movement from dormant wallets has historically accompanied periods of distribution, the timing of the latest shift suggests that custody migration may be playing a significant role. Bitcoin also failed to establish new lows following the Coldcard breach, further weakening the argument that the movement represents widespread panic selling.

The more important takeaway may be that Bitcoin holders are becoming increasingly conscious of the infrastructure surrounding self-custody. A security incident affecting wallet-generation technology can encourage users to move funds even when they have no intention of selling.

This could become an increasingly important trend as Bitcoin ownership matures. The next phase of the market may not simply be about whether investors hold or sell BTC, but where and how they choose to hold it. If more investors migrate toward regulated custodians, ETFs or redesigned self-custody solutions, security could become a much bigger factor in shaping Bitcoin’s ownership structure.