Bitcoin wallet security rattled as $130M Coldcard hack moves a dormant $31M wallet

A bitcoin wallet that had sat untouched since 2013 suddenly sprang back to life this week, moving 500 BTC worth $31.3 million in a single transaction. The timing wasn’t random. It happened right as a security scare tied to Coldcard hardware wallets was rattling confidence in how people store their crypto, raising fresh questions about bitcoin wallet security at a moment when self-custody is supposed to be the safest option around.

Key takeaways

• A wallet labeled 18TExP, dormant since 2013, moved 500 BTC worth $31.3 million after 12.7 years of inactivity, first flagged by Whale Alert.
• Those same coins were worth roughly $500,000 the last time they moved, back in 2013.
• A flaw in Coldcard hardware wallets, dating back to March 2021, has been exploited by attackers since July 30, 2026, draining an estimated $130 million in BTC, according to researchers at Galaxy.
• On-chain data shows a broader pattern: 935 BTC dormant for 10+ years moved on August 3, and 6,388 BTC dormant five to seven years moved on July 31.
• Analytics firm Lookonchain suggested the 18TExP transfer may be a defensive move tied directly to the Coldcard hack.

Dormant Bitcoin Wallet Moves Millions After 12 Years

On its own, a wallet moving coins doesn’t say much — someone with an old private key simply decided it was time. But the scale and timing here made this transaction stand out immediately.

The 18TExP Wallet Transfer

The wallet in question, tagged 18TExP, had been completely inactive since 2013. It held 500 BTC, and when it finally moved, the transaction was worth $31.3 million at current prices. Whale Alert, the blockchain tracking service that monitors large crypto movements, was the first to flag the transfer publicly.

Value Change Since Last Movement

The jump in value tells its own story about bitcoin’s long-term trajectory. Those same 500 BTC were worth roughly $500,000 the last time they changed hands, 12.7 years ago. That’s a more than 60-fold increase in dollar terms over the holding period — a reminder of just how much wealth has been sitting quietly in wallets that predate most of the current crypto industry.

Coldcard Hardware Wallet Security Breach

The reactivation of a 12-year-old wallet didn’t happen in a vacuum. It coincided with an active security crisis involving Coldcard, a widely used Bitcoin-only hardware wallet designed specifically to keep private keys offline and safe from remote attacks.

Details of the Vulnerability

The issue isn’t new, exactly — it traces back to a flaw dating to March 2021. What changed is that attackers have now found a way to exploit it, draining BTC from wallets generated using the compromised process. This matters because Coldcard has built its reputation on offline, air-gapped security, and the breach undercuts a product that many self-custody bitcoin holders trusted precisely because it wasn’t supposed to have this kind of weakness.

Scale and Timeline of the Hack

Since July 30, 2026, attackers have been systematically draining wallets tied to the flaw. Early estimates put the damage at around $89 million across more than 1,200 affected addresses, according to reporting from Fox Business. That figure has since climbed. Researchers at Galaxy now put total losses at approximately $130 million in BTC, and the number could still shift as more affected wallets surface. Over the weekend, analysts also noted a rise in bitcoin flowing onto exchanges, a pattern often associated with holders losing confidence in self-custody and opting to move funds somewhere they consider safer, at least temporarily.

Why this matters: Coldcard and devices like it exist specifically to remove the need to trust an exchange or custodian with your coins. A flaw at the hardware level strikes at the core promise of self-custody, and it forces even long-term holders — people who haven’t touched their coins in years — to reconsider whether their setup is actually safe.

Surge in Movement of Long-Dormant Bitcoin

The 500 BTC transfer wasn’t an isolated event. On-chain data points to a broader wave of old coins moving at the same time the Coldcard story was unfolding.

Data on Dormant Coin Movements

According to CryptoQuant’s spent output age bands, which track how long coins sit still before moving, the numbers spiked sharply. Coins dormant for 10 years or longer saw roughly 935 BTC move on August 3 — the largest single-day total in that age bracket since March 20. Separately, coins that had been dormant for five to seven years saw about 6,388 BTC move on July 31. Both figures sit well outside the normal pattern for long-held bitcoin.

Possible Motivations Behind Coin Activity

Old coins move for plenty of reasons unrelated to any single hack — estate transfers, exchange consolidations, or custodial migrations all happen regularly and have nothing to do with a security scare. Lookonchain, though, flagged a specific link in the case of the 18TExP wallet, noting on X that following the Coldcard hack, the owner may have relocated the funds to a new wallet as a security precaution. That’s a hypothesis, not a confirmed motive, but the clustering of large, long-dormant transfers immediately after the breach became public gives the pattern real weight.

This is the part that matters most for anyone thinking about bitcoin wallet security right now: even holders who haven’t touched their coins in a decade are apparently watching the news closely enough to act. When a hardware flaw threatens the fundamentals of self-custody, dormant capital doesn’t stay dormant for long — it moves, and it moves fast.

FAQ

Why did the 18TExP bitcoin wallet move 500 BTC after 12 years?

Lookonchain suggests the wallet owner moved the funds due to security concerns following the Coldcard hardware wallet hack, though this remains an inference rather than a confirmed reason.

What is the Coldcard hardware wallet vulnerability?

Coldcard hardware wallets have a security flaw dating back to March 2021, which attackers have exploited to steal about $130 million in BTC since July 30, 2026, according to researchers at Galaxy.

Have other long-dormant bitcoin wallets moved coins recently?

Yes. On August 3, 2026, 935 BTC that had been dormant for 10 or more years moved, and on July 31, 2026, 6,388 BTC dormant for five to seven years moved — both unusually large shifts in long-held coins.

Does all dormant coin movement relate to the Coldcard hack?

Not necessarily. Old coins can move for reasons like estate transfers or custodial changes that have nothing to do with any single security incident. But the timing and scale of these movements right after the Coldcard breach suggest at least some holders were acting proactively to protect their funds.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.