A significant surge in dormant Bitcoin movement occurred throughout August, with 6,427.59 BTC worth $507 million transferred across 188 spends between August 1-30. The activity represents a dramatic increase compared to July and follows several wallet security incidents.
The wave of transfers coincided with security concerns in the cryptocurrency hardware wallet space. In late July, a Coldcard firmware exploit resulted in losses reaching approximately 2,000 BTC. Additionally, two hardware wallet manufacturers—Safepal and Trezor—disclosed data breaches exposing customer information including names, email addresses, phone numbers, and shipping addresses.
Significant Increase in Movement Compared to July
August's dormant coin activity substantially exceeded July's levels. The month averaged 214.25 BTC moved per day, compared to July's average of 40.78 BTC per day—representing a 5.3x increase. In contrast, July saw only 30 spends with wallets created between 2010 and 2017, moving a total of 1,264.16 BTC.
Early Cohorts Show Highest Activity
Wallets created in 2014 accounted for the largest share of August's movement. Data showed 94 transfers from 2014-origin addresses moved approximately 3,286.26 BTC. The 2016 cohort ranked second with 985.38 BTC across 29 movements, while 2013 wallets recorded 16 transfers totaling 845.48 BTC.
Older Bitcoin addresses also showed activity. Eight transfers originated from wallets created in 2010 or 2011, with 2010 transfers moving 50 BTC total and six 2011 movements transferring 155.57 BTC.
Two Distinct 2014 Patterns Emerge
The 2014 cohort's 3,286.26 BTC movement divided into two notably different clusters. The first cluster comprised 64 addresses created between January 27 and February 4, 2014, moving 1,672 BTC across 11 separate days between August 3-13, with individual transfers ranging from 0.31 BTC to 33 BTC.
The second cluster showed different characteristics. Twenty-five addresses created between November 30 and December 26, 2014, moved 1,514 BTC in nearly uniform lots of approximately 50 BTC. Notably, 22 of these 25 addresses executed transfers on August 19 within approximately one hour, suggesting coordinated activity rather than independent actions.
The coordinated timing of the second cluster's transfers indicates activity potentially executed by a single custodian or key holder rather than multiple independent holders moving decade-old coins simultaneously. Possible explanations for such coordinated movement include an exchange cold-storage reorganization, an escrow release, or a bulk paper-wallet distribution.
