The 90-day moving average of spent outputs from the cohort has reached about 1,500 $BTC, twice the level recorded in May, according to Darkfost. A moving average smooths daily changes, making it less sensitive to isolated transfers from a few large wallets.
At 1,500 $BTC, the current average is also about 56% above the 962 $BTC reported on June 24. At the time, the reading had fallen below 1,000 $BTC for the first time since November 2024, indicating that activity from older holders had slowed to its lowest point in nearly two years.
As previously reported by crypto.news, earlier peaks appeared in May 2024, February 2025, and September 2025. Daily movements during those periods exceeded 10,000 $BTC, 30,000 $BTC, and, in one case, 142,000 $BTC.
Darkfost linked the latest increase to unease created by Bitcoin’s consolidation. Even investors who have held through several market cycles appear more active, the analyst said, although the data cannot identify the reason behind each transaction.
Bitcoin traded near $79,600 at the time of writing, down about 1.8% over 24 hours after moving between an intraday low of $78,723 and a high of $81,370. The price has struggled to establish a lasting move above $80,000 following several sharp swings around the level.
Spent UTXOs do not prove Bitcoin was sold
A spent UTXO records Bitcoin that has been used as an input in a new transaction. Because Bitcoin’s ledger tracks transaction outputs rather than account balances, an output becomes “spent” whenever its owner moves the coins to another address.
Movement alone does not identify the purpose of a transaction. An investor can send $BTC to an exchange for a possible sale, transfer it to a new custodian, consolidate several outputs, divide a balance across wallets or replace an old security setup.
Darkfost cautioned against treating the 1,500 $BTC average as confirmed selling. Some of the transactions may represent holders moving their coins to safer storage after the Coldcard security incident rather than exiting their positions.
Destination data provides more useful evidence when an old wallet sends coins to a labeled exchange or trading firm. Even then, an exchange deposit shows that the Bitcoin became available for trading; it does not establish that the owner completed a sale.
Recent dormant-wallet transfers illustrate the limitation. During a 10-day period in August, six wallets that had remained inactive for almost 12 to more than 15 years moved 553.59 $BTC worth $40.15 million.
Five transfers went to addresses with no identified exchange connection. One wallet sent 40 $BTC to an address labeled Boerse Stuttgart Digital, which provides custody and trading infrastructure. Neither the unlabeled destinations nor the custody provider established whether the owners sold, changed custodians, or reorganized their holdings.
Another 28 dormant wallets moved 1,314.41 $BTC on Aug. 20, including more than 1,200 $BTC from addresses created in 2014. Blockchain records documented the transfers but did not reveal the owners’ intentions.
Coldcard incident complicates onchain readings
The Coldcard incident created an unusual source of Bitcoin activity after a firmware flaw exposed seed phrases generated by affected hardware wallet models. Owners were advised to create new seeds and transfer their holdings because installing corrected firmware could not repair credentials produced by vulnerable software.
In early August, K33 Research found that nearly 890,000 $BTC had moved over seven days, the highest seven-day active supply recorded in 2026. The surge occurred while Bitcoin was trading within one of its narrowest 30-day ranges since 2023, separating the rise in network activity from a major price breakout.
Researchers linked the activity partly to Coldcard users migrating funds and attackers draining vulnerable wallets. Galaxy Research had confirmed the theft of 1,596 $BTC from about 7,300 addresses across three attack waves by Aug. 5.
Galaxy estimated that losses could reach approximately 2,055 $BTC, then worth close to $130 million, if a suspected fourth wave was confirmed. Around 90% of the stolen Bitcoin had not moved after the initial attacks at that stage, according to the research firm.
Transfers made for seed migration still consume old UTXOs, so they can raise spending metrics even when the owner keeps control of the coins. The effect can reach age-based cohorts if affected wallets contain Bitcoin that has remained untouched for five years or longer.
Wallet consolidation can produce a similar result. Combining several old outputs into one new output records the original UTXOs as spent without changing the owner’s total balance, apart from the network fee.
U.S. investors can hold Bitcoin without managing seeds
For U.S. investors, the Coldcard incident has renewed attention on the custody differences between directly held Bitcoin and shares of a spot Bitcoin exchange-traded fund. Direct holders control spendable $BTC but remain responsible for seed creation, backups, firmware updates, and wallet migration.
ETF investors do not manage private keys because the fund and its service providers handle custody. Bloomberg Intelligence senior ETF analyst Eric Balchunas argued in August that the Coldcard losses strengthened the case for ETFs among investors who only want exposure to Bitcoin’s price.
An earlier report on the U.S. custody debate noted that no verified flow data had tied ETF demand directly to the incident. Investor responses could also include multisignature wallets, new hardware devices, institutional custodians, or the division of funds across several storage methods.
BlackRock’s iShares Bitcoin Trust uses Coinbase Custody to hold its Bitcoin in segregated cold-storage wallets, according to the fund’s SEC filing. The trust may also use Anchorage Digital Bank as an additional custodian.
ETF ownership transfers personal seed risk to fund operators, custodians, and other service providers. BlackRock’s filing warns that hacking, employee misconduct, technical failures and unauthorized transfers could still cause losses, while available insurance may not cover every event.
Unlike direct holders, retail ETF shareholders cannot withdraw the underlying Bitcoin to a personal wallet or use it for onchain payments. Fund shares trade during U.S. market hours, while Bitcoin transactions remain available around the clock.
