NEW YORK, August 4, 2026, 10:12 EDT
- Bitcoin’s round-the-clock market remained open, with BTC near $63,700. Reported 24-hour volume stood at $25.9 billion.
- Sub-1 BTC transfers reached 39,600 BTC, or 24.8 times the preliminary 1,596-BTC theft tally.
- A separate 16,400-BTC move reached a new unlabeled wallet, not a known exchange.
Bitcoin held near $63,700 on Tuesday. Sub-1 BTC transfers reached 39,600 BTC during the Coldcard security shock. That was almost 25 times the preliminary theft tally.
That gap matters for investors. It points to a broader security response than attributed losses alone. It does not mean 39,600 BTC was sold.
Much of the reported movement involved fresh self-custody wallets. A separate $1.04 billion whale transfer also avoided known exchange addresses. The destination data favor custody migration over broad liquidation.
Gross blockchain movement is not sell supply. A transfer can reflect theft, key rotation, custody consolidation or an OTC settlement. Exchange deposits remain the cleaner near-term test of sale intent.
CryptoQuant research head Julio Moreno reported the 39,600-BTC figure for July 31. Daily active addresses rose from 645,000 to almost one million. Neither measure proves why individual owners moved funds.
Network response versus attributed theft
| Measure | Latest reading | Comparison | Investor read |
|---|---|---|---|
| Transfers below 1 BTC | 39,600 BTC | 24.8× high-confidence theft tally | Activity extended beyond attributed losses |
| Daily active addresses | Almost 1 million | Above 645,000 one day earlier | Network use rose by more than 50% |
| High-confidence theft estimate | 1,596 BTC; about 7,300 addresses | Three waves and 14 smaller incidents | Preliminary attributed loss |
| Suspected upper estimate | 2,000 BTC; about $130 million | Includes unconfirmed cases | Preliminary upper case |
The 24.8-times gap is the central investor angle. It suggests defensive repositioning reached beyond coins already linked to attackers. Still, the measures cover different periods and populations.
The sub-1 BTC bucket also measures transaction size, not unique owners. Repeated transfers and unrelated activity may be included. The ratio is a stress gauge, not a victim count.
Old-coin activity splits into several populations. The exploit itself moved aged coins. Unaffected holders may also have reviewed their custody, while routine estate and OTC transfers remain possible.
Dormant-supply comparison — events and age bands may overlap
| Movement | Bitcoin moved | Prior inactivity | Scale and reported destination |
|---|---|---|---|
| Wallet 18TExP | 500 BTC | 12.7 years | $31.3 million; sent to a new wallet |
| Ten-year-plus age band | 935 BTC | At least 10 years | Largest daily total since March 20 |
| Five-to-seven-year age band | 6,388 BTC | Five to seven years | 6.8× the oldest cohort’s total |
| Large whale wallet | 16,400 BTC | Seven months | $1.04 billion; fresh address with no known exchange link |
The 16,400-BTC transfer carried the largest headline value. Its route mattered more. A new unlabeled address weakens the immediate sale case, but does not exclude later exchange deposits.
Price action supports that cautious reading. Bitcoin was about 1.4% above the level reported around the whale transfer. Its intraday trading range remained roughly 1.5% wide.
Market absorption comparison — scale, not liquidity equivalence
| Indicator | Reading | Comparison |
|---|---|---|
| Bitcoin price at 10:12 EDT | $63,657 | About 1.4% above $62,808 transfer-time price |
| Intraday range | $63,143–$64,117 | Roughly 1.5% from low to high |
| Reported 24-hour volume | $25.93 billion | Broad market turnover |
| Current 16,400-BTC notional | About $1.04 billion | Roughly 4.0% of reported volume |
| Reported destination | Fresh unlabeled wallet | No known exchange route identified |
Bitcoin’s resilience is informative but limited. It shows the transfers have not produced enough visible selling to break the range. It does not establish that every migrated balance remains inactive.
Coinkite said a 2021 integration routed seed generation through a MicroPython fallback. The intended hardware random-number generator did not contribute as designed. Preliminary search-space estimates are about 40 bits for Mk2 and Mk3, and 72 bits for later models. The intended target was 128 bits.
Fixed firmware protects newly generated seeds only. It cannot repair seeds created by affected firmware. Those users must create a new seed and migrate their funds.
Galaxy Digital NASDAQ:GLXY research head Alex Thorn wrote, “High confidence 1,596 BTC has been stolen.” He linked the estimate to about 7,300 addresses. The suspected 2,000-BTC total remains unconfirmed. Galaxy
Coinkite co-founder and CEO Rodolfo Novak wrote, “I’m sorry and I’m devastated.” The company destroyed remaining inventory carrying vulnerable firmware and halted shipments. It said the threat remained ongoing. CoinDesk
Risks: Address labels can be incomplete, while theft estimates remain preliminary. Old-wallet transfers may reflect estates, custody changes or private deals. Fresh wallets could later route coins to exchanges, creating potential sell pressure.
Investors should now watch exchange inflows from new wallets and known attacker addresses. Until those routes change, the evidence favors custody migration over broad liquidation. Price has absorbed the security shock so far.
Related articles: NASDAQ:GLXY
