Dormant Bitcoin OGs Move 1,500 BTC During Consolidation

Dormant Bitcoin wallets awaken

The 90-day moving average of spent outputs (STXO) from Bitcoin addresses that had been untouched for more than five years has risen to roughly 1,500 BTC, according to on-chain analysis. That reading marks a doubling of activity since May and signals renewed movement among long-dormant holders — often called "OG" Bitcoin holders — as BTC price action consolidates around the $80,000 range.

On-chain specialists warn that spent UTXOs are a measurement of movement, not an automatic indication of selling. Transfers can reflect custodial migrations, security-driven seed rotations, wallet consolidations, or actual exchange deposits intended for trading. Still, the uptick in five-year-old coins moving on-chain is notable because it represents activity from coins that had been inactive across multiple market cycles.

Key on-chain metrics and historical context

Analysts tracking age-based cohorts show the 90-day moving average of STXOs for five-year-plus coins at about 1,500 BTC — roughly twice the level observed in May. That average is also about 56% higher than a 962 BTC reading recorded on June 24, when activity from older holders slowed to a near two-year low. Moving averages reduce the noise of single large transfers and provide a clearer view of sustained trends in wallet activity.

Past spikes and their scale

Previous large-scale movements by dormant wallets appeared during May 2024, February 2025 and September 2025. Those events included daily flows that, at times, exceeded 10,000 BTC, 30,000 BTC and, in one extreme case, around 142,000 BTC. Compared with those spikes, the present 90-day average suggests a steady reactivation rather than a single explosive wave.

Why spent UTXOs don’t always equal selling

A spent UTXO is simply an earlier transaction output that has now been used as an input for a new on-chain transaction. Because Bitcoin’s ledger records outputs rather than account balances, an output becomes "spent" whenever the coins move to a new address. That technical detail means movement can represent a range of actions:

• Deposits to a labeled exchange address (which increases the potential for selling but does not confirm it).
• Custodial transfers between wallets managed by the same entity.
• Security-driven seed migrations after hardware wallet vulnerabilities are disclosed.
• Wallet consolidation or reorganization to reduce UTXO fragmentation.
• Transfers to new cold storage or multisig setups.

Because on-chain data rarely ties directly to an owner's intent, researchers and market participants are careful not to treat all movement as liquidation. Destination labeling (e.g., recognized exchange addresses) strengthens the case for a potential sale, but even exchange deposits simply make BTC available for trading — they do not guarantee an executed sell order.

Coldcard vulnerability: a key driver of recent activity

One concrete catalyst for increased on-chain movement this year has been the Coldcard incident. A firmware flaw in certain hardware wallet models reportedly exposed seed phrases created by affected devices. Users were advised to generate new seeds and migrate funds because updating firmware would not retroactively secure seeds already produced by compromised software. This guidance triggered a wave of migrations from vulnerable addresses to new wallets or custodial providers.

Impact on network activity and losses

Researchers observed that early August produced one of the highest seven-day active supplies seen in 2026, with nearly 890,000 BTC moving within seven days. That surge occurred while Bitcoin's 30-day price range was unusually tight, which highlighted how security fixes and exploit activity can decouple on-chain volume from price-driven flows.

Reports from security teams documented real thefts related to the Coldcard vulnerability. By early August, Galaxy Research had attributed roughly 1,596 BTC in confirmed thefts across about 7,300 addresses, with a possibility of additional waves raising losses to an estimated 2,055 BTC. Those incidents — combined with legitimate migrations by cautious users — increased STXO counts and affected age-based metrics when long-dormant outputs were consumed during migrations.

Examples of recent dormant-wallet transfers

On several occasions in August, multiple wallets that had not transacted for a decade or longer began moving sizeable balances. In one 10-day window, six wallets inactive for roughly 12 to more than 15 years moved a total of 553.59 BTC (about $40.15 million at the time). Most transfers flowed to addresses with no exchange association, while one wallet sent 40 BTC to an address labeled as Boerse Stuttgart Digital, a custody and trading provider. The destinations left open multiple plausible explanations, from custody changes to strategic redeployments of long-stored capital.

Another notable day of reactivation saw 28 dormant wallets move 1,314.41 BTC, including more than 1,200 BTC from addresses created in 2014. Blockchain records confirm the existence and timing of such transfers, but they do not reveal whether the owners sold, re-custodied, or simply reorganized their holdings.

Consolidation, wallets, and the custody debate

Long-term holders who control their private keys assume responsibility for seed creation, backups, firmware maintenance and secure migrations. High-profile hardware wallet incidents renew debate over the trade-offs between self-custody and custodial products like spot Bitcoin exchange-traded funds (ETFs).

ETF custody as a lower-seed-risk option

Spot Bitcoin ETFs transfer the operational custody burden to fund operators and their service providers. For U.S. investors, this has become a persuasive argument: ETFs provide price exposure without requiring individuals to manage private keys or perform secure seed migrations. Bloomberg Intelligence analyst commentary has highlighted the Coldcard fallout as strengthening the case for ETF exposure among investors prioritizing simplicity and institutional custody standards.

ETF filings show major custodial arrangements. For example, BlackRock’s iShares Bitcoin Trust lists Coinbase Custody for segregated cold storage and may use Anchorage Digital Bank as an additional custodian. Still, custodial models carry their own risks — hacking, insider misconduct, technical failures or unauthorized transfers — and insurance coverage may be limited or incomplete.

ETF investors receive shares traded during U.S. market hours and cannot withdraw the underlying BTC to a personal wallet or use the coins directly for on-chain payments. That difference in usability is an important consideration for investors weighing custody models against self-custody strategies.

Market context: price action and what it means for on-chain flows

At the time of the latest readings, Bitcoin traded near $79,600, moving in a tight intraday band from about $78,723 to $81,370. The price's inability to sustain a move above $80,000 — combined with sharp intra-day swings — has coincided with rising movement from older cohorts. Analysts suggest that consolidation phases often encourage both opportunistic repositioning and precautionary migrations, particularly from holders who have endured multiple cycles.

Interpreting the 1,500 BTC figure

While the 1,500 BTC 90-day STXO average points to meaningful activity among five-year-old coins, it should be interpreted with nuance. The metric indicates increased transfers involving long-dormant UTXOs, but not necessarily coordinated or large-scale selling. Security migrations related to hardware wallet vulnerabilities, wallet consolidations, and custodial reassignments can all elevate STXO counts without changing long-term ownership or market supply available for immediate sale.

What traders and long-term holders should watch

Market participants tracking on-chain signals should combine age-cohort STXO data with destination labeling, exchange netflows, and known security events to build a fuller picture. Key indicators to monitor include:

• Exchange-labeled deposit spikes from old wallets (a stronger signal of potential liquidations).
• Concentrated transfers to known custodians versus transfers to unlabeled addresses.
• News of hardware wallet vulnerabilities or firmware advisories prompting seed migrations.
• ETF inflows and custody announcements that may shift investor preference away from self-custody.

Combining these signals helps investors and researchers distinguish between movement driven by security hygiene or consolidation and movement driven by intent to sell.

Conclusion

Activity among Bitcoin's oldest holders has clearly picked up: the five-year-plus cohort's 90-day spent-output average rose to roughly 1,500 BTC, double the May level and significantly higher than readings from late June. Yet the increase does not equate to definitive selling pressure. A mix of security-driven migrations (notably after the Coldcard vulnerability), custodial transfers, and wallet reorganizations can all push up STXO metrics.

For traders and institutional observers, the takeaway is to assess spent UTXO data in tandem with destination labeling, exchange flow metrics, and external events. That blended approach offers a clearer signal about whether long-dormant Bitcoin is being mobilized for market exits or simply being moved for safety and operational reasons.