Bitcoin holders who have kept their coins dormant for more than five years have doubled their spending activity since May, although blockchain data does not show whether the moves represent selling.
The 90-day average of spent outputs from the group has risen to about 1,500 BTC, according to CryptoQuant analyst Darkfost. The figure is twice the level recorded in May, while Bitcoin continues to trade within a relatively narrow price range.
The cohort is made up of investors whose Bitcoin had remained untouched for more than five years before being moved onchain. A 90-day moving average smooths out daily fluctuations, reducing the impact of individual transactions by a small number of large wallets.
The latest reading is also about 56% higher than the 962 BTC recorded on 24 June. That figure had fallen below 1,000 BTC for the first time since November 2024, suggesting activity among long-term holders had reached its lowest point in almost two years.
Earlier increases were recorded in May 2024, February 2025 and September 2025. Daily movements during those periods exceeded 10,000 BTC, 30,000 BTC and, on one occasion, 142,000 BTC.
Darkfost associated the latest rise with uncertainty created by Bitcoin’s prolonged consolidation. Even investors who have held through several market cycles appear to be moving more coins, the analyst said, although the data cannot establish why each transaction took place.
Bitcoin was trading at about $79,600 when the analysis was published, down approximately 1.8% over 24 hours. It had moved between an intraday low of $78,723 and a high of $81,370, while struggling to sustain a break above $80,000 after several sharp swings around that level.
Coin movements do not confirm selling
A spent unspent transaction output, or UTXO, is Bitcoin that has been used as an input in a new transaction. Because the Bitcoin ledger records transaction outputs rather than account balances, an output is marked as spent whenever its owner transfers the coins to another address.
That movement alone does not reveal what the owner intended to do. Bitcoin can be sent to an exchange ahead of a possible sale, transferred to a new custodian, combined with other outputs, divided between several wallets or moved as part of a change to security arrangements.
Darkfost therefore warned against interpreting the 1,500 BTC average as proof of selling. Some of the activity may reflect investors transferring holdings into safer storage following the Coldcard security incident rather than leaving the market.
Destination addresses can provide additional evidence, particularly when coins from an old wallet are sent to a known exchange or trading company. Even then, a deposit only shows that the Bitcoin became available for trading. It does not prove that the owner completed a sale.
The limits of the data were highlighted by several recent transfers. Over a 10-day period in August, six wallets that had been inactive for between almost 12 and more than 15 years moved a combined 553.59 BTC, worth $40.15m.
Five transfers went to addresses with no identified exchange connection. One wallet sent 40 BTC to an address labelled Boerse Stuttgart Digital, which provides custody and trading infrastructure. The transactions did not establish whether the owners sold their Bitcoin, changed custodians or simply reorganised their holdings.
A further 28 dormant wallets transferred 1,314.41 BTC on 20 August, including more than 1,200 BTC from addresses created in 2014. Blockchain records showed that the movements happened but offered no indication of the owners’ intentions.
Coldcard incident adds to uncertainty
The Coldcard incident created an unusual source of Bitcoin activity after a firmware flaw exposed seed phrases generated by affected hardware-wallet models. Users were advised to create new seeds and move their holdings because installing updated firmware could not repair credentials created by the vulnerable software.
K33 Research reported in early August that almost 890,000 BTC had moved over seven days. It was the highest seven-day active supply recorded in 2026. The increase came while Bitcoin was trading within one of its narrowest 30-day ranges since 2023, meaning the rise in network activity was not linked to a major price breakout.
Researchers said the activity was partly explained by Coldcard users migrating their funds and by attackers draining vulnerable wallets. Galaxy Research confirmed the theft of 1,596 BTC from about 7,300 addresses across three attack waves by 5 August.
Galaxy estimated that losses could reach roughly 2,055 BTC, worth close to $130m at the time, if a suspected fourth wave was confirmed. About 90% of the stolen Bitcoin had not moved after the initial attacks, according to the research firm.
Seed migration transactions still consume old UTXOs, meaning they can increase spending statistics even when the owner retains control of the coins. This can affect age-based groups if the wallets involved contain Bitcoin that had remained untouched for at least five years.
Consolidating wallets can have a similar effect. Combining multiple old outputs into a single new output records the original UTXOs as spent, although the owner’s overall balance remains unchanged apart from the network fee.
ETFs offer an alternative to managing private keys
The Coldcard incident has also renewed debate in the United States about the difference between holding Bitcoin directly and owning shares in a spot Bitcoin exchange-traded fund.
Direct holders control spendable Bitcoin but are responsible for creating and backing up seed phrases, updating firmware and moving funds when a wallet migration is required. ETF investors do not manage private keys because custody is handled by the fund and its service providers.
Bloomberg Intelligence senior ETF analyst Eric Balchunas argued in August that the Coldcard losses strengthened the case for ETFs among investors seeking exposure only to Bitcoin’s price.
However, no verified flow data has directly connected demand for ETFs with the Coldcard incident. Investors may also respond by using multisignature wallets, new hardware devices, institutional custodians or several different storage methods.
BlackRock’s iShares Bitcoin Trust uses Coinbase Custody to hold its Bitcoin in segregated cold-storage wallets, according to the fund’s filing with the Securities and Exchange Commission. The trust may also use Anchorage Digital Bank as an additional custodian.
ETF ownership transfers personal seed-phrase risk to fund operators, custodians and other service providers. BlackRock’s filing warns that hacking, employee misconduct, technical failures and unauthorised transfers could still cause losses, while available insurance may not cover every incident.
Unlike direct Bitcoin holders, retail ETF shareholders cannot withdraw the underlying Bitcoin to a personal wallet or use it for onchain payments. ETF shares trade during U.S. market hours, whereas Bitcoin transactions remain available around the clock.
