Key Takeaways
- • Bitcoin micro holders are exiting at the fastest pace since December 2024, with approximately 245,000 wallets disappearing in a concentrated timeframe as the asset has declined roughly 10% on the day and more than 20% year-to-date.
- • On July 31, 2026, nearly 1 million Bitcoin active addresses moved in a single day—the highest reading since December 10, 2024—driven primarily by the Coldcard hardware wallet security breach rather than new demand, with BTC trading at $60,347 versus $100,000 during the prior peak.
- • Small holders (retail wallets under 1 BTC) transferred 39,600 BTC on July 31, matching the largest daily outflow since the FTX collapse in November 2022, indicating panic liquidation among Coldcard's user base following confirmed theft of 1,367 BTC ($88.6 million) across 4,585 addresses.
- • On-chain consolidation patterns show sending addresses driving nearly all activity growth while receiving addresses remained flat, suggesting thousands of wallets emptied toward a smaller set of destinations rather than organic market participation.
- • Bitcoin has erased all 2025 gains and shed approximately $800 billion from its October 2025 peak, with analysts estimating 2.3 to 4 million BTC (11–18% of the 21 million supply cap) are permanently lost.
Summary
Bitcoin holders, particularly micro-holders, are exiting positions at the fastest pace observed since December 2024, according to on-chain data tracking wallet activity. The acceleration coincides with a sharp sell-off in crypto markets, with Bitcoin declining roughly 10% in a single day and more than 20% year-to-date. The asset has fallen from its October 2025 peak near $100,000 to recent lows near $60,000, erasing all gains accumulated during 2025 and shedding approximately $800 billion in market value.
The most notable on-chain event occurred on July 31, 2026, when nearly 1 million Bitcoin daily active addresses moved—the highest concentration since December 10, 2024. However, this spike was driven not by fresh demand but by the Coldcard hardware wallet security breach. Glassnode data showed active addresses surged from 645,000 on July 30 to approximately 980,000 on July 31, representing a 50% single-day jump. Critically, CryptoQuant research revealed that sending addresses accounted for nearly all growth while receiving addresses remained relatively static, indicating consolidation rather than distributed ownership expansion. According to CryptoQuant Head of Research Julio Moreno, thousands of wallets emptied toward a much smaller set of destinations.
The Coldcard breach exposed a critical vulnerability in self-custody infrastructure. Attackers exploited a flawed random number generator to drain hardware wallets across multiple waves. Three confirmed attack waves resulted in theft of 1,367 BTC worth $88.6 million from 4,585 addresses, with a suspected fourth wave claiming an additional 380 BTC. Retail-sized wallets, which comprise Coldcard's typical user base, bore the brunt of losses. On July 31, transfers below 1 BTC totaled 39,600 BTC—a metric matching the daily outflow recorded on November 16, 2022, immediately following the FTX collapse. One holder lost 18.25 BTC (worth $1.6 million) in under seven minutes.
Historically, Bitcoin active addresses had fluctuated between 550,000 and 750,000 throughout most of 2026, making the July 31 spike a clear outlier driven by distress liquidation rather than organic market participation. The convergence of macro weakness—falling prices, erased annual gains, and heightened volatility—with infrastructure-specific shocks demonstrates the compounding effect of security events during drawdown periods. Analysts estimate 2.3 to 4 million BTC (representing 11–18% of Bitcoin's 21 million supply cap) are permanently lost, further constraining effective circulating supply.
The most notable on-chain event occurred on July 31, 2026, when nearly 1 million Bitcoin daily active addresses moved—the highest concentration since December 10, 2024. However, this spike was driven not by fresh demand but by the Coldcard hardware wallet security breach. Glassnode data showed active addresses surged from 645,000 on July 30 to approximately 980,000 on July 31, representing a 50% single-day jump. Critically, CryptoQuant research revealed that sending addresses accounted for nearly all growth while receiving addresses remained relatively static, indicating consolidation rather than distributed ownership expansion. According to CryptoQuant Head of Research Julio Moreno, thousands of wallets emptied toward a much smaller set of destinations.
The Coldcard breach exposed a critical vulnerability in self-custody infrastructure. Attackers exploited a flawed random number generator to drain hardware wallets across multiple waves. Three confirmed attack waves resulted in theft of 1,367 BTC worth $88.6 million from 4,585 addresses, with a suspected fourth wave claiming an additional 380 BTC. Retail-sized wallets, which comprise Coldcard's typical user base, bore the brunt of losses. On July 31, transfers below 1 BTC totaled 39,600 BTC—a metric matching the daily outflow recorded on November 16, 2022, immediately following the FTX collapse. One holder lost 18.25 BTC (worth $1.6 million) in under seven minutes.
Historically, Bitcoin active addresses had fluctuated between 550,000 and 750,000 throughout most of 2026, making the July 31 spike a clear outlier driven by distress liquidation rather than organic market participation. The convergence of macro weakness—falling prices, erased annual gains, and heightened volatility—with infrastructure-specific shocks demonstrates the compounding effect of security events during drawdown periods. Analysts estimate 2.3 to 4 million BTC (representing 11–18% of Bitcoin's 21 million supply cap) are permanently lost, further constraining effective circulating supply.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.