The firm said only about 10% of the revived supply reached exchanges, framing the three-day scramble after the July 31 hack as defensive wallet rotation rather than selling.
A roughly 594 BTC Coldcard hardware-wallet theft on July 31 set off what Glassnode called one of the clearest natural experiments in Bitcoin holder behavior this cycle, with about 119,000 BTC of dormant coins moving over the following three days. In its Week 31 report, the on-chain analytics firm said the reaction was about 200 times larger than the amount stolen, as holders rushed to move funds off potentially compromised wallets after an attacker exploited a roughly five-year-old key-generation flaw and drained some 500 self-custodied wallets in around 25 minutes. Glassnode said the pattern looked defensive rather than bearish. Its Revived Supply 1y+ metric (coins moving after at least a year dormant) showed the spike, but only about 10% of those coins remained on exchanges, while new-address creation returned to baseline within three days and Bitcoin held in wallets less than a month old had climbed 40% since the event and was still rising when the report was published. The firm described that as a shift into fresh cold storage (offline crypto custody) rather than liquidation, adding that the spot market "barely registered the event." Glassnode placed the episode within a broader market backdrop of flat Bitcoin trading, June outflows of roughly 65,800 BTC from US spot Bitcoin ETFs, record-low upside implied volatility (options-based expected future swings) near 23%, and what it called bottoming conditions that are "assembling but incomplete" and forming "through boredom, not capitulation."