A 12-Year Dormant Bitcoin “Ancient Whale” Makes an Emergency Move: Risk Avoidance or Being Hunted?

On August 4, 2026, late at night Beijing time, a strange ripple suddenly appeared beneath the surface of the crypto market.

A Bitcoin address that had remained completely dormant since 2013 — 18TExP — suddenly became active. 500 BTC (worth approximately $31.3 million) were transferred the moment the transaction was confirmed on-chain. This wallet had been asleep for a staggering 12 years and 8 months, making it even older than the birth of Ethereum.

500 BTC Transferred from the 18TExP Address (Source: CoinDesk)

Just as people began speculating whether this was the reappearance of Satoshi Nakamoto himself, another far more chilling backdrop emerged: Coldcard, known as the “fortress” of Bitcoin hardware wallets, had just been exposed with a critical security vulnerability, resulting in hundreds of millions of dollars worth of BTC being stolen.

The discovery process of this vulnerability further demonstrated both the power and the threat of AI. After the Coldcard team released a security advisory in late July, someone submitted the source code to Claude Code, an AI coding model, for review. The AI identified the exact line of code responsible for the randomness failure in just eight minutes.

The revival of an ancient Bitcoin whale and the fatal Coldcard wallet vulnerability happened at the same time. Was this merely a coincidental “migration” of old coins, or a precision hunt targeting dormant whale wallets？

Today, we will cut through the speculation and explain, in plain language, the technological battle behind this major crypto security incident.

In the eyes of crypto security enthusiasts, Coldcard has long been synonymous with “extreme security.” Its biggest selling point is “generating private keys completely offline.” In theory, as long as the device never connects to the internet, even the most sophisticated attackers cannot steal your coins.

But this time, hackers did not attack your computer. They simply “guessed” your private key.

What exactly is a private key？ At its core, it is an extremely large random number. Generating a private key is like shuffling a deck of cards — the more random the shuffle, the harder it is for anyone else to predict the outcome.

The mistake Coldcard made was one of the most classic programming failures: insufficient entropy in a pseudo-random number generator (PRNG).

• In a firmware update released in March 2021, the Coldcard team introduced a bug.
• As a result, certain models (such as Mk2 and Mk3) generated private keys with only around 40 bits of randomness.

The numbers show how serious this was:

Bitcoins private keys are designed with a security level of 128 bits. A brute-force attack against a properly generated private key would require trying approximately 2¹²⁸ combinations — a number larger than the estimated number of atoms in the observable universe.

However, when entropy drops to just 40 bits, the number of possible combinations shrinks dramatically to around 1 trillion (2⁴⁰).

Does 1 trillion still sound like a huge number？

For an ordinary computer, it is indeed an astronomical challenge. But for a well-funded hacking group with powerful computing resources or specialized GPU clusters, cracking those 1 trillion possibilities could take only days or even hours.

It is like changing your safe password from an 8-digit code to a 4-digit code — to a professional attacker, that safe is practically meaningless.

Over the past few years, amid repeated exchange collapses, withdrawals being frozen, and platforms disappearing with user funds, the principle of “never keep your coins on exchanges” has become a widely accepted rule in the crypto industry.

More and more long-term Bitcoin holders have chosen:

• Hardware wallets
• Cold wallets
• Multi-signature wallets

These solutions have long been considered among the safest methods for protecting BTC.

However, the Coldcard security incident once again reminded the market of an important reality:

A cold wallet is not absolutely secure. True asset protection depends not on the device itself, but on an entire security system covering random generation, private key management, and backup mechanisms.

How Does Hardware Wallet Security Actually Work？

A hardware wallet such as Coldcard by Coinkite is essentially an offline private key generation and transaction signing device.

The normal process is:

Device generates random numbers → Creates 12/24-word seed phrase → Seed phrase generates private keys → Private keys control BTC addresses → User stores the seed phrase offline

In theory, brute-force attacks are almost impossible. Even if the physical device is lost, as long as the seed phrase remains secure, the assets remain protected.

That is why many long-term Bitcoin holders rely on hardware wallets.

However, this vulnerability was not caused by:

• Hackers breaking into Coldcard devices;
• Remote control of wallets;
• Users leaking their seed phrases.

Instead, the issue was that some Coldcard versions failed to use a sufficiently strong source of randomness when generating seed phrases.

As mentioned earlier, attackers only needed to calculate the limited number of possible seed phrases, derive private keys, identify the corresponding BTC addresses, and transfer the funds.

They did not need physical access to the users device.

According to currently available public data:

• The first wave of attacks resulted in approximately 1,196 addresses being compromised, with around 1,082 BTC stolen.
• Subsequent attack waves expanded the losses significantly.
• According to tracking by institutions such as Galaxy Research, by early August:
• Confirmed losses exceeded $130 million;
• More than 7,300 wallets were affected;
• At least 15 independent hacker groups were reportedly exploiting the vulnerability to “fish” for vulnerable wallets.

This incident marks a turning point: in the era of AI-assisted hacking, even hardware wallets — once considered the ultimate line of defense — must continuously evolve their security models.

BTC Address Balance Overview (Source: Blockchair)

The biggest significance of the Coldcard incident is not that it proves “cold wallets are unsafe.” Rather, it serves as a reminder that crypto asset security is entering a new era — moving from simply “storing private keys” to “managing risks.”

The main reason was the timing.

The transfer occurred shortly after the Coldcard vulnerability was exposed. As a result, many users began reviewing the security of their cold wallets. This led to speculation: Did this ancient Bitcoin wallet move its assets early because the owner became concerned about security risks？

However, there is currently no evidence proving that the two events are connected.

The reason is simple: Coldcard did not exist in 2013, meaning this address could not have originally been generated by a Coldcard device.

A more reasonable explanation is that the whale took proactive defensive measures after concerns triggered by the Coldcard vulnerability:

• Moving funds to a new wallet;
• Upgrading security solutions;
• Reorganizing asset management strategies.

Of course, another possibility is that the long-term holder simply sold the BTC or conducted an OTC transaction. For early miners and investors, 500 BTC was not an unusual amount of holdings.

This is not an isolated case.

Data shows that after the Coldcard vulnerability was revealed, the activity of Bitcoin addresses containing coins dormant for 7–10 years surged across the network.

Behind the scenes, a silent “great migration” of ancient coins appears to be taking place — as long-term holders reassess their security strategies and move their assets.

Number of Long-Term Bitcoin Holders (Source: CoinGlass)

The Coldcard vulnerability incident reveals a very important lesson:

There is no such thing as absolute security when it comes to asset protection.

In the past, we only asked: “Should I store my coins on an exchange or in a cold wallet？”

Today, the question needs to evolve into:

“How do I build a complete asset security system？”

Because any link in the security chain can fail — including:

• Firmware;
• Random number generation;
• Supply chain security;
• Backup practices;
• Usage environment.

A single weak point can compromise the entire system.

For ordinary users, one hardware wallet may be sufficient. However, large BTC holdings should not rely on a single point of security.

The single-wallet model is becoming increasingly risky. A more mature approach is to establish multiple layers of protection:

• Hardware wallet as the first layer;
• Independent backups as the second layer;
• Multi-signature wallets as the third layer;
• Asset diversification as the fourth layer.

For example, instead of:

1 wallet + 1,000 BTC + 1 seed phrase

a safer approach would be:

10 wallets + 1,000 BTC + 10 independent seed phrases.

For large-scale holdings, consider using multi-signature solutions.

For example, with a 2-of-3 multisig setup:

• One device is stored at home;
• One device is kept in a bank safety deposit box;
• One device is held by a trusted family member.

At least two signatures are required to authorize a transaction.

This means that even if one device is compromised, the assets remain protected.

Finally, if you or someone you know is currently using Coldcard, or any hardware wallet, remember this:

Migration is more important than upgrading.

Simply updating Coldcard firmware cannot repair private keys that were already generated under vulnerable conditions.

You must:

• Transfer your assets immediately to newly generated addresses;
• Ensure those new addresses are created using firmware versions that have fixed the vulnerability.

Check your device model.

The main Coldcard models reportedly affected include:

• Coldcard Mk2
• Coldcard Mk3
• Coldcard Mk4
• Coldcard Q

If you are using one of these models and the wallet was created between 2021 and 2023, it should be considered potentially exposed to risk.

If you hold wallets created around 2013–2016, even if they are not Coldcard wallets, this “ancient whale migration” event should serve as a warning.

Older address formats and outdated key-generation methods will always be attractive targets for attackers.

Proactive migration is a responsibility you owe to your own wealth.

The Coldcard incident does not invalidate the value of hardware wallets.

On the contrary, it demonstrates that:

Hardware wallets remain one of the most important tools for protecting Bitcoin today — but no security tool is completely invulnerable.

If you are unsure whether the wallet or exchange platform you are using carries security risks, you can use third-party compliance and risk assessment platforms such as WikiBit as an additional reference.

However, any third-party tool is only a supporting resource.

The ultimate security defense will always depend on your own private key management system.



Wallet Risk Rankings (Source: WikiBit)

Regardless of whether you use an exchange, a software wallet, or a hardware wallet, the first principle of crypto asset security is:

Never put all your assets at risk on a single platform, a single device, or a single key management system.

Diversifying risks is far more important than searching for so-called “absolute security.”

Conclusion

The awakening of “18TExP” may have simply been a routine move by an early Bitcoin whale. The Coldcard vulnerability may have been just another technical challenge along the path of technological evolution.

But when these two events happened together, they revealed a harsh reality:

In the crypto world, a sense of security is a luxury.

Hardware wallets are not the final destination. Even code itself is not absolutely secure.

True security comes from respecting the underlying principles of technology and maintaining constant vigilance.

That wallet remained dormant for 12 years — not because it was perfectly secure, but because it had never been discovered.

The moment it awakened, the real danger may have only just begun.