Maketo research
What the chain shows about the Coldcard entropy week
In late July 2026 the maker of the Coldcard hardware wallet warned that a firmware bug had left some wallets guessable. Coins were stolen. Then, the next day, a great deal of very old bitcoin moved — far more than the theft can account for.
We measured that week on our own Bitcoin node. This page is what the chain itself records, separated carefully from what it cannot tell us. Every number below was measured by us and can be checked by anyone running a node; the method is at the bottom.
Measured 4 August 2026. All times UTC.
First, what a “coin day” is
One bitcoin sitting still for one day earns one coin day. Move ten bitcoin that last moved a hundred days ago and you destroy a thousand coin days. It is simply a way of asking: how much long-held money moved today?
It matters because it separates a busy day from a meaningful one. Coins bouncing between exchanges barely register. Coins waking up after years register loudly. On a normal day in 2026 the whole Bitcoin network destroys somewhere around 9 million coin days.
The order things happened
The sequence matters more than any single number, and two parts of it we confirmed directly against our own node.
- 30 July, 01:10–01:51. Coins were swept out of a large number of wallets inside a single 41-minute window, in blocks 960,183 to 960,191. We checked those blocks: the timestamps hold.
- 30 July, 22:50. The maker published its warning — about 21 hours after the sweep had already finished. Nobody moving coins that morning could have been acting on the advice.
- 31 July, all day. Old coins moved across all 157 blocks of the day, in a pattern we have not seen before. This is the day this page is mostly about.
Note what is not in that list: 30 July, the day most coverage names, was an ordinary day on-chain. It destroyed 11.5 million coin days and ranks 388th of the 946 days since January 2024. The theft is in there — it is just small enough to disappear into a normal day.
The big day was 31 July, and it was not a record
31 July destroyed 63.1 million coin days — about seven times a normal July day. That is a genuine spike, and it is worth reporting as one.
It is not, however, unprecedented. Ranked against every day since January 2024, it comes 16th out of 946. Five days were between two and eight times larger, including 28 May 2024 (518 million) and 4 July 2025 (420 million). Anyone describing the week as the largest old-coin movement in years is describing something the chain does not show.
The theft is far too small to explain it
This is the part that changes the story. Against the surrounding baseline, 31 July destroyed about 52.9 million coin days more than normal. So how much of that could a theft account for?
Take the most widely quoted figures — roughly 1,367 bitcoin taken, sitting on average 3.18 years. Multiply them out and you get about 1.6 million coin days: 3% of the excess. Use the highest published upper bound instead, and push every stolen coin to the oldest age the bug can physically produce, and you still only reach 4 million — 7.6%.
Run it the other way and the gap is starker. To move 52.9 million coin days you need roughly 48,000 bitcoin of three-year-old coins, or 29,000 bitcoin if they averaged five years. The theft is one to two orders of magnitude short. Whatever filled that day, it was mostly not the thief.
The day has a shape we have not seen before
Big old-coin days almost always have one owner behind them: a government selling seized coins, an exchange restructuring, an early holder cashing out. That leaves a fingerprint — the movement piles into a handful of blocks.
We scanned all 2,041 days since January 2021 and took the 40 biggest. On those days, the single busiest block carries between 12% and 96% of everything that moved.
On 31 July 2026 the busiest block carried 2.3%. The four busiest together carried 8.6%. The largest old-coin movement in nineteen months was spread almost perfectly evenly across the entire day — nearly five times flatter than the next most even day in five and a half years.
That is what thousands of unrelated people acting separately looks like. It is close to the opposite of what one actor looks like.
One thing we looked for and did not find
Emptying a wallet in one go leaves a distinctive trace: no change comes back, so the transaction has a single output. If 31 July were full of wallets being emptied, that share should have risen.
It did not. We read every one of the 610,733transactions in that day’s blocks. 63.6% had a single output — lower than the 76.3% on our comparison day. The reason is scale: even tens of thousands of people emptying wallets is a rounding error against 610,000 transactions. The signal drowns.
One aggregate difference did show up. The median fee rate on 31 July was about 2.0 sat/vB against 0.44 the week before — people paying more to get confirmed sooner. That is consistent with urgency, and on its own it proves nothing.
We report this because it explains why coin days is the right lens here and transaction counting is not. Counting transactions treats a hundred pounds and a life’s savings the same. Coin days weight by how much moved and how long it had been still — which is exactly the thing that changed.
How old the coins were — and where they stop
Sorting the extra movement by how long each coin had been sitting still gives the clearest picture on this page. Almost all of it — 99% — came from coins aged between six months and seven years, peaking at two to three years.
Then it stops. Coins aged seven to eight years contributed almost nothing. Above eight years, the day was actually quieter than normal. The very old coins — the ten-year and fifteen-year vintages that dominate a typical record-setting day — sat the whole thing out.
A ceiling like that is meaningful, because a coin cannot be older than the wallet holding it. A population of wallets that all came into existence after a certain date can only hold coins younger than that date. The movement on 31 July behaves like exactly that: a large group of wallets with a shared birthday, and nothing older joining in.
What this most likely means
Everything above is measurement. This part is interpretation, and we mark it as such.
The most coherent reading is that 31 July was mostly not a robbery. It was an evacuation. A warning went out at 22:50 the previous night telling owners their coins might be guessable and to move them. What the chain recorded over the following twenty-four hours has every feature you would expect from that: tens of thousands of coins, thousands of separate decisions, spread flat across a whole day, from wallets of broadly similar vintage, with the oldest coins on the network sitting still throughout.
The theft was real, and for the people it happened to it was total. But it is a small part of what the chain shows. Most of what moved that day looks like people moving their own money out of harm’s way — which is, after all, exactly what they were told to do.
What we cannot know
Bitcoin addresses carry no record of what created them. Nothing on the chain says “this wallet was a Coldcard” — not the address, not the transaction, not the amount. Any claim that a specific set of addresses belonged to a specific device rests on evidence from outside the chain.
We therefore did not try to identify victims, attackers, or a cluster of affected wallets, and no number on this page depends on having done so. Everything here is measured across the whole network.
The direct consequence is that we cannot separate a theft from a rescue. Once the warning went out, an owner urgently emptying their own wallet produces almost the same on-chain shape as somebody emptying it for them. That ambiguity is real, it is not resolvable from public chain data alone, and it is why the section above is labelled interpretation.
Numbers we did not measure
The theft totals in circulation — commonly 1,367 bitcoin from 4,585 addresses, later revised upward — are not ours. They trace to a single analytics firm, published in social posts rather than a formal report, and were repeated widely without the caveats that firm attached to them. That firm noted it could not confirm from chain data alone which wallets were affected, and that a theft looks the same on-chain as an owner moving coins.
We use those figures on this page only as the subject of an arithmetic check, never as an input to a measurement. If they are revised, the conclusion does not move much: the gap between the theft and the movement is so large that even the highest published bound closes less than a tenth of it.
Two published claims we could check, we did, and both hold. The 41-minute sweep window sits where it was said to (blocks 960,183–960,191, 01:10:20 to 01:51:26 on 30 July). A single address named as the destination of the first wave shows 594.477 bitcoin arriving across 504 separate payments on our own node. Hundreds of unrelated owners do not share one destination, so that first wave — before any warning existed — is theft on any reading.
How to check this yourself
All of it comes from a fully synced Bitcoin node, indexed to block 960,999, with no third-party data feeding any measurement.
- The day in question is 31 July 2026 UTC, blocks 960,325 to 960,481 — 157 blocks. Day boundaries come from block timestamps, and we verified that the first block of each day falls after midnight and the one before it falls before.
- Baselineis 1–29 July 2026, ending before the incident. “Excess” is the day minus that baseline, computed per age band and then summed.
- Concentrationis the share of a day’s coin days sitting in its single busiest block, computed for all 2,041 days since 1 January 2021 and reported for the 40 largest.
- Cross-check.Coin days summed block by block agree with the node’s own daily total to within 0.8%, the small residual being a rolling-window versus calendar-day boundary.
Rebuilding this needs a synced node and a way to read coin days destroyed per block, plus spend volume split by coin age. No paid data source is involved.
Maketo is a Bitcoin data site. This page is research, not investment advice and not security advice. If you own a hardware wallet and think you may be affected, follow the manufacturer’s own guidance. Charts and figures may be reproduced with attribution to Maketo.