In custody language, a hot wallet is a key setup that can sign often — online, used for deposits and withdrawals. A cold wallet keeps keys offline (or under slower multisig procedures) so a single breach does not empty the reserve. When an exchange “moves coins to cold storage,” the chain shows a transaction from addresses used for operations into addresses used for reserve. That transaction can be thousands of BTC. It is still an internal bookkeeping event until someone trades on an order book. This page is education. Not trading signals. Not investment advice.
What you can observe
Public data can show:
- A large output total — often one or a few outputs, i.e. a consolidation shape.
- A sourced label on an input (hot or operational wallet) or an output (a previously disclosed cold address).
- Fee rate: cold sweeps are frequently unhurried.
Public data cannot show: that the destination is actually offline, that the legal owner changed, or that the coins will be sold. “Cold” is an operational claim. Unless the entity published the address (proof-of-reserves, a transparency report, a regulator filing), you are inferring from graph folklore.
Why alerts over-count “outflows”
Flow dashboards that tag an exchange cluster and then treat every spend from that cluster as “BTC leaving the exchange” will count hot→cold as an outflow. Economically the coins may still be customer liabilities on the same balance sheet. The opposite happens too: cold→hot looks like an inflow or a “preparing to sell” story when it may be refill for withdrawals.
Our directory is small and exact-match. We will not mark an unlabeled destination as “Binance cold” because a blog said so. If neither side matches Labels, Brief will say so. That refusal is the product.
Sourced case (input label, unlabeled output)
The Bitfinex sweep 61b5cc645177843e8514e18a19faf162a19247c8bb4f25519b57c166e9df302c (147 inputs → 1 output, ~22,025 BTC, block 615825) matches Bitfinex on the input side in our list. The single output has no directory entry. A responsible sentence is: “Bitfinex-attributed coins were consolidated into a new UTXO.” A reckless sentence is: “Bitfinex sent 22k BTC to cold storage, bullish.” We do not know the operational role of the output from the transaction alone. Details and explorer links: Examples.
Proof-of-reserves is a different artifact
Some exchanges periodically publish addresses or Merkle proofs so customers can check that on-chain balances exist. Those publications are a primary source for labels — when they are current. Addresses rotate. A 2022 PoR list does not license you to tag a 2026 output. We only add directory rows with a public source; stale PoR snapshots get medium or low confidence, or they stay out. Propose updates via Contact.
How to read a suspected cold sweep here
- Confirm the tx in a block — pending is provisional.
- Shape: many inputs / few outputs? Then start from consolidation, not “sale.”
- Label side: input, output, or both? Input-only means you know more about the sender than the destination.
- Compare Brief’s certainty. Internal custody should not raise certainty; it should lower the market story.
- Refuse a price implication. See exchange flows and Disclaimer.
Multisig and “ugly” addresses
Cold setups often use multisig or descriptor wallets. Explorer “from/to” rows can look noisy (nested scripts, uncommon address types). The underlying model is still UTXOs consumed and created. Brief reports counts and labeled touches; it does not name wallet vendors. If you need script type, read it on mempool.space — explorer basics.
Address reuse is not “the cold wallet”
Popular coverage talks as if an exchange has one cold address. In practice, reserves sit in many UTXOs, often under multisig or descriptor wallets, and they rotate. A reused address that once appeared in a proof-of-reserves file is a candidate for a label — if the file is public and dated. It is not a permanent name for every later output. Our directory would rather show unlabeled than freeze a 2022 address onto a 2026 transaction.
Fees as a weak clue, not a signal
A low sat/vB on a many-input sweep is consistent with “we can wait for the next blocks.” It is also consistent with a wallet that simply used its default fee. A high fee on a large output can mean urgency, a stuck parent (CPFP), or a clumsy preset. None of those are buy/sell marks. Compare fee rate to the rest of the same block on the explorer if you care; do not compare it to the price chart.
Further reading
- Radar — watch large confirmed output sums, then inspect structure
- What is a Bitcoin whale? — size is not identity
- Methodology
Educational only.
Primary sources
- Bitcoin Developer Guide — Transactions — UTXOs, not accounts; a “wallet” is a key/UTXO set, not a chain object named hot or cold.
- Worked input-labeled consolidation 61b5cc6…302c (block 615825). Destination unlabeled in our directory.
- This site’s label directory and methodology — exact match only.