How to Safely Move All Your Bitcoin to a New Wallet: The Complete Migration Guide (2026)

This weekend, an attacker began draining bitcoin wallets holding just a few thousand dollars each — the third wave of the Coldcard key-generation exploit that has taken roughly $89 million from 4,585 addresses since July 30, per Galaxy Research figures reported by CoinDesk. The uncomfortable lesson is that sooner or later, most bitcoin holders will face a moment when they need to move everything: a security advisory, a suspected leak, an inherited wallet, or simply aging hardware. Moving your entire stack is not the same as sending a payment. This guide covers the full process — planning, fees, privacy, and the mistakes that turn a precaution into a loss. It is written for the current emergency but applies to any migration, this year or in ten.

First: decide how urgent your situation is

Not every migration is an emergency, and misjudging urgency causes mistakes in both directions. You are in the emergency lane if your seed was generated on hardware or software with a published vulnerability — for example, seeds created on Coldcard firmware 4.0.0-era builds, which Coinkite says must be treated as compromised even after a firmware update, because updating the firmware does not repair an already-generated weak seed. You are also in the emergency lane if your seed words were ever typed into a computer or phone, photographed, stored in a cloud note, or seen by another person. In these cases, speed beats fee optimization: a vulnerable seed is a race between you and whoever else can derive your keys — and wave three of the Coldcard attack proves that small balances are being hunted too.

You are in the routine lane if nothing is known to be wrong and you are migrating for hygiene: consolidating old wallets, moving to multisig, replacing aging hardware. Here you can take days, plan UTXOs deliberately, and wait for cheap fee windows — often weekends, when mempool congestion is typically lower.

Sweep vs. send: know the difference

A regular transaction spends selected coins to a destination and returns change to the source wallet. A sweep empties every coin controlled by a key into a new wallet, leaving nothing behind. For a compromised seed you almost always want a sweep — leaving 'dust' behind on a burned seed has no upside. But understand what a sweep does: it links every UTXO you own in a single on-chain event. Anyone watching your old addresses — including the attacker who may be scanning them — now knows your total stack and its new home. We will come back to that in the privacy section.

Step 1 — Prepare the destination before touching the source

The order matters: destination first, source last. Buy or verify your new hardware from the manufacturer or an authorized reseller, never second-hand. Check the anti-tamper measures the vendor documents. Update the device to the latest firmware and verify the firmware signature through the vendor's official process before generating anything. Then generate a brand-new seed on the device itself — never reuse an old seed, never import one 'temporarily,' and never generate seed words on a phone or computer. If your device supports adding your own entropy (dice rolls are the classic method, and would have fully protected users in the Coldcard incident), use it: it removes the device's random number generator as a single point of failure. Write the words on paper or steel. No photos, no cloud, no password manager.

Confirm the new wallet works before funding it: receive a trivial test amount, restore the seed from your written backup onto the wiped device (or a second device) to prove the backup is correct, and only then treat the wallet as live. A backup you have never restored is a hope, not a backup.

Step 2 — Plan the transaction: fees, UTXOs, and timing

List what you actually hold: how many UTXOs, of what sizes, at which addresses. A wallet with one 0.5 BTC UTXO migrates in one cheap transaction; a wallet with forty small UTXOs from years of DCA buys is a fee problem, because each input adds size (and therefore cost) to the transaction. In an emergency, send everything at the fastest reasonable fee rate and accept the cost — check a mempool explorer for the current next-block rate rather than trusting a wallet's stale default. In a routine migration, batch thoughtfully: you might consolidate small UTXOs at a low fee rate first, or migrate in a handful of planned transactions that keep unrelated coins separate.

Always use replace-by-fee (RBF) if your wallet supports it, so an underpaid transaction can be bumped instead of sitting stuck for hours while your compromised seed stays live. Verify the receiving address on the new device's own screen — not just in the companion app — before signing. Malware that swaps addresses in the clipboard is one of the oldest tricks in crypto theft, and it still works.

Step 3 — The test-then-commit pattern

For any balance that would hurt to lose, migrate in two stages. First send a small test amount, wait for a confirmation, and verify you can see and spend it from the new wallet. Then send the remainder. Two transactions cost more than one, but the test catches a wrong address, a broken backup, a derivation-path mismatch, or a compromised companion app — every one of which is catastrophic at full size and trivial at test size. In a genuine emergency with an actively exploited seed, you may reasonably judge that the extra minutes of a two-stage move cost more than they protect; that is a real trade-off, and it is exactly why doing this before an emergency is the better plan.

Step 4 — Privacy: don't turn a rescue into a dossier

Migration is where holders accidentally publish their net worth. Some practical rules. First, avoid merging coins with separate histories (for example, KYC-exchange withdrawals and privately acquired coins) into one output unless you accept that those histories are now permanently linked. Second, if your new wallet will be watched via an exported xpub in a companion app, remember that the xpub reveals every future address in that account — treat it like a password, and the Coldcard attack is a reminder why: a leaked xpub gave attackers targets to monitor. Third, consider sending the migration to several destination addresses (all controlled by your new seed) rather than one, so a single on-chain observer sees fragments rather than a lump sum. None of this is exotic; it is fifteen minutes of thought before signing.

Step 5 — After the move

Keep a watch-only view of the old, emptied addresses for a few months; any activity there is a signal about how compromised the old setup really was (in the Coldcard case, researchers are watching the attacker's 562 BTC consolidation address the same way). Physically destroy or securely wipe retired backups so an old seed phrase cannot resurface in a drawer years later — an emptied wallet is only harmless if it stays empty and forgotten. Update your inheritance notes so whoever eventually needs your backup finds the current one, not the burned one. And diarize a periodic check of your vendor's security advisories: the Coldcard flaw sat undiscovered for five years, and the users who escaped were largely the ones who heard the news within hours. As Binance founder CZ put it after this exploit, even hardware wallets can have bugs — splitting funds across wallets trades one risk for another, but it caps the damage any single failure can do.

The complete migration checklist

Frequently asked questions

Disclaimer: This article is for informational and educational purposes only and does not constitute investment, financial, legal, or tax advice. Cryptocurrency prices are highly volatile and you can lose your entire investment. Always do your own research and consult a qualified financial advisor before making any investment decision.