While exploits in crypto often grab headlines because of the sheer amount of money that gets stolen, Coates emphasized that many of these hacks actually originate outside of blockchain compromises themselves. “In many cases, it is an operational security issue or a Web2 issue that led to a key compromise,” he said.

This will only prove to be more difficult as artificial intelligence advances gives attackers better tools to exploit security practices.

“The social engineering piece is going to get a lot worse because of the power of AI and deepfakes,” Coates said. “We should expect full spoofed phone calls with voices of people that we know… there’s really no reason this won’t hyperscale.

To prevent that, Coates thinks crypto needs to come up with better systems that remain secure and work when people fall for these scams.

“You cannot fully prevent anyone from falling victim,” he said. “Eventually, you will be fooled because the cons are that good.” Organizations should thus have multiple layers of various degrees of security controls, so “when someone gets fooled, the other things take over to protect you.”

For the longer-term, the question of quantum computing largely looms on various crypto ecosystem’s futures, including that of Solana.

The obvious objection is that this is leveraged speculation in new language, and that traditional markets keep their frictions for good reasons. Both points have force. A funding rate is not a substitute for the price discovery that settlement enforces, and continuous leverage on volatile assets concentrates risk in ways periodic markets do not. But those are arguments for building the structure carefully, not for assuming it will not be built. The demand is already here, and it moves toward the venue that offers universal access to global assets, whether stocks, crypto or FX.

There is one place crypto’s progress this cycle has not yet reached. Over the past year, tokens acquired real economic rights, revenue shares, buybacks and votes, while projects with nothing behind them were delisted and some of the strongest teams chose IPOs over token launches. Even the IPO no longer sits outside this system: SpaceX’s shares changed hands as synthetic pre-IPO perpetuals on Hyperliquid for weeks before its June 2026 listing, trading tens of millions of dollars a day in May and swelling to roughly $1.3 billion on debut day as investors shut out of the traditional allocation turned to crypto rails. The market structure beneath perps has not fully followed. The next stage is to build that alignment in, with the transparency now expected across the rest of crypto. That consolidation is happening on centralized venues as much as onchain: the largest exchanges now run multi-asset books where equities, crypto and FX clear side by side, and a single centralized platform accounted for more than half of all real-world-asset perp volume in May 2026. The pull is structural rather than speculative, with 52% of Bitget’s users already holding both stocks and crypto.

Galaxy Research, the research arm of Galaxy Digital, has expanded the on-chain footprint linked to the Coldcard wallet incident that reportedly resulted in the loss of 1,082.65 bitcoin. In a new analysis, the firm identified 1,196 addresses that were involved in transactions tied to that event, widening the estimated scale beyond earlier preliminary figures.

The activity Galaxy Research points to took place between 1:10 AM and 1:51 AM UTC on July 30, spanning blocks 960,183 to 960,191—roughly 30 hours before Coldcard published its first security advisory, as referenced in Galaxy Research’s post on X.

Key takeaways

• Galaxy Research traced a cluster of 1,196 addresses tied to the Coldcard incident, connected to losses of 1,082.65 BTC.
• The movements were observed across blocks 960,183–960,191 between 1:10 AM and 1:51 AM UTC on July 30.
• Galaxy Research says the transactions share a recognizable on-chain pattern (including identical fees and no change outputs), though later attacks may not reuse the same fingerprint.
• Earlier estimates from Rob Hamilton and related analysis suggested a smaller, tighter window of activity that has since been superseded by the larger Galaxy Research mapping.
• Coinkite has said it released a hotfix for a firmware bug, but users who created seeds using the vulnerable firmware may still need to move funds to a new seed.

Galaxy Research widens the address set

According to Galaxy Research, the incident’s impact is visible on-chain in a larger set of wallets than first documented publicly. The firm said it identified 1,196 addresses linked to the Coldcard wallet incident that ultimately resulted in 1,082.65 BTC being moved in the span it analyzed.

Galaxy Research’s tracing work focused on how those funds moved through the network during a specific period. It reported that the key transaction activity occurred between 1:10 AM and 1:51 AM UTC on July 30, crossing blocks 960,183 to 960,191.

That timing is also notable in terms of disclosure. Galaxy Research indicated this took place about 30 hours before Coldcard’s first security advisory was published.

From a smaller estimate to a larger on-chain pattern

Prior to Galaxy Research’s broader mapping, a preliminary view of the incident suggested a more limited sweep. Earlier analysis by AnchorWatch CEO and co-founder Rob Hamilton estimated that 594.48 BTC—worth around $38 million at the time—moved across roughly 500 transactions within a narrow three-block window.

Galaxy Research’s later work does not necessarily contradict the existence of that tight burst; instead, it expands the scope of what can be linked to the event by pointing to a repeatable transaction fingerprint.

In posts on X, Galaxy Research said the identified transactions share specific characteristics, including identical 30 satoshis per virtual byte fees and the absence of change outputs. Galaxy Research described these features as part of the method that allows the initial attack activity to be identified on-chain.

Importantly for users trying to assess exposure, Galaxy Research also cautioned that future attacks targeting Coldcard-generated addresses may not always follow the same on-chain “fingerprint.” That means wallet owners should not assume that the first set of identifiable traits will be reused in later attempts.

What Coinkite says about the firmware bug and the limits of updates

Coinkite co-founder Rodolfo Novak publicly addressed the issue via an X post on Friday, saying the company takes responsibility for the firmware bug and is working to determine the full scope of the problem.

Novak also said Coinkite released a hotfix intended to remove the software fallback path. However, he warned that installing the fix does not retroactively protect seeds that were generated using vulnerable firmware.

In practical terms, Novak advised users who created seeds on the vulnerable firmware to move their funds to a new seed. That distinction—between fixing a flaw going forward and securing already-generated keys—appears to be central to how users should interpret the incident response.

This is also a reminder that “device firmware updates” and “seed security” are not always interchangeable. If the vulnerability affected how seeds were generated or handled, a patch may stop new risk but cannot undo the exposure that may have occurred when the vulnerable firmware produced the original seed material.

Why the expanded tracing matters for incident assessment

The difference between Hamilton’s earlier estimate of 594.48 BTC and Galaxy Research’s later identification of 1,082.65 BTC underscores how incident accounting can evolve as analysts refine clustering techniques and expand time windows. Early on-chain forensics often focus on the clearest bursts; later work may connect additional wallets and transactions using shared traits like consistent fee patterns and transaction structure.

For traders and users, this matters because it changes how incident exposure can be understood. Wallet owners who are evaluating whether they need to move funds may face a moving target: a larger set of addresses suggests that more wallets could have been impacted than initially thought, while Galaxy Research’s warning about fingerprint variability implies that on-chain searches may not capture everything using a single pattern.

For developers and auditors, the episode also highlights the importance of both preventive controls and disclosure timing. Galaxy Research’s observation about the 30-hour gap between the analyzed activity and Coldcard’s first advisory publication frames the timeline in which users may have been acting on incomplete information.

As more details are verified, the key question for the broader ecosystem will be whether subsequent investigations confirm additional waves of activity beyond the identifiable on-chain pattern described by Galaxy Research—and whether Coinkite’s technical findings fully explain how the firmware behavior led to the reported losses.

Readers should watch for further updates from Coinkite on what the bug impacted at the seed level and for additional on-chain analysis that tests whether other clusters of transactions match or diverge from the fee and “no change output” fingerprint outlined by Galaxy Research.

The crypto industry suffered 30 major hacking incidents in July, leading to losses totaling $210.3 million, a significant increase from the $75.87 million reported in June.

The industry has lost $1 billion during the first half of the year, and recorded a record number of hacks within six months, with Ethereum and Solana leading the losses.

Crypto Industry Reports A Surge In Hacking Incidents

PeckShield has reported that the cryptocurrency industry suffered a loss of $210.3 million from 30 major exploits in July, a 177.2% increase from the $75.87 million reported in June. The exploits highlight the persistent security challenges faced by the industry. The losses were driven by a handful of high-profile incidents. The Coldcard Wallet exploit was the largest incident this month, and the third-largest this year, resulting in $70 million in losses.

Other notable security incidents in July include the AFX Trade exploit ($24 million), Ostium ($24 million), BONK ($21.2 million), Wanchain ($13 million), Triple-A ($10 million), Bonzo Lend ($9.05 million), Verus ($7.5 million), WEMIX ($6.25 million), and Summer.fi ($6 million).

Crypto Hacks Cross $1 Billion For 2026

According to Blockaid, an on-chain security platform, the cryptocurrency industry recorded a record number of exploits in the first half of 2026, with losses from these hacks exceeding $1 billion. The attacks were primarily concentrated on Ethereum and Solana, which lost $332 million and $326 million, respectively, to various exploits. Hackers used code exploits to target Ethereum-based protocols, and key and infrastructure breaches on Solana-based protocols.

Hackers Target Ethereum And Solana-Based Applications

Hackers targeted vulnerabilities in Ethereum-based applications. BlockAid stated in its Q2 2026 report that code exploits were the most common tactic used by hackers. However, Ethereum-based protocols such as Humanity Protocol and StablR were targeted through private-key exploits. BlockAid also highlighted other attack vectors on Ethereum, including privilege account exploits, market manipulation, smart contract, and bridge vulnerabilities.

Meanwhile, Drift Protocol, a Solana-based protocol, was targeted through social engineering, with hackers spending months building a relationship with the protocol team before using Solana’s “durable nonces” feature to get members to sign transactions giving them admin control. This allowed the hackers to drain $285 million, over half its TVL, from the protocol. On-chain indicators suggest North Korean hackers were behind the heist. The Step Finance exploit was also attributed to North Korean hackers. The hackers siphoned off $40 million after gaining access to devices belonging to the project’s team. The team then unstaked 261,854 SOL and moved them, causing the value of the STEP token to plummet 80%. However, Solana also saw code-based exploits involving Volo and Raydium.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Russia is tightening its cryptocurrency mining rules by expanding a ban that will apply in Moscow and surrounding areas. The restriction takes effect on Aug. 15, 2026, and is scheduled to run through Dec. 31, 2032, according to a government resolution published on Pravo.ru.

The updated measure, signed July 25, 2026 by Prime Minister Mikhail Mishustin, amends earlier restrictions adopted in December 2024. It broadens the list of regions where mining is prohibited, citing electricity supply and demand pressures in power-constrained territories.

Key takeaways

• Russia’s Resolution No. 936 (signed July 25, 2026) extends crypto mining restrictions to Moscow and the Moscow Region.
• The Moscow-area ban starts Aug. 15, 2026 and runs through Dec. 31, 2032.
• Additional affected areas include several territories within Russia’s Kursk Region, plus eight municipal districts and the city of Lgov.
• The Kremlin-linked restrictions build on an earlier Dec. 2024 mining curbs order, and follow region-by-region bans introduced since early 2026.

Resolution expands mining ban into Moscow and nearby territories

Under the revised framework, mining restrictions now include Moscow, the Moscow Region, and multiple areas within Russia’s Kursk Region. The document also lists eight municipal districts and the city of Lgov as part of the restricted zone.

The changes are formalized in Resolution No. 936, referenced in records published on Pravo.ru. The resolution amends an earlier order issued in December 2024, which had already established limitations on cryptocurrency mining in specific parts of Russia.

Electricity demand remains the policy rationale

Russian officials have previously connected mining restrictions to grid strain and rising electricity demand. According to reporting by TASS, the Moscow Region’s energy authorities said a ban was needed as consumption increased.

TASS also cited power infrastructure figures, stating that Moscow and the Moscow Region have 65 data centers linked to the grid with a combined capacity of 734 megawatts (MW). Within that total, 19 data centers are located in the Moscow Region, totaling 233 MW of capacity.

While the new resolution expands the restricted geography, the underlying logic mirrors earlier steps: authorities are attempting to limit additional load from mining activities in areas where power supply and demand are already under pressure.

Earlier regional restrictions set the stage for a broader move

This Moscow-focused expansion follows a broader pattern of state action against crypto mining in selected regions. The updated rules amend the December 2024 restriction order, which had already begun shaping where mining could operate.

Earlier restrictions were also introduced in parts of Russia, including areas in Buryatia and Zabaykalsky Krai. As described in the Pravo.ru records, those bans were set to run from April 1, 2026 through March 15, 2031.

In other words, Russia is not simply imposing a new nationwide approach; it is layering restrictions by region—first in selected territories and now into major urban and power-dependent areas like Moscow and its surrounding region.

What to watch next for miners and operators

For mining companies and energy-intensive operators, the key practical implication is that compliance will depend heavily on location rather than a single countrywide rule. With the start date set for Aug. 15, 2026 and a long time horizon through 2032, operators in or near the newly restricted areas will need to plan for regulatory compliance well ahead of implementation.

Investors, traders, and builders should watch whether authorities continue expanding the banned geography beyond Moscow and Kursk, and whether grid-capacity reporting becomes more central to future policy decisions. Additional region-specific amendments would further reinforce Russia’s approach of using electricity supply constraints as the deciding factor for mining permissions.

Bitget has upgraded its Bitcoin-backed BGBTC asset with daily BTC-denominated rewards, cross-chain transfers through Chainlink CCIP, and independent oversight from Gauntlet.

Bitget adds daily Bitcoin rewards to BGBTC

Bitget said the upgraded BGBTC will distribute daily rewards denominated in BTC to token holders. The asset is designed to maintain a 1:1 peg with Bitcoin while allowing users to earn yield without selling their underlying exposure.

The exchange is positioning BGBTC as an alternative to holding idle Bitcoin or moving BTC into separate yield strategies. Those strategies can require users to transfer assets between platforms, manage additional protocols, or accept reduced liquidity.

BGBTC already has several uses within the Bitget ecosystem. Holders can use the asset as futures margin, lending collateral or for participation in the exchange’s Launchpool and PoolX products.

The upgrade also introduces support for large-volume and faster redemptions, according to Bitget. The company said it has added institutional-grade risk controls and greater transparency, although specific reward rates and redemption thresholds were not provided in the announcement.

Rewards remain tied to the performance and sustainability of the underlying yield strategies. A Bitcoin-backed token can also carry platform, custody, smart-contract and liquidity risks that differ from holding BTC directly.

Chainlink CCIP supports cross-chain BGBTC transfers

Bitget selected Chainlink’s Cross-Chain Interoperability Protocol as the canonical infrastructure for distributing BGBTC across multiple blockchain networks.

CCIP provides the messaging layer needed to move the asset between supported chains. The integration could allow holders to access decentralized applications and financial services outside Bitget’s centralized platform while retaining exposure to the Bitcoin-backed token.

Bitget already uses Chainlink Proof of Reserve to verify the assets supporting BGBTC. Proof of Reserve provides on-chain data intended to help users assess whether sufficient collateral exists behind the issued supply.

Combining Proof of Reserve with CCIP addresses two separate functions. The reserve system focuses on collateral verification, while CCIP handles communication and token transfers across blockchains.

Bitget did not identify every blockchain that will initially support BGBTC through CCIP or provide a schedule for additional network deployments.

Gauntlet will oversee BGBTC yield strategies

Gauntlet has been appointed as BGBTC’s independent curator and will supervise the strategies used to generate rewards for holders.

The quantitative risk-management firm will monitor the underlying portfolio, assess risks and help determine how capital is deployed. Bitget said the framework is intended to support the long-term sustainability of BGBTC’s yield rather than relying on an unmanaged set of strategies.

Independent curation adds another layer of oversight, but it does not eliminate losses. Reward levels may change based on market conditions, available strategies, and the performance of the assets or protocols involved.

Bitget is also working with infrastructure providers, including Chainlink and Morph, as it seeks to connect centralized and decentralized financial services through a broader Bitcoin yield network.

The company cited USDGO Holderyield as another part of its effort to let users earn returns from assets that would otherwise remain idle.

What the upgrade means for Bitcoin holders

BGBTC combines Bitcoin exposure, daily rewards and cross-chain utility in a single token. Users can potentially earn BTC-denominated returns while deploying the asset as collateral, margin or capital in supported decentralized applications.

For US investors, access to BGBTC and related Bitget services may depend on geographic and product restrictions. Users should confirm whether the exchange, token, and associated yield products are available in their jurisdiction before transferring funds.

Yield paid in BTC may also create tax-reporting obligations for US holders, depending on how the rewards are classified and when users gain control of them. Bitget did not announce any US-specific rollout or regulatory approval alongside the upgrade.

Future adoption will depend on the reward rate, redemption performance, supported networks, and transparency around the underlying strategies. Bitget has not yet disclosed a fixed annual yield or a complete cross-chain deployment timeline.