While exploits in crypto often grab headlines because of the sheer amount of money that gets stolen, Coates emphasized that many of these hacks actually originate outside of blockchain compromises themselves. “In many cases, it is an operational security issue or a Web2 issue that led to a key compromise,” he said.

This will only prove to be more difficult as artificial intelligence advances gives attackers better tools to exploit security practices.

“The social engineering piece is going to get a lot worse because of the power of AI and deepfakes,” Coates said. “We should expect full spoofed phone calls with voices of people that we know… there’s really no reason this won’t hyperscale.

To prevent that, Coates thinks crypto needs to come up with better systems that remain secure and work when people fall for these scams.

“You cannot fully prevent anyone from falling victim,” he said. “Eventually, you will be fooled because the cons are that good.” Organizations should thus have multiple layers of various degrees of security controls, so “when someone gets fooled, the other things take over to protect you.”

For the longer-term, the question of quantum computing largely looms on various crypto ecosystem’s futures, including that of Solana.

The obvious objection is that this is leveraged speculation in new language, and that traditional markets keep their frictions for good reasons. Both points have force. A funding rate is not a substitute for the price discovery that settlement enforces, and continuous leverage on volatile assets concentrates risk in ways periodic markets do not. But those are arguments for building the structure carefully, not for assuming it will not be built. The demand is already here, and it moves toward the venue that offers universal access to global assets, whether stocks, crypto or FX.

There is one place crypto’s progress this cycle has not yet reached. Over the past year, tokens acquired real economic rights, revenue shares, buybacks and votes, while projects with nothing behind them were delisted and some of the strongest teams chose IPOs over token launches. Even the IPO no longer sits outside this system: SpaceX’s shares changed hands as synthetic pre-IPO perpetuals on Hyperliquid for weeks before its June 2026 listing, trading tens of millions of dollars a day in May and swelling to roughly $1.3 billion on debut day as investors shut out of the traditional allocation turned to crypto rails. The market structure beneath perps has not fully followed. The next stage is to build that alignment in, with the transparency now expected across the rest of crypto. That consolidation is happening on centralized venues as much as onchain: the largest exchanges now run multi-asset books where equities, crypto and FX clear side by side, and a single centralized platform accounted for more than half of all real-world-asset perp volume in May 2026. The pull is structural rather than speculative, with 52% of Bitget’s users already holding both stocks and crypto.

Galaxy Research, the research arm of Galaxy Digital, has expanded the on-chain footprint linked to the Coldcard wallet incident that reportedly resulted in the loss of 1,082.65 bitcoin. In a new analysis, the firm identified 1,196 addresses that were involved in transactions tied to that event, widening the estimated scale beyond earlier preliminary figures.

The activity Galaxy Research points to took place between 1:10 AM and 1:51 AM UTC on July 30, spanning blocks 960,183 to 960,191—roughly 30 hours before Coldcard published its first security advisory, as referenced in Galaxy Research’s post on X.

Key takeaways

• Galaxy Research traced a cluster of 1,196 addresses tied to the Coldcard incident, connected to losses of 1,082.65 BTC.
• The movements were observed across blocks 960,183–960,191 between 1:10 AM and 1:51 AM UTC on July 30.
• Galaxy Research says the transactions share a recognizable on-chain pattern (including identical fees and no change outputs), though later attacks may not reuse the same fingerprint.
• Earlier estimates from Rob Hamilton and related analysis suggested a smaller, tighter window of activity that has since been superseded by the larger Galaxy Research mapping.
• Coinkite has said it released a hotfix for a firmware bug, but users who created seeds using the vulnerable firmware may still need to move funds to a new seed.

Galaxy Research widens the address set

According to Galaxy Research, the incident’s impact is visible on-chain in a larger set of wallets than first documented publicly. The firm said it identified 1,196 addresses linked to the Coldcard wallet incident that ultimately resulted in 1,082.65 BTC being moved in the span it analyzed.

Galaxy Research’s tracing work focused on how those funds moved through the network during a specific period. It reported that the key transaction activity occurred between 1:10 AM and 1:51 AM UTC on July 30, crossing blocks 960,183 to 960,191.

That timing is also notable in terms of disclosure. Galaxy Research indicated this took place about 30 hours before Coldcard’s first security advisory was published.

From a smaller estimate to a larger on-chain pattern

Prior to Galaxy Research’s broader mapping, a preliminary view of the incident suggested a more limited sweep. Earlier analysis by AnchorWatch CEO and co-founder Rob Hamilton estimated that 594.48 BTC—worth around $38 million at the time—moved across roughly 500 transactions within a narrow three-block window.

Galaxy Research’s later work does not necessarily contradict the existence of that tight burst; instead, it expands the scope of what can be linked to the event by pointing to a repeatable transaction fingerprint.

In posts on X, Galaxy Research said the identified transactions share specific characteristics, including identical 30 satoshis per virtual byte fees and the absence of change outputs. Galaxy Research described these features as part of the method that allows the initial attack activity to be identified on-chain.

Importantly for users trying to assess exposure, Galaxy Research also cautioned that future attacks targeting Coldcard-generated addresses may not always follow the same on-chain “fingerprint.” That means wallet owners should not assume that the first set of identifiable traits will be reused in later attempts.

What Coinkite says about the firmware bug and the limits of updates

Coinkite co-founder Rodolfo Novak publicly addressed the issue via an X post on Friday, saying the company takes responsibility for the firmware bug and is working to determine the full scope of the problem.

Novak also said Coinkite released a hotfix intended to remove the software fallback path. However, he warned that installing the fix does not retroactively protect seeds that were generated using vulnerable firmware.

In practical terms, Novak advised users who created seeds on the vulnerable firmware to move their funds to a new seed. That distinction—between fixing a flaw going forward and securing already-generated keys—appears to be central to how users should interpret the incident response.

This is also a reminder that “device firmware updates” and “seed security” are not always interchangeable. If the vulnerability affected how seeds were generated or handled, a patch may stop new risk but cannot undo the exposure that may have occurred when the vulnerable firmware produced the original seed material.

Why the expanded tracing matters for incident assessment

The difference between Hamilton’s earlier estimate of 594.48 BTC and Galaxy Research’s later identification of 1,082.65 BTC underscores how incident accounting can evolve as analysts refine clustering techniques and expand time windows. Early on-chain forensics often focus on the clearest bursts; later work may connect additional wallets and transactions using shared traits like consistent fee patterns and transaction structure.

For traders and users, this matters because it changes how incident exposure can be understood. Wallet owners who are evaluating whether they need to move funds may face a moving target: a larger set of addresses suggests that more wallets could have been impacted than initially thought, while Galaxy Research’s warning about fingerprint variability implies that on-chain searches may not capture everything using a single pattern.

For developers and auditors, the episode also highlights the importance of both preventive controls and disclosure timing. Galaxy Research’s observation about the 30-hour gap between the analyzed activity and Coldcard’s first advisory publication frames the timeline in which users may have been acting on incomplete information.

As more details are verified, the key question for the broader ecosystem will be whether subsequent investigations confirm additional waves of activity beyond the identifiable on-chain pattern described by Galaxy Research—and whether Coinkite’s technical findings fully explain how the firmware behavior led to the reported losses.

Readers should watch for further updates from Coinkite on what the bug impacted at the seed level and for additional on-chain analysis that tests whether other clusters of transactions match or diverge from the fee and “no change output” fingerprint outlined by Galaxy Research.

The crypto industry suffered 30 major hacking incidents in July, leading to losses totaling $210.3 million, a significant increase from the $75.87 million reported in June.

The industry has lost $1 billion during the first half of the year, and recorded a record number of hacks within six months, with Ethereum and Solana leading the losses.

Crypto Industry Reports A Surge In Hacking Incidents

PeckShield has reported that the cryptocurrency industry suffered a loss of $210.3 million from 30 major exploits in July, a 177.2% increase from the $75.87 million reported in June. The exploits highlight the persistent security challenges faced by the industry. The losses were driven by a handful of high-profile incidents. The Coldcard Wallet exploit was the largest incident this month, and the third-largest this year, resulting in $70 million in losses.

Other notable security incidents in July include the AFX Trade exploit ($24 million), Ostium ($24 million), BONK ($21.2 million), Wanchain ($13 million), Triple-A ($10 million), Bonzo Lend ($9.05 million), Verus ($7.5 million), WEMIX ($6.25 million), and Summer.fi ($6 million).

Crypto Hacks Cross $1 Billion For 2026

According to Blockaid, an on-chain security platform, the cryptocurrency industry recorded a record number of exploits in the first half of 2026, with losses from these hacks exceeding $1 billion. The attacks were primarily concentrated on Ethereum and Solana, which lost $332 million and $326 million, respectively, to various exploits. Hackers used code exploits to target Ethereum-based protocols, and key and infrastructure breaches on Solana-based protocols.

Hackers Target Ethereum And Solana-Based Applications

Hackers targeted vulnerabilities in Ethereum-based applications. BlockAid stated in its Q2 2026 report that code exploits were the most common tactic used by hackers. However, Ethereum-based protocols such as Humanity Protocol and StablR were targeted through private-key exploits. BlockAid also highlighted other attack vectors on Ethereum, including privilege account exploits, market manipulation, smart contract, and bridge vulnerabilities.

Meanwhile, Drift Protocol, a Solana-based protocol, was targeted through social engineering, with hackers spending months building a relationship with the protocol team before using Solana’s “durable nonces” feature to get members to sign transactions giving them admin control. This allowed the hackers to drain $285 million, over half its TVL, from the protocol. On-chain indicators suggest North Korean hackers were behind the heist. The Step Finance exploit was also attributed to North Korean hackers. The hackers siphoned off $40 million after gaining access to devices belonging to the project’s team. The team then unstaked 261,854 SOL and moved them, causing the value of the STEP token to plummet 80%. However, Solana also saw code-based exploits involving Volo and Raydium.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Bitget has upgraded its Bitcoin-backed BGBTC asset with daily BTC-denominated rewards, cross-chain transfers through Chainlink CCIP, and independent oversight from Gauntlet.

Bitget adds daily Bitcoin rewards to BGBTC

Bitget said the upgraded BGBTC will distribute daily rewards denominated in BTC to token holders. The asset is designed to maintain a 1:1 peg with Bitcoin while allowing users to earn yield without selling their underlying exposure.

The exchange is positioning BGBTC as an alternative to holding idle Bitcoin or moving BTC into separate yield strategies. Those strategies can require users to transfer assets between platforms, manage additional protocols, or accept reduced liquidity.

BGBTC already has several uses within the Bitget ecosystem. Holders can use the asset as futures margin, lending collateral or for participation in the exchange’s Launchpool and PoolX products.

The upgrade also introduces support for large-volume and faster redemptions, according to Bitget. The company said it has added institutional-grade risk controls and greater transparency, although specific reward rates and redemption thresholds were not provided in the announcement.

Rewards remain tied to the performance and sustainability of the underlying yield strategies. A Bitcoin-backed token can also carry platform, custody, smart-contract and liquidity risks that differ from holding BTC directly.

Chainlink CCIP supports cross-chain BGBTC transfers

Bitget selected Chainlink’s Cross-Chain Interoperability Protocol as the canonical infrastructure for distributing BGBTC across multiple blockchain networks.

CCIP provides the messaging layer needed to move the asset between supported chains. The integration could allow holders to access decentralized applications and financial services outside Bitget’s centralized platform while retaining exposure to the Bitcoin-backed token.

Bitget already uses Chainlink Proof of Reserve to verify the assets supporting BGBTC. Proof of Reserve provides on-chain data intended to help users assess whether sufficient collateral exists behind the issued supply.

Combining Proof of Reserve with CCIP addresses two separate functions. The reserve system focuses on collateral verification, while CCIP handles communication and token transfers across blockchains.

Bitget did not identify every blockchain that will initially support BGBTC through CCIP or provide a schedule for additional network deployments.

Gauntlet will oversee BGBTC yield strategies

Gauntlet has been appointed as BGBTC’s independent curator and will supervise the strategies used to generate rewards for holders.

The quantitative risk-management firm will monitor the underlying portfolio, assess risks and help determine how capital is deployed. Bitget said the framework is intended to support the long-term sustainability of BGBTC’s yield rather than relying on an unmanaged set of strategies.

Independent curation adds another layer of oversight, but it does not eliminate losses. Reward levels may change based on market conditions, available strategies, and the performance of the assets or protocols involved.

Bitget is also working with infrastructure providers, including Chainlink and Morph, as it seeks to connect centralized and decentralized financial services through a broader Bitcoin yield network.

The company cited USDGO Holderyield as another part of its effort to let users earn returns from assets that would otherwise remain idle.

What the upgrade means for Bitcoin holders

BGBTC combines Bitcoin exposure, daily rewards and cross-chain utility in a single token. Users can potentially earn BTC-denominated returns while deploying the asset as collateral, margin or capital in supported decentralized applications.

For US investors, access to BGBTC and related Bitget services may depend on geographic and product restrictions. Users should confirm whether the exchange, token, and associated yield products are available in their jurisdiction before transferring funds.

Yield paid in BTC may also create tax-reporting obligations for US holders, depending on how the rewards are classified and when users gain control of them. Bitget did not announce any US-specific rollout or regulatory approval alongside the upgrade.

Future adoption will depend on the reward rate, redemption performance, supported networks, and transparency around the underlying strategies. Bitget has not yet disclosed a fixed annual yield or a complete cross-chain deployment timeline.

SpaceX stock remained under pressure near a record low as traders prepared for the company’s first post-IPO earnings report and the release of 911.5 million insider shares.

SpaceX stock extends its post-IPO decline

SpaceX stock closed July 31 at $108, down 3.41% during the session and about 36% from its July 1 price of $171. The decline left the shares at their lowest closing level since the company’s June 12 initial public offering.

SPCX has now fallen by more than 50% from the record high of $225 reached on June 16. The sustained pullback has raised the prospect of a move below $100 as two major catalysts approach.

SpaceX is scheduled to publish its first quarterly results as a public company on Aug. 4. Two days later, restrictions covering 911.5 million insider shares are expected to expire, allowing their holders to sell the stock.

Those events could produce large price swings because investors must assess the company’s operating performance while preparing for a possible increase in available supply.

Earnings and short sellers drive the move

Wall Street expects SpaceX to report quarterly revenue of between $6.72 billion and $6.9 billion. Results above that range could ease concerns about the company’s valuation and encourage buyers to return after four consecutive weeks of losses.

A revenue miss could have the opposite effect, particularly because the stock has not established a reliable support base. Traders will also watch management’s guidance for Starlink, launch operations, and the company’s emerging data-center business.

Short positioning has added pressure. S3 Partners data showed that investors had shorted 219.3 million shares, representing about 39% of the stock available for public trading.

The large position means short sellers could continue benefiting if SPCX falls. However, unexpectedly strong earnings could force some traders to cover their positions, creating a short-term rebound.

Bernstein recently maintained an outperform rating and a $239 target after SpaceX completed its 13th Starship test flight. William Blair also reportedly increased its adjusted earnings-per-share estimate from $8.20 to $8.60, citing potential growth from the company’s data-center operations.

Share unlock threatens to increase selling

The Aug. 6 unlock represents the main downside risk because it will make 911.5 million insider shares eligible for sale. At a price of about $108, those shares would carry a market value approaching $98.4 billion, although eligibility does not mean that all holders will sell.

S3 Partners research director Sam Pierson argued that the additional supply could outweigh a positive earnings report.

“There won’t be anything announced on earnings that will overcome the volume of unlocked shares coming to market,” Pierson said.

Actual selling will depend on insider decisions, liquidity and market demand. Even so, the scale of the unlock may discourage investors from buying before Aug. 6, particularly while short interest remains elevated.

For US investors, both events fall within the same trading week. That concentration could increase volatility, widen intraday price ranges and make execution prices less predictable around the earnings release and unlock date.

Advertisement

SpaceX stock tests $107.10 support

The one-hour SPCX chart shows the stock trading around $108.39 after declining within a broad descending channel. Price is now testing the $107.10 Fibonacci level, which forms the most immediate support.

A confirmed break below $107.10 would remove the final marked retracement support on the chart. That could expose the psychological $100 level, followed by the descending channel’s lower boundary near $97.

Trend indicators continue to favor sellers. Aroon Down stands at 92.86%, compared with Aroon Up at 7.14%, showing that recent lows are occurring much more frequently than recent highs.

The Awesome Oscillator is also negative at minus 3.98. Its red histogram bars indicate that bearish momentum remains active as SPCX trades near the bottom of its recent range.

The first upside barrier sits at the 78.6% Fibonacci retracement level of $121.09. Reclaiming that price would weaken the immediate bearish setup, but it would not reverse the broader downtrend.

Advertisement

Further resistance appears at $132.08, corresponding to the 61.8% retracement, followed by $139.80 at the 50% level. SPCX would need to move above the descending channel and hold those levels before the chart supports a more durable recovery.

What comes next for SPCX

The near-term direction will likely depend on whether earnings demand can absorb the potential supply created by the share unlock. A revenue beat and stronger guidance could help SPCX defend $107.10 and challenge $121.09.

Failure to hold $107.10 would increase the risk of a decline below $100. Conversely, a sustained break above $121.09 would provide the first meaningful technical evidence that selling pressure is easing.

With earnings due Aug. 4 and the unlock expected Aug. 6, traders face two separate catalysts capable of moving the stock sharply. Until SPCX reclaims nearby resistance, its descending trend and negative momentum indicators leave sellers in control.

Advertisement