Who’s paying?

US spot Bitcoin exchange-traded funds (ETFs) recorded $517.2 million in net inflows on Wednesday, their largest single-day investment since May 4, pushing August net inflows to $1.47 billion.

The funds have taken in about $1 billion since Monday, already their strongest weekly net inflow since the week ended Jan. 16, when they attracted about $1.42 billion.

The inflows came as crypto prices rallied on Wednesday, alongside a US Treasury decision to expand buybacks of longer-dated government debt and renewed attention on crypto regulation after President Donald Trump urged Congress to advance the CLARITY Act at a White House event.

“The Treasury signalling it’ll step in at the long end pushed yields and the dollar lower, and gold and silver outperformed equities on the day, so the market priced this as a currency event rather than a growth one,” Jonatan Randin, senior market analyst at PrimeXBT, told Cointelegraph.

“Bitcoin moved with gold and silver rather than with risk appetite, which is what the debasement trade looks like when it’s working,” he said.

Bitcoin traded near $72,000 at the time of writing on Thursday, up 11% in the last 24 hours, according to CoinGecko. Ether rose 19% to $2,286.

Spot Ether ETFs logged $189.2 million in net inflows on Wednesday, bringing this week’s inflows to about $291.5 million.

Related: Standard Chartered analyst eyes $100K BTC as US Treasury doubles long-end buybacks

This article is produced in accordance with Cointelegraph’s Editorial Policy and is intended for informational purposes only. It does not constitute investment advice or recommendations. All investments and trades carry risk; readers are encouraged to conduct independent research.

Blockchain interoperability project LayerZero has lost a dozen partners this year as its ZRO token shed a third of its value.

The latest departure, Ethereum node service provider Nethermind, ran one of the verifiers that LayerZero advertised to enterprise users. It migrated to one of LayerZero’s competitors and terminated its role as verifier on Wednesday.

It joins a long list.

• Kelp DAO exited LayerZero in May after it lost $292 million through a bridge that a single LayerZero verifier secured.
• Solv Protocol deprecated its LayerZero bridges two days later, with Re.xyz making the same move. 
• The following week, Kraken shifted its kBTC BTC-linked token off LayerZero, while Lombard pulled over $1 billion of BTC-backed assets one day later.
• Virtuals Protocol left LayerZero in June. Yuzu Money completed its exit in early July, and Mantle swapped out its Super Portal days later.
• BitGo took $7.7 billion of wrapped BTC out of LayerZero’s ecosystem in August.
• Huma Finance declined to use LayerZero for its product launched earlier this year.

Even the Wyoming Stable Token Commission, the lone state government in the pack of LayerZero partners, dropped its token bridge on Tuesday. 

LayerZero targeted by Lazarus Group

More than $7 billion in assets had migrated off LayerZero by early July. BitGo’s exit lifted the tally toward $15 billion.

The panic began after LayerZero admitted that hackers at Lazarus Group poisoned its internal RPCs in April.

“We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions,” it said.

Protos documented the immediate fallout from that incident, with Aave pausing ETH-pegged token markets from LayerZero as depositors rushed for the exits.

Read more: Aave TVL still down 43% since KelpDAO hack

Advertisement

Hard to recover from an 88% drawdown

LayerZero co-founder and CEO Bryan Pellegrino dismissed much of the early criticism as untrue.

Another defender argued that the departures amount to “about 3% of actual usage in volume and less than 1% of messages.”

Still, LayerZero has been retreating. ZRO, has lost 31% of its value this year, 56% over the past 12 months, and 88% from its December 2024 all-time high.

In July, it announced it was “winding down support for a number of chains with minimal activity across our offchain services and Stargate products.”

Advertisement

The same notice told Stargate users on those chains, “Failure to act before chain support is fully deprecated will result in losing access to your funds.”

LayerZero warned teams still using v1 libraries would face an August 3 shutoff.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

Bitcoin (BTC) saw multimonth highs after Thursday’s Wall Street open while stocks dipped and bond yields rebounded on US-Iran war nerves.

Key points:

• Bitcoin builds on its highest levels in 11 weeks to hit $72,500 on Bitstamp.
• US bond yields see volatility after president Donald Trump threatens “economic warfare” with Iran.
• Bitcoin market participants question whether the rally has staying power.

US bond yields reverse higher after Trump pledges “economic warfare” with Iran

Data from TradingView showed BTC/USD retesting $71,000 before hitting new 11-week high of $72,505 on Bitstamp, up by more than 4% on the day.

BTC/USD one-day chart. Source: Cointelegraph/TradingView

US equities opened lower after US president Donald Trump threatened Iran with the “most crushing economic operation ever taken against any country,” calling it “Economic D-Day.”

“This will be economic warfare and isolation on an unprecedented scale,” he wrote in a post on Truth Social amid frustration over the lack of a deal with the US on the Strait of Hormuz oil route.

WTI crude oil reached $87.69 per barrel on the day, its highest since July 24.

CFDs on WTI crude oil one-day chart. Source: Cointelegraph/TradingView

The comments further appeared to cause a rebound in US government bond yields, which had fallen sharply the day prior after the US Treasury announced that it would at least double the size of its bond-market liquidity interventions from September.

The 30-year yield traded as low as 5.179% on the day before rebounding to 5.266% — an increase of 9 bps, which nearly erased the previous downside. The 10-year bond yield also reversed the previous day’s drop.

US 30-year bond yields one-day chart. Source: Cointelegraph/TradingView

The Kobeissi Letter cast doubt on whether the intervention would be sufficient to calm markets. 

“It’s going to take a lot more intervention to tame this beast,” it wrote in a post on X. The Treasury confirmed in its announcement that it would revisit the size of debt buyback operations on Nov. 4.

US 10-year bond yields chart. Source: The Kobeissi Letter on X.com

Analysis: Too early to call Bitcoin bull-market comeback

After gaining nearly $10,000 over four days, Bitcoin left market participants skeptical about the durability of its newfound strength.

Related: Bitcoin has ‘largely purged’ froth that preceded 50% drop from $126K: BlackRock

In ongoing X coverage, trader and analyst Rekt Capital argued that BTC/USD would need to sustain its gains to challenge the grip of the bear market.

“Bitcoin will need to rally a lot more than what it has produced thus far if price is to invalidate the ‘weakening support’ idea. At the moment, technicals are pointing to $60k as a weakening macro support,” he wrote on Thursday.

A further post noted that four-year BTC price cycle patterns would allow for a new macro BTC price low until the end of 2026.

BTC/USD one-month chart. Source: Rekt Capital on X.com

Continuing, Ki Young Ju, CEO of onchain analytics platform CryptoQuant, flagged the return of positive demand for Bitcoin on both spot and derivatives markets — a phenomenon not seen since October 2025, when BTC/USD saw its most recent all-time high of $126,200.

“The scale remains modest, but if this holds for another month, it would be reasonable to conclude that the bear market is over and a new bull cycle has begun,” he told X followers.

Previously, Cointelegraph reported on the lack of spot demand as a key missing catalyst for a sustainable crypto market reversal.

Bitcoin demand growth data. Source: Ki Young Ju on X.com

Coldcard has released firmware versions 5.6.1 and 1.5.1Q after a three-week security review, while warning that users with affected seed phrases must create new wallets and move their Bitcoin.

Coldcard firmware adds mandatory user entropy

Coldcard said in an Aug. 20 post that the latest release followed three weeks of review after its July 31 emergency fix, which addressed a flaw in how some versions of its firmware generated wallet seed phrases.

The Bitcoin hardware wallet maker released version 5.6.1 for its Mk4 and Mk5 devices and version 1.5.1Q for Coldcard Q. According to the company, the review covered the earlier seed-generation failure and several areas involved in transaction signing, device connections, firmware installation, and random-number checks.

🚨 New COLDCARD firmware is available: 5.6.1 for Mk4/Mk5 and 1.5.1Q for Q.

This release follows three weeks of sustained review since our July 31 hotfix. We continue to acknowledge the customers who suffered severe financial losses from the seed-generation attack.

Every newly… pic.twitter.com/zmrEwh58eI

— COLDCARD (@COLDCARDwallet) August 20, 2026

Under the updated process, every new seed phrase must receive at least one source of randomness directly from the device owner. Users can provide it through at least 65 key presses with unpredictable timing, 50 private rolls of a physical six-sided die, or 128 physical coin flips.

Coldcard said the device combines that user input with fresh data from the STM32 true random-number generator and its two secure elements, known as SE1 and SE2. Requiring input from separate sources reduces reliance on any single component during seed creation, according to the company.

“Every newly generated seed now requires one source of user entropy,” Coldcard said.

Users must keep their key presses, dice results, or coin tosses private because anyone who records the inputs may gain information that could help reconstruct the resulting wallet. The company’s instructions treat its standard seed process separately from its advanced dice-only method, which has its own minimum requirements.

Existing Coldcard seeds cannot be repaired by updating

Installing the latest release only changes how Coldcard creates seeds after the update. The company warned that firmware cannot add missing randomness to a seed phrase that was generated previously.

Affected users must update their device first, create and verify an entirely new seed, and transfer their Bitcoin to addresses controlled by the replacement wallet. Importing the old words into updated Coldcard firmware, a different hardware wallet, or a software wallet preserves the same weakness because the underlying seed remains unchanged.

Coldcard advised users to record the replacement seed offline, confirm the wallet’s receiving address on the device screen, and complete a small test transfer before moving the full balance. Owners should keep the old backup until they have checked that the migration succeeded, but they should not continue using it to receive funds.

As reported on Aug. 2 by crypto.news, the official warning applies to seeds created on specific firmware versions rather than every seed ever produced by a Coinkite device. Mk2 and Mk3 seeds generated on versions 4.0.1 through 4.1.9 fall within the affected range.

For Mk4 and Mk5 devices, the advisory covers seeds generated before standard firmware 5.6.0 or Edge firmware 6.6.0X. Coldcard Q users are covered when their seeds were created before standard version 1.5.0Q or Edge version 6.6.0QX.

Mk1 devices are outside the firmware regression identified by researchers, while Coinkite products, including TAPSIGNER, OPENDIME, and SATSCARD, use different software and are not covered by the same disclosure.

Coldcard previously identified an exception for wallets whose owners added at least 50 fair, independent, and private dice rolls before their final seed words were produced. According to the company, the rolls supplied at least 128 bits of independent randomness. Users who cannot remember how many rolls they entered, used fewer than 50, or exposed the sequence were advised to migrate.

A BIP-39 passphrase can create another barrier between an attacker and a wallet, but Coldcard said a passphrase does not repair the seed itself. Owners of affected seeds were therefore told to replace the underlying recovery phrase even if they had added a strong passphrase.

Firmware 5.6.1 tightens signing and device boundaries

Beyond seed creation, the release adds staged verification of partially signed Bitcoin transactions immediately before signing. A partially signed Bitcoin transaction, commonly called a PSBT, lets a wallet review and approve transaction data without exposing its private keys to an online computer.

Coldcard said the new check divides PSBT verification into stages before the device produces a signature. The company also changed its default SIGHASH handling, which determines which parts of a Bitcoin transaction a signature covers.

Additional changes strengthen the boundaries around USB connections and firmware updates. The release also improves Delta Mode isolation, fixes backups involving the active wallet, and adds checks around random-number generator initialization and possible faults.

Users downloading the update were told to verify its digital signature before installation. Firmware signatures allow an owner to check whether a file came from Coldcard and whether it was altered after publication.

The release follows a seed-generation flaw introduced during a firmware change in March 2021. Block’s Bitcoin engineering and security team said affected software called a deterministic MicroPython fallback when creating wallet seeds instead of using the intended STM32 hardware random-number generator.

According to Block’s review, older Mk2 and Mk3 devices could produce seeds with about 40 bits of effective randomness, while vulnerable Mk4, Mk5, and Q devices received some input from a secure element but reached only about 72 bits. Both figures were below the intended 128-bit level, making some seeds practical to search offline.

An attacker who generated possible seeds could derive their Bitcoin addresses and compare them with public blockchain records. Finding a match would provide the private keys needed to transfer the funds without obtaining the physical device, learning its PIN, or attacking the Bitcoin network.

A subsequent analysis of the flaw detailed four suspected attack waves that removed an estimated 1,816 BTC from more than 5,200 addresses. Loss estimates have varied as researchers separated confirmed victim reports from addresses identified through transaction patterns.

Coldcard attack changed custody choices for US holders

The incident also affected how some Bitcoin owners approached custody. An Aug. 4 report on exchange inflows cited OKX Chief Compliance Officer Jonathan Brockmeier as saying the exchange recorded unusually high deposits after the Coldcard attacks.

“We’re seeing record levels of inflows now to centralized exchanges post-Coldcard,” Brockmeier said.

Moving Bitcoin to an exchange removes the owner’s direct responsibility for seed generation and storage, but it places control of the assets with a third-party custodian. US investors who only want exposure to Bitcoin’s price can also use spot Bitcoin exchange-traded funds, whose shares trade through regulated brokerage accounts while institutional custodians hold the underlying Bitcoin.

Galaxy Research said it shared suspected attacker addresses with exchanges, blockchain investigators, and US federal law enforcement agencies. The research firm also reported in early August that about 90% of the Bitcoin taken during the confirmed attack waves had not moved from the identified destination wallets.

What happened to Hind Rajab