Bitcoin (BTC) climbed above $75,000 on Friday, continuing its strongest rally in months. The flagship cryptocurrency is on track to record its best week in over two years as improving regulatory sentiment, lower bond yields, and a $3 billion short squeeze push prices higher.

The flagship cryptocurrency surged over 7% on Wednesday and another 5.36% on Thursday, decisively crossing $70,000 and closing at $73,011. The price is up 3.42% during the ongoing (Friday) session at $75,411.

Short Squeeze and Macroeconomic Headwinds Power Bitcoin Rally

The flagship cryptocurrency is up almost 8% over the past 24 hours and nearly 20% over the week, and remains on course for its highest weekly gain in over two years. The broader cryptocurrency market has also pushed higher, with Ethereum (ETH) up nearly 5%, Ripple (XRP) up 17%, and Solana (SOL) up over 5%. 24-hour trading volume has risen to $137.28 billion, while the overall cryptocurrency market cap rose 6.79% to $2.53 trillion. The most telling sign of shifting market sentiment is the Fear and Greed Index, which jumped to 69, firmly in “greed” territory.

The rally began on Wednesday (August 19), when the US Treasury announced it would double the buyback operations for the 10- to 20-year and 20- to 30-year nominal coupon operations from $2 billion to $4 billion per operation. The announcement came after 30-year bond yields hit 5.337%, the highest since 2007. Yield dropped to 5.192% following the announcement. The effect of these buybacks on the markets is almost immediate, improving liquidity conditions across the market. Rachel Lucas, an analyst at BTC Markets, stated,

“The real driver was the US Treasury doubling long-dated bond buybacks, which pulled long yields lower and lifted risk appetite broadly. Nothing has rewritten Bitcoin’s long-term case, but nothing’s rewritten its volatility either.”

President Trump’s renewed calls to Congress to advance the CLARITY Act, following a meeting with top crypto industry executives, also buoyed market expectations of a favorable regulatory environment in the US.

Spot Bitcoin ETFs Could Dictate Momentum

Meanwhile, some analysts believe ETF and spot demand will play a major role in dictating whether the breakout holds. Nicolai Søndergaard, senior research analyst at Nansen, stated that while forced short covering fueled Bitcoin’s rally, rising institutional demand and better liquidity conditions had already put the market on an upward trajectory. Søndergaard highlighted stable open interest to show that the rally was being driven by more than just traders adding fresh leverage.

“Bitcoin’s move above $70,000 reflects a combination of forced short covering, renewed institutional demand and a more supportive liquidity backdrop.”

Meanwhile, spot Bitcoin ETFs added over $600 million on Thursday, the highest since May, and marking their fourth consecutive day of inflows. Bitcoin ETFs have registered $1.61 billion in inflows so far this week, with the figure expected to climb higher on Friday as institutional investors buy strongly. Søndergaard believes spot trading and ETF inflows will determine whether BTC can build support above $70,000 and push higher once forced buying reduces. BTC’s price action has pushed it above the 20-week and 200-day moving averages and the estimated short-term holder cost basis, putting buyers in profit.

Nick Ruck, LVRG Research Director, believes the US Treasury’s announcement to double bond buybacks has improved institutional investor sentiment, helping to reverse months of substantial outflows.

However, he cautioned that only progress on the CLARITY Act, a clear course of action on interest rates, and broader access to crypto through retirement accounts could help establish a positive institutional trend.

“Sustained inflows are unlikely without additional confirmation. Until those catalysts develop, inflows will likely remain temporary rather than structural.”

Bitcoin Momentum Stretched

However, momentum is stretched, with the one-hour RSI around 78 and the four-hour RSI above 85. Positive funding rates also indicate that leveraged long positions were picking up. If BTC holds above $70,000, it could extend its rally higher, while a drop to around $69,000 could indicate a retest rather than a reversal.

White House Pushes for Crypto Legislation

President Trump met with top crypto executives from Coinbase, Ripple, Gemini, Chainlink Labs, Kraken, among others. Following the meeting, Trump urged Congress to approve the CLARITY Act, establish clear market rules, and divide market oversight between the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). Bitget Wallet Research Analyst Lacie Zhang believes the Trump administration must show lower borrowing costs, progress in high-growth industries, and a robust financial market before the November midterms.

The SEC’s Regulation Crypto Assets also provided a policy catalyst, offering crypto companies and startups exemptions under specific circumstances. However, Zhang warned that failure to advance the CLARITY Act, conflict of interest controversies, and waning regulatory momentum could sour investor sentiment.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Coinkite has rolled out a major security firmware upgrade for its Coldcard hardware wallets, aiming to harden seed phrase generation against a class of failures that can leave private keys more guessable than they should be. The company says the updates—Coldcard firmware 5.6.1 for Mk4 and Mk5 and 1.5.1Q for the Coldcard Q—change how new wallet seeds are created by requiring user-supplied entropy and combining it with multiple onboard sources of randomness.

The move comes as confirmed losses from the Coldcard exploit continue to be tallied. According to an Aug. 14 report by Galaxy Research, confirmed theft reached 1,778 BTC (about $112 million). Galaxy’s reporting also places the incident among the year’s largest crypto hacks, with DefiLlama’s aggregated data ranking it as the third-largest exploit of 2026.

Key takeaways

• Coinkite’s firmware updates require new seed phrases to include user-supplied entropy collected through interactive user actions.
• Coinkite says the collected entropy is mixed with device randomness from secure elements and the hardware RNG to reduce the impact of any single randomness failure.
• Users are instructed to upgrade immediately, but must also replace existing seed phrases before migrating funds, because old seeds are still considered vulnerable.
• The update adds additional protections around USB data handling and transaction signing by re-verifying transactions immediately before signing.
• As the ecosystem responds to “weak seed” risks, Coinspect has launched a free tool intended to detect addresses generated from known weak seed phrase datasets.

User entropy becomes a required ingredient for new seeds

The most significant change in Coinkite’s release is in the mechanics of seed phrase generation. The firmware requires that newly generated seeds incorporate user-supplied entropy through at least 65 keypresses with deliberately unpredictable timing, plus one of two additional interaction-based inputs: 50 rolls of a six-sided die or 128 coin flips. The company pairs this user input with randomness sourced from multiple hardware components, including secure elements and the wallet’s hardware random-number generator (RNG).

Coinkite’s stated goal is straightforward: even if one entropy source fails or behaves unexpectedly, the seed creation process should still produce private keys that remain hard to predict. That “defense in depth” matters for users because seed phrases are the single critical root of control in Bitcoin self-custody—if their generation is weakened, an attacker may be able to brute-force likely keys rather than needing to break cryptography.

Importantly, Coinkite stresses that upgrading the firmware does not automatically immunize existing wallets. The company told users that previously generated seed phrases remain vulnerable after the update and must be replaced with new seeds before any funds are migrated. In practice, this means the security benefit applies to future seed creation, not past ones.

Seed protection continues after a prior fix

The Thursday release follows a broader security review and extends protections that were already introduced in a July 31 firmware update. Coinkite previously said that update addressed the seed-generation failure for wallets created after that point. The new 5.6.1 and 1.5.1Q releases build on that foundation by strengthening how entropy is gathered and validated, and by adding safeguards beyond seed generation alone.

Coinkite also characterizes the new approach as closing a theoretical gap involving a compromised computer USB port. Rather than assuming the external host is trustworthy—or assuming that checks performed earlier in a workflow are sufficient—the firmware is designed to re-verify transactions immediately before signing. This reduces the chance that altered transaction data could survive earlier checks and make it onto the signing path.

Additional enhancements include hardware RNG checks and a boot-time test intended to confirm that the wallet is using the intended hardware randomness path. Coinkite further restricts how USB transfers occur by limiting downloads to the device’s most recent output and requiring an encrypted session.

Finally, certain Bitcoin signature hash modes that can allow transaction outputs to be modified are now blocked by default, tightening the rules around which transaction forms the device will sign.

Coldcard losses remain material while upgrades roll out

Even as Coinkite issues new defenses, the fallout from the Coldcard exploit continues to be quantified. Galaxy Research’s Aug. 14 report, cited in the coverage of this firmware update, put confirmed losses at 1,778 BTC (about $112 million). The same reporting context notes the incident’s scale relative to other 2026 hacks, using DefiLlama’s aggregated exploit rankings.

For users, the critical implication is that remediation must be more than “patch and hope.” The requirement to generate new seed phrases underscores that the security model is tied to how a wallet was originally initialized. In other words, if a wallet was created under weaker randomness assumptions, the safest path is typically to replace the root of control rather than rely on later software fixes.

Given the confirmed-loss magnitude, these upgrades also carry practical urgency for anyone who used affected wallets and has not yet assessed whether their seed phrase was produced under the vulnerable conditions. The firmware update provides a clearer security story for new wallet initialization, but it does not undo exposure retroactively.

Software tools emerge to identify weak-seed exposure

Alongside firmware changes, the security ecosystem is increasingly focused on detection. Coinspect announced Unlukey, described as a free public tool for identifying wallet addresses generated from weak seed phrases. In a Friday post on X, Coinspect said the initial version aims to reproduce known weak seed generation behavior and then check whether public addresses fall into an affected dataset.

This kind of tooling matters because it moves the conversation from “what might be vulnerable” to “is this specific wallet address likely connected to weak-seed generation.” While such tools cannot replace operational security measures—such as upgrading, re-seeding, and moving funds—their role is to help users triage and focus on wallets most likely to be impacted.

The broader context for weak-seed risks includes claims from TRM Labs, which stated that a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets. TRM Labs said this reduced key strength from 128 bits to 40 bits, making affected keys “brute-forceable without physical access.” Those figures are particularly relevant because they illustrate how far a randomness failure can go beyond a small quality-of-randomness issue—potentially changing the feasibility of an attacker’s search.

For builders and traders alike, the evolving response highlights a pattern seen across major wallet incidents: security upgrades address the technical causes going forward, while independent detection tools attempt to quantify exposure in the wild. Investors should watch how these tools perform in practice—especially whether they gain broader validation and whether they help more users act quickly and correctly.

Next, users running older Coldcard firmware should confirm they are using the latest releases and follow Coinkite’s guidance on re-seeding before moving funds, while the wider community will likely keep evaluating how detection tools like Unlukey map to real-world exposure. The remaining uncertainty is how comprehensively the weak-seed issue affected wallets in circulation—and whether further forensic work will refine estimates as additional data comes in.

Coinkite has released a major security upgrade for its Coldcard hardware wallets aimed at strengthening seed-phrase generation by forcing users to contribute unpredictable entropy. The change is designed to ensure private keys remain hard to predict even if one of the device’s randomness sources underperforms.

In a Thursday blog post, Coinkite announced firmware 5.6.1 for the Coldcard Mk4 and Mk5, and 1.5.1Q for the Coldcard Q. The company said affected users must upgrade immediately and—critically—replace any existing seed phrases before moving funds.

Key takeaways

• Coinkite’s new firmware changes how Coldcard generates seed phrases by mixing user-supplied entropy with multiple device randomness sources.
• For newly generated wallets, the firmware requires user input via at least 65 keypresses with unpredictable timing (or equivalent die/coin-rolling actions).
• Even after upgrading, previously generated seed phrases remain vulnerable and must be replaced with new seeds before migrating funds, Coinkite says.
• The update also adds safeguards around USB handling, transaction verification timing, hardware RNG checks, and boot-time integrity testing.
• Separately, Coinspect launched Unlukey, a free tool intended to help detect wallet addresses potentially linked to weak-seed generation.

Seed phrases now rely on more user unpredictability

At the center of Coinkite’s update is a shift in seed generation. According to the company, newly generated seeds must incorporate user-supplied entropy through interactive actions, including at least 65 keypresses with intentionally unpredictable timing. Coinkite also describes alternative entropy contribution methods: 50 rolls of a six-sided die or 128 coin flips.

That input is then combined with randomness from several parts of the device, including secure elements and the wallet’s hardware random-number generator (RNG). Coinkite frames the redesign as defense-in-depth: by requiring user entropy and mixing it with internal sources, the resulting private keys should remain unpredictable even if one device entropy source fails or is otherwise compromised.

Importantly, Coinkite’s guidance is not limited to upgrading. The company warns that existing seed phrases do not become safe just because the firmware is updated; users must generate new seeds and replace the wallet’s backing recovery phrase before migrating funds.

Coinkite adds transaction and USB safeguards

The new firmware follows an earlier July 31 update that Coinkite says already corrected the seed-generation failure for newly created wallets. In its Thursday announcement, Coinkite describes the latest release as the result of additional security review over the subsequent weeks, expanding protections beyond seed generation.

One element targets how transactions are processed when a Coldcard is connected to a potentially compromised computer. Coinkite says the firmware re-verifies transactions immediately before signing—an approach intended to counter a theoretical attack involving a compromised USB port. In other words, the device aims to confirm that what it signs is still what it expects, right up to the moment it produces a signature.

Coinkite also describes new hardware RNG checks and a boot-time test designed to confirm the wallet is using the intended hardware pathway. Beyond randomness integrity, the update restricts USB downloads to the device’s most recent output and requires an encrypted session, reducing opportunities for manipulated data to be fed to the wallet during the workflow.

Finally, the firmware blocks certain Bitcoin signature hash modes by default—specifically those that could allow transaction outputs to remain modifiable under the affected conditions Coinkite references.

Impact from the Coldcard exploit remains significant

While Coinkite focuses on preventing additional exposure, the ongoing consequences of the Coldcard exploit continue to shape the security landscape. Galaxy Research reported that confirmed losses associated with the exploit reached 1,778 Bitcoin, worth about $112 million, in an Aug. 14 report. Galaxy’s assessment is linked to a broader figure compilation, and DefiLlama data aggregated in the same context ranks the Coldcard hack as the third-largest cryptocurrency exploit of 2026.

These figures underline why seed-generation hardening and secure transaction flows matter to users: even hardware-wallet protections can be undermined if randomness used for key material is weak or if signing operations can be influenced through connectivity or timing issues.

Weak-seed detection tools enter the ecosystem

Alongside firmware fixes, at least one blockchain security firm is working on software approaches to identify potential victims of weak seed generation. Coinspect revealed Unlukey, a free public tool for identifying wallet addresses that may have been generated from weak seed phrases.

In a Friday X post, Coinspect said the first iteration of Unlukey focuses on reproducing known weak seed generation patterns and checking whether public addresses appear in the affected dataset. While this does not automatically prove that any given address belongs to an exposed wallet, the tool is positioned as a way to narrow down exposure for individuals and analysts who are investigating risks related to the Coldcard incident.

Context on the underlying weakness comes from TRM Labs, which said in an analysis that a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets. TRM Labs reported that the issue reduced key strength from 128 bits to 40 bits, making keys “brute-forceable without physical access.”

Coinspect’s decision to build an address-level detection method suggests the broader industry takeaway from the Coldcard episode: even when hardware vendors issue patches, secondary tooling can help the ecosystem identify which wallet outputs and addresses may be most at risk based on how seed generation was implemented in the past.

Readers should watch how users apply Coinkite’s guidance—especially the requirement to replace existing seed phrases before moving funds—and whether address-detection tools like Unlukey continue to expand coverage as more information about weak-seed generation patterns is validated.