OKX has scheduled the removal of six GODS, PRCL and DUCK spot trading pairs while suspending deposits for the affected tokens from Aug. 7 and setting Nov. 7 as the withdrawal deadline.

According to an OKX announcement, the exchange will remove three margin-settled spot pairs GODS/USD, PRCL/USD, and DUCK/USD, between 16:00 and 18:00 UTC on Aug. 14. Three additional spot pairs quoted in USDT and EUR will follow three days later, with GODS/USDT, PRCL/USDT and DUCK/USDT scheduled for delisting during the same two-hour window on Aug. 17.

The exchange has also introduced a phased timeline for the affected assets. Deposits for GODS, PRCL and DUCK stopped at 16:00 UTC on Aug. 7, while withdrawals for the three tokens will remain available until 16:00 UTC on Nov. 7.

OKX has split the trading pair removals across two dates

Rather than removing all markets at once, the exchange has divided the delisting into two stages.

On Aug. 14, users will lose access to GODS/USD, PRCL/USD and DUCK/USD trading pairs. Three days later, OKX will remove GODS/USDT, PRCL/USDT and PRCL/EUR alongside DUCK/USDT, completing the process for all six spot markets listed in the notice.

At the same time, the exchange has already halted deposits for the related assets, preventing users from transferring additional GODS, PRCL or DUCK tokens onto the platform. Withdrawals remain available for another three months before closing in November, giving holders additional time to move their assets elsewhere.

The announcement did not state the reason for removing the trading pairs.

Deposit suspension starts before withdrawal deadline

The published timetable separates trading, deposits and withdrawals into different stages.

Deposit services for the affected cryptocurrencies ended first on Aug. 7. Trading activity will continue until the scheduled delisting windows in mid-August, after which the listed spot pairs will no longer be available.

Withdrawal support, however, will continue until Nov. 7, providing a longer period for customers who still hold the affected tokens after trading ends.

Crypto exchanges commonly separate delisting from withdrawal deadlines, allowing users to transfer assets after markets have been removed. In this case, OKX has provided nearly three months between the end of deposits and the final withdrawal cutoff.

OKX continues operational changes across multiple markets

The latest asset removals come during a period of operational updates across several regions.

Earlier in July, Digital Asset reported that the OKX Android application had returned to South Korea’s Google Play Store after a four-day suspension, making it the first recently restricted overseas crypto exchange to regain access on the platform. The restoration followed Google’s temporary removal of the app, while exchanges such as Bybit remained unavailable in the Korean Play Store.

Digital Asset had previously found that dozens of overseas exchange applications became inaccessible on Google Play as South Korea tightened oversight of overseas virtual asset service providers operating without local registration. 

Although some exchanges had been identified by the country’s Financial Intelligence Unit as unreported VASPs, the publication reported that Google’s restrictions also affected several platforms that were not included on the FIU’s published enforcement list.

Outside South Korea, OKX has continued expanding regulated services in Europe. In July, the exchange launched a one-way USDT-to-USDC conversion service for eligible customers across 30 European Union and European Economic Area countries operating under its Markets in Crypto-Assets license. 

The service allows users to deposit USDT and voluntarily convert their holdings into MiCA-compliant USDC as European exchanges reduce support for Tether’s stablecoin following the regulation’s implementation.

OKX has also expanded its institutional strategy

Operational changes have coincided with new corporate developments at the exchange.

Last month, OKX appointed former New York Governor Andrew Cuomo to its board of directors after he had advised the company on U.S. regulatory and institutional strategy since 2023. According to the company, the appointment formalized an existing relationship as OKX continued expanding its U.S. operations following the relaunch of its U.S. exchange and self-custody wallet in 2025.

The company has also continued working with Intercontinental Exchange through a planned joint venture focused on blockchain-based financial products. According to OKX, Cuomo will remain co-chair of the initiative, which is intended to combine ICE’s market infrastructure with the exchange’s blockchain technology, subject to regulatory approvals.

Bridge has joined the EU’s MiCA register, increasing the number of authorized electronic money token issuers to 42 after securing regulatory approval in Luxembourg.

According to the latest update published by the European Securities and Markets Authority (ESMA) on Wednesday, Bridge Building, the Luxembourg-based entity behind Stripe-owned stablecoin infrastructure company Bridge, has been added to the European Union’s Markets in Crypto-Assets (MiCA) register as an authorized electronic money token (EMT) issuer.

The addition raises the number of MiCA-authorized EMT issuers in the European Union to 42. ESMA’s latest register update also added three new crypto-asset service providers (CASPs) from Germany, bringing the total number of authorized CASPs across the bloc to 324.

Bridge’s inclusion follows regulatory approvals it announced on July 2 after obtaining both a MiCA crypto-asset service provider authorization and an Electronic Money Institution (EMI) license from Luxembourg’s Commission de Surveillance du Secteur Financier (CSSF). At the time, Bridge Head of Product Mai Leduc Blount said the approvals would allow businesses across the European Union to develop stablecoin and payment products under a regulated framework.

Bridge’s MiCA approval expands regulated stablecoin services

Receiving both the CASP authorization and EMI license allows Bridge to provide regulated services throughout all 27 European Union member states under a single regulatory framework instead of requiring separate approvals in each country.

When announcing the approvals in July, the company said businesses using its infrastructure would be able to issue custom euro-backed stablecoins, create named virtual IBANs, and provide euro accounts that work across the European Union. Bridge also said fintech companies could integrate cross-border euro accounts through a single connection, while enterprises could move funds between subsidiaries using stablecoins instead of correspondent banking networks.

Blount said at the time that businesses operating in the European Union could combine euro stablecoin issuance with named IBANs and euro payouts across all member states through one integration.

The approvals came shortly after the European Union completed the final phase of its MiCA transition on July 1, requiring regulated crypto platforms to support only compliant stablecoins. Following the implementation, exchanges including Coinbase, Kraken and Crypto.com removed USDT trading for European users after Tether decided not to seek MiCA authorization, while Binance introduced service changes for customers affected by the new framework.

ESMA register adds new German CASPs

Alongside Bridge’s registration, ESMA added three German institutions to its MiCA register as authorized crypto-asset service providers.

The newly listed firms are Volksbank Die Gestalterbank, VBU Volksbank im Unterland and VR-Bank Erding. Their inclusion increases the number of authorized CASPs in the European Union from 321 to 324.

ESMA’s latest update did not introduce any new asset-referenced token (ART) authorizations, leaving that section of the register without approved issuers. The regulator also made no changes to its list of non-compliant crypto-asset companies.

Recent weeks have seen ESMA publish register updates more frequently as firms continue securing MiCA authorizations following the regulation’s full implementation across the European Union.

Stripe continues building regulated stablecoin infrastructure

Bridge’s registration comes as Stripe continues expanding the stablecoin infrastructure it acquired through its approximately $1.1 billion purchase of Bridge.

Since completing the acquisition, Stripe has integrated Bridge’s technology into its payments business while extending regulated payment services into additional jurisdictions. The company has positioned the infrastructure around stablecoin payments, cross-border settlement and financial services for businesses and developers.

In March, Visa announced an expansion of its partnership with the Stripe-owned company to introduce stablecoin-backed Visa card programs in more than 100 countries by the end of 2026.

The company has also continued building banking relationships and payment infrastructure around Bridge. Connor Fitzgerald, who recently stepped down as Stripe’s head of stablecoin partnerships after helping establish the company’s stablecoin card program, said the team built sponsor bank relationships, payment network connections and regulatory infrastructure before expanding the program internationally.

According to Fitzgerald, the stablecoin card initiative grew from launch to operations in more than 100 markets, introduced what he described as the first stablecoin settlement flow in the United States and increased annualized payment volume from zero to tens of millions of dollars.

Stablecoins remain central to Stripe’s payments strategy

Bridge’s latest regulatory milestone adds to Stripe’s recent activity in blockchain-based payments as the company continues combining regulated infrastructure with its global payments network.

Alongside expanding stablecoin products, Stripe has supported cross-border settlement, card issuance and payment services built on Bridge’s technology. The company has also remained active in traditional payments. Reuters previously reported that Stripe and private equity firm Advent International submitted a proposal worth about $53 billion to acquire PayPal.

According to Reuters, the offer valued PayPal at $60.50 per share and would give Stripe and Advent equal ownership if completed. Reuters also reported that PayPal’s board viewed the proposal as undervaluing the company while weighing financing certainty, regulatory considerations and execution risks, with discussions remaining active.

If completed, the transaction would combine PayPal’s crypto payment products, including the Paxos-issued PYUSD stablecoin, with Stripe’s expanding stablecoin infrastructure developed through Bridge. Reuters also reported that the bidders explored potential structural remedies in the event antitrust regulators require changes to the proposed transaction.

CleanSpark has reported a $239 million quarterly loss as revenue fell 30.5% year over year, while its latest AI data center lease has added a long-term revenue stream outside Bitcoin mining.

According to CleanSpark’s fiscal third-quarter results published on Thursday, the Nasdaq-listed Bitcoin mining company generated $138 million in revenue for the three months ended June 30, down 30.5% from $198 million in the same quarter last year. The figure also came in below Wall Street expectations, with Yahoo Finance analyst estimates placing the consensus forecast at $142.2 million.

For the quarter, the company posted a net loss of $239 million, or $0.89 per basic share, reversing from net income of $257 million, or $0.90 per share, recorded a year earlier.

The earnings release arrived after the company had already reported another loss-making quarter in May. For the fiscal second quarter ended March 31, CleanSpark reported a net loss of $378.3 million on revenue of $136.4 million, compared with a loss of $138.8 million and revenue of $181.7 million in the prior-year period.

CleanSpark revenue has missed analyst estimates

Alongside the decline in revenue, CleanSpark’s quarterly sales narrowly missed analysts’ expectations compiled by Yahoo Finance.

Investors reacted by sending the stock lower. Shares fell 5.5% during Thursday’s trading session before recovering about 3% in pre-market trading on Friday to trade above $13.10, according to Yahoo Finance market data.

The latest earnings follow a similar market reaction after the previous quarterly report. Following the May results, CleanSpark shares dropped more than 10% in pre-market trading after closing the previous session at $14.30. Google Finance data at the time showed the company carried a market capitalization of about $3.66 billion, with shares trading within a 52-week range of $8.00 to $23.61.

AI infrastructure has become part of CleanSpark’s strategy

Even as its Bitcoin mining business has faced weaker financial results, CleanSpark has continued expanding into artificial intelligence and high-performance computing infrastructure.

On July 14, the company signed a 20-year lease for a 175-megawatt data center at its Sandersville, Georgia, campus with an undisclosed investment-grade global technology company. CleanSpark estimated the agreement would generate about $6.6 billion in contracted revenue over the initial lease term.

Development at the Sandersville campus has been underway for several quarters. Earlier this year, the company said it had doubled its contracted megawatts from a year earlier while securing 585 megawatts of ERCOT-approved capacity in Texas to support additional AI and HPC projects.

During the May earnings release, chief executive Matt Schultz said the company planned to commercialize assets suitable for AI and HPC workloads while continuing to operate its Bitcoin mining business efficiently.

Bitcoin holdings have continued growing despite losses

Although quarterly earnings remained under pressure, CleanSpark continued adding Bitcoin to its balance sheet.

During the fiscal second quarter, the company said its Bitcoin holdings increased 14% from a year earlier while average monthly hashrate climbed 18%. It ended that quarter holding $925.2 million worth of Bitcoin alongside $260.3 million in cash.

The company also disclosed that a $224.1 million fair value loss on its Bitcoin holdings accounted for nearly 60% of its total net loss during the March quarter, following weaker Bitcoin prices during the reporting period.

Bitcoin miners have expanded into AI data centers

CleanSpark is not the only publicly traded Bitcoin miner adding AI infrastructure alongside mining operations.

Several companies across the sector have reported similar changes while dealing with earnings pressure tied to digital asset accounting.

MARA, for example, reported a $1.3 billion first-quarter loss after mark-to-market adjustments affected the value of its Bitcoin treasury.

TeraWulf separately reported that revenue from high-performance computing exceeded Bitcoin mining revenue for the first time during the first quarter, illustrating how AI-related infrastructure has become a larger contributor to its business.

Core Scientific has also increased its exposure to colocation services. As previously reported by crypto.news, the company posted a $347.2 million first-quarter loss while reporting a significant increase in colocation revenue as more capacity was allocated to AI infrastructure.

Ethereum price traded near $1,918 on Friday after reclaiming $1,900, as spot ETF inflows and improving short-term momentum supported another test of overhead resistance.

Ethereum price action today

According to data from crypto.news, Ethereum (ETH) price traded at $1,918.26 at the time of writing, up 0.74% during the daily session. The token reached an intraday high of $1,918.88 after opening near $1,904.

The move extended ETH’s recovery from the $1,850 area and kept its weekly gain above 4%. Buyers have repeatedly defended the $1,840–$1,850 region since the start of August, preventing a deeper correction toward the July lows.

Price has now moved above three closely watched daily averages. ETH is trading over its 20-day moving average at $1,895.45, its 100-day average at $1,911.42, and its 50-day average at $1,796.09.

That alignment improves the short-term outlook, but Ethereum remains below its 200-day moving average at $2,061.80. The gap shows that the latest recovery has not yet reversed the broader downtrend that began after ETH traded above $2,400 in April.

The daily Bull Bear Power reading has returned to positive territory at 32.07. The indicator suggests buyers have regained a modest advantage after bearish pressure briefly returned at the beginning of August.

ETF inflows and US jobs data support ETH

Renewed demand for US-listed spot Ethereum exchange-traded funds has provided one catalyst for the move.

The funds recorded about $92.15 million in net inflows on Aug. 6, equal to roughly 48,327 ETH at the reported market price. The latest intake followed net inflows of $60.86 million on Aug. 5, with BlackRock’s ETHA accounting for $50.34 million of that session’s total.

Cumulative net inflows into US spot Ethereum ETFs have now moved above $11.4 billion. The products give US investors regulated ETH exposure through conventional brokerage accounts, although their flows do not always produce an immediate or proportional price response.

A softer US employment reading also helped the wider risk-asset backdrop. Private employers added 44,000 jobs in July, below forecasts of about 70,000 and down from a revised 95,000 in June, according to ADP.

The weaker hiring figure pointed to some cooling in the labor market. However, annual pay still rose 4.4%, and jobless claims remained historically low, leaving uncertainty around the Federal Reserve’s next rate decision. Any renewed increase in rate-hike expectations could weigh on ETH and other risk assets.

Ethereum liquidation map points to $1,950

Ethereum’s 4-hour chart shows price moving above the Supertrend threshold near $1,907.42. Holding that level would preserve the immediate bullish structure and give buyers another opportunity to attack the recent highs.

The 4-hour Relative Strength Index stood at 61.74, above its signal average of 57.76. Momentum therefore favors buyers, but the reading remains below the overbought threshold of 70.

The 3-day liquidation heatmap shows a concentration of leveraged positions immediately above the market near $1,925. A larger liquidity band sits around $1,945–$1,955.

These pools could act as short-term price magnets. A push through $1,925 may trigger forced buying from short sellers and accelerate a move toward $1,950.

Above that level, the psychological $2,000 mark becomes the next target. Ethereum would still need to overcome the daily 200-day average near $2,062 before the broader technical structure turns decisively bullish.

Liquidity is also building below the current price. The nearest downside zones appear around $1,890, $1,870 and $1,850–$1,860. Losing $1,900 could therefore expose ETH to a sweep of leveraged long positions in those areas.

The 4-hour Supertrend support near $1,850.62 provides the main bullish invalidation level. A sustained break below it would weaken the recovery and could open a move toward $1,800 or the 50-day average near $1,796.

Analysts see $2,000 as the next Ethereum test

Analyst Michaël van de Poppe said Ethereum could outperform Bitcoin if the broader market leader begins another upward move.

“Honestly, if BTC breaks upwards, I’d assume we’re seeing a significantly stronger breakout on ETH rather than Bitcoin.”

His chart placed a broader Ethereum target near $2,400, although ETH would first need to clear resistance around $2,000 and the 200-day moving average.

Analyst Ted Pillows also focused on the reclaimed psychological level and the potential for a short-term continuation.

“ETH is still holding above the $1,900 level. Clarity Act voting has been delayed, but still Ethereum looks good. If ETH manages to hold above this level, a rally to $2,000 could happen next.”

For now, $1,900 separates the bullish and bearish short-term scenarios. A daily close above $1,925 would strengthen the case for $1,950 and $2,000, while a reversal below $1,900 would shift attention back to $1,850.

Chainalysis has warned that cryptocurrency crime has increasingly extended into kidnappings, home invasions and other violent incidents as criminals pursue holders who can transfer digital assets immediately under coercion.

According to the blockchain analytics firm’s latest report shared with crypto.news, cybercrime still accounts for most illicit crypto activity, including an estimated $3.4 billion stolen through hacks, $17 billion lost to scams and about $820 million linked to ransomware in 2025. 

At the same time, physical attacks have become more common because crypto holders often control large amounts of wealth through self-custody wallets without the institutional safeguards associated with traditional financial assets.

The report estimates that violent criminals have extracted more than $30 million from crypto holders during the first half of 2026 through successful kidnappings, hostage situations, and home invasions. If the current pace continues, 2026 would surpass the $58 million stolen during 2025, although the estimate only covers publicly reported incidents and likely understates the full scale of the problem.

Earlier this week, Galaxy Research estimated that confirmed losses from the Coldcard hardware wallet vulnerability had reached 1,596 Bitcoin across three attack waves, with a suspected fourth wave potentially lifting total losses to about 2,055 BTC if verified. 

While the Coldcard incident involved a software flaw rather than physical violence, it underscored the value of cryptocurrency that criminals continue targeting through both digital exploits and real-world attacks.

Chainalysis says on-chain trails still expose violent attackers

Although the number of attacks has increased, the report said criminals are succeeding less often. Only 12 of 46 documented violent theft attempts resulted in victims surrendering funds through late June, producing a 26% success rate compared with 49% in 2025 and 67% in 2024. 

When failed extortion attempts, blocked transfers and recovered assets are included, the value connected to violent incidents rises to roughly $107 million during the first half of 2026.

According to the report, every successful forced transfer also creates a blockchain record that investigators can examine. Analysts grouped attackers into three categories based on how they handled stolen assets after the theft.

The least experienced offenders typically sent funds directly to centralized exchanges, making compliance teams and law enforcement more likely to identify them. More capable operators used decentralized exchanges, bridges and intermediary wallets to complicate tracing before eventually cashing out.

The report identified a third category consisting of attackers who appeared connected to established criminal networks. 

In one investigated case, stolen funds passed through an instant exchange before reaching what analysts described as a suspected over-the-counter laundering service that had previous blockchain links to cartel-related laundering services, wallets associated with alleged cocaine trafficker Ryan Wedding, terrorist financing clusters and Southeast Asian money laundering networks. 

The report presented those links as blockchain exposure rather than proof that every connected entity participated in the original violent crime.

Home invasions have become more common

As investigators documented more incidents, the nature of the attacks also changed. Kidnappings continued to account for most documented wrench attacks, while home invasions climbed from 14% of incidents in 2025 to 37% through mid-2026. According to the report, criminals increasingly use homes because they can pressure victims in familiar surroundings without moving them elsewhere.

Regional patterns also differed. The United States remained an outlier for home invasions, while France experienced a much higher share of kidnapping attempts than other countries tracked in the dataset.

France’s attack surge has coincided with alleged data exposure

France has recorded the highest number of publicly known violent crypto incidents since 2023, with 30 cases reported through mid-2026 after recording 19 during all of 2025, according to the report. Interior Minister Laurent Nuñez has said authorities documented more than 70 crypto-related violent incidents and announced a rapid identification and alert system for people considered at risk.

The report pointed to an alleged 2024 theft and sale of tax records belonging to high-net-worth crypto holders as the most likely explanation for the rise in French cases. According to the report, the dossiers allegedly contained names, addresses, holdings, phone numbers and tax information that could help criminals identify potential victims. 

It also cited Waltio’s January 2026 disclosure that unauthorized access affected data connected to about 50,000 users, while stopping short of establishing a direct causal link between the breach and individual attacks.

French authorities have treated the attacks as organized crime investigations. By mid-2026, the crackdown had resulted in around 200 arrests, 88 indictments, 75 suspects held in pretrial detention and more than a dozen investigations, according to the report.

Family members have increasingly become leverage

Beyond targeting crypto holders themselves, attackers have increasingly turned to relatives and acquaintances to force victims into handing over digital assets. According to the report, family members or close relations accounted for roughly 25% to 30% of documented incidents by early 2026 after being almost absent from recorded cases in 2021. In France, more than 40% of incidents involved someone connected to the holder rather than the holder directly.

The report also found that most victims were local residents instead of visitors. Known residency data showed locals accounted for all documented victims in Sweden, 93% in France, 82% in Brazil and 77% in the United States, a pattern that the firm said points to advance reconnaissance using leaked information, blockchain activity, social media or insider knowledge.

Newly unsealed court records show a US judge granted Bybit expedited discovery in the exchange’s ongoing legal push to identify assets tied to a $1.5 billion North Korea-linked attack. The ruling is aimed at helping Bybit move from broad allegations toward practical, court-backed tracing—an approach that can matter when large portions of stolen crypto have already been obfuscated.

According to the filings, Bybit brought the case under seal on June 18, naming North Korea, the Reconnaissance General Bureau, the Lazarus Group and 20 unnamed defendants. The court granted the expedited discovery request the following day, giving Bybit a faster route to request information that could pinpoint alleged intermediaries and determine what—if any—stolen funds remain recoverable through identifiable on-chain or account-linked activity.

Key takeaways

• Unsealed records confirm a federal judge granted Bybit expedited discovery tied to the June 18 lawsuit over the $1.5 billion 2025 North Korea-linked hack.
• Bybit claims 90.2% of stolen assets became untraceable after moves through mixers, cross-chain bridges, and OTC trading channels.
• The company reports 9.8% of the funds were traceable to identifiable wallets, including 5.3% (about $75.5 million) that were frozen or recovered.
• Bybit obtained a temporary restraining order that the court renewed and partially supported with a preliminary injunction decision later in July.
• The complaint seeks relief that includes compensatory, punitive and treble damages under the US RICO statute.

Expedited discovery: turning allegations into targeted asset recovery

The court documents describe Bybit’s strategy as an attempt to identify alleged actors and intermediaries that may have handled stolen funds after the hack. Expedited discovery typically shortens the timeline for obtaining information from counterparties or other relevant parties—particularly important in high-stakes crypto cases where defendants may move assets quickly or hide trail details behind complex transaction structures.

In the complaint, Bybit alleges that some traceable assets ended up on or through platforms that operate in the United States or maintain US-based infrastructure. Bybit sought account-holder identities, balances and transaction histories, arguing that certain platforms indicated they would cooperate once a court order was issued.

From an investor and market-structure standpoint, this matters because court-ordered discovery can bridge a gap that often exists in crypto investigations: even when chain analytics suggest where funds may have gone, legal access to counterparties’ records is often what enables meaningful recovery efforts.

How much of the stolen crypto was still traceable?

Bybit’s filing includes a key metric about how the attackers allegedly laundered the stolen assets. As of the June 18 submission, the exchange said 90.2% of the funds had become untraceable after passing through mixers, cross-chain bridges, and over-the-counter dealers. The remaining 9.8% it said could be tied to identifiable wallets.

Within that smaller traceable portion, Bybit reported that 5.3% of the total theft—about $75.5 million—had been frozen or recovered. The rest of the traceable amount was described as still linked to identifiable wallets, implying it may be recoverable if the legal process can connect those wallets to accountable parties.

Bybit’s numbers also suggest a significant shift compared with more than a year earlier. The exchange previously reported that 68.57% of the stolen funds remained traceable, a claim attributed to Bybit CEO Ben Zhou at the time. In this newer filing, the traceability figure has dropped materially, underscoring how quickly stolen crypto can become harder to recover as it moves through layered obfuscation techniques.

Restraining orders and injunction steps in July

Alongside expedited discovery, Bybit secured legal measures designed to prevent alleged defendants from moving certain traceable assets while the case progresses. The company obtained a temporary restraining order on June 19 against the unnamed defendants, aimed at halting transfers of specific traceable funds.

That restraining order was renewed on July 16. The court also partially granted Bybit’s request for a preliminary injunction on July 30. While the records indicate that some exhibits and related materials remain sealed, the sequence reflects a court willingness to support Bybit’s attempt to preserve at least part of the identifiable asset set while discovery and claims move forward.

Background of the Feb. 21, 2025 hack and FBI attribution

The underlying incident dates to Feb. 21, 2025. Bybit said the attackers compromised the Safe Wallet infrastructure after gaining access through compromised credentials associated with a Safe developer. Forensic investigations cited in earlier coverage described malicious code being injected into Safe’s cloud infrastructure.

The FBI attributed the theft to North Korea on Feb. 26, 2025, according to its public notice on the incident. That attribution has been central to how regulatory and law enforcement narratives have framed the event, and it helps explain why a civil lawsuit targeting North Korea-linked entities would be pursued alongside asset-tracing and recovery measures.

In the complaint, Bybit seeks recovery related to approximately $1.5 billion, including compensatory damages, punitive damages and treble damages under the US Racketeer Influenced and Corrupt Organizations Act. In practical terms, the damages claim indicates Bybit is not only seeking to preserve and identify assets but also to establish broader liability if the court finds actionable wrongdoing and causation.

What to watch next

The immediate question is whether expedited discovery turns the “traceable” wallet subset into actionable, court-backed targets—especially given Bybit’s claim that most of the stolen crypto has already become untraceable. Readers should watch how the case develops as sealed exhibits are gradually revealed and as the court’s preliminary injunction posture evolves, because those steps can determine how much of the remaining identifiable funds can realistically be recovered.

Coldcard has temporarily suspended its automatic customer data deletion process because of legal obligations tied to the security incident disclosed on July 30, preserving records that would otherwise have been erased after 120 days.

Coldcard announced the policy change in a post on X, saying it must retain customer records that could be relevant to ongoing and anticipated legal proceedings arising from the wallet security incident.

The company said the temporary measure overrides its published data-retention schedule but added that customers who do not want their information preserved under the legal protocol can still request the application of its existing retention policy by contacting customer support.

Coldcard has paused automatic data deletion

Explaining the change, the company said its standard practice has been to “automatically blank customer records after 120 days,” keeping only customers’ email addresses and country of residence. It also noted that buyers have long been able to request accelerated deletion after their orders were delivered.

The company said the July 30 security incident has changed those procedures because it is now legally required to preserve records that may become relevant during litigation.

As a result, customer records that were scheduled for deletion under the normal 120-day policy will now be retained until further notice.

Coldcard said customers who prefer not to have their records included in that legal preservation process can contact its support team to request that their information be handled under the original retention policy instead.

Addressing privacy concerns, the company wrote that it understood the decision “is a departure from our published practices” and acknowledged that customers value the privacy protections it previously committed to maintaining.

It added that retained customer information will remain securely stored, access will be limited to authorized personnel, and the data “will not be used for any purpose other than compliance with legal obligations.” 

According to the company, the previous automated deletion system will return once legal requirements no longer require record preservation.

Security incident has already triggered investigations

The revised retention policy follows one of the largest known hardware wallet security incidents affecting Bitcoin users.

As previously reported by Galaxy Research, attackers have stolen 1,596 BTC from about 7,300 wallet addresses across three confirmed attack waves linked to the Coldcard vulnerability. The research firm said a fourth suspected wave could increase total losses to about 2,055 BTC, although it has not yet received enough victim confirmations to classify those additional thefts as confirmed.

Galaxy has distinguished its confirmed figures from blockchain-only observations. While earlier on-chain analysis identified approximately 1,815.75 BTC moving across four observed waves, the firm’s latest estimate is based on confirmed reports from affected wallet owners.

Separately, Galaxy’s head of firmwide research, Alex Thorn, said blockchain activity indicates the suspected fourth wave was “substantially comprised of” a single attacker. Even so, the firm has continued treating the additional addresses as unconfirmed until more victims come forward.

Investigators have also shared confirmed attacker and victim addresses with U.S. federal law enforcement agencies, cryptocurrency exchanges and cyber-investigation groups so the stolen funds can be monitored if they move through regulated platforms.

Firmware flaw reduced wallet seed randomness

According to Coinkite’s earlier technical disclosure, the vulnerability originated in March 2021 during the integration of a new cryptographic library into Coldcard firmware.

Instead of generating wallet seeds through the intended hardware-backed random-number generator, affected firmware accidentally relied on MicroPython’s deterministic pseudo-random generator during wallet creation.

Block’s Bitcoin engineering and security team independently reviewed the firmware and reached the same conclusion, stating that vulnerable versions called the deterministic MicroPython fallback instead of the STM32 hardware random-number generator while generating seed phrases.

Coinkite estimated that affected Mk2 and Mk3 devices provided roughly 40 bits of effective entropy, while vulnerable Mk4, Mk5 and Coldcard Q devices generated about 72 bits rather than the intended 128 bits.

Because of that weakness, attackers were able to reproduce possible wallet seeds offline, derive Bitcoin addresses from those seeds and compare them with publicly visible blockchain data. The attack did not require physical possession of affected devices, users’ PINs or any weakness in the Bitcoin protocol itself.

Most stolen Bitcoin remains untouched

Although the investigation has expanded, most of the stolen cryptocurrency has not yet moved.

Galaxy previously said about 90% of the stolen Bitcoin remained untouched, giving investigators additional time to monitor attacker-controlled addresses. Later on-chain analysis found that the largest identified attacker still holds 1,159 BTC spread across seven addresses without moving the funds.

Separate blockchain monitoring has identified activity from another attacker, however. According to analysts tracking the transactions, 64 BTC entered a transaction flow associated with a cryptocurrency mixer. Roughly 10 BTC was initially mixed, while approximately 54 BTC returned as change before being split into outputs of about 7 BTC each.

Researchers said the activity appears unrelated to the seven-address cluster holding the 1,159 BTC, indicating that multiple attackers likely exploited the same wallet weakness.

At the same time, Coinkite has continued urging affected users to replace vulnerable wallet seeds even after installing updated firmware. The company has already released patched firmware for all affected Coldcard models and destroyed remaining inventory containing vulnerable versions.

According to Coinkite, firmware updates protect only wallets created after the fix. Users whose seed phrases were generated with vulnerable firmware are advised to create entirely new seeds, verify a receiving address, send a small test transaction and move the remaining balance only after confirming the transfer works. Existing wallets created with at least 50 fair private dice rolls are not affected by this specific random-number-generation flaw.