There are 15 separate attackers draining BTC from Coldcard customers’ hardware wallets, Galaxy Research concluded on Tuesday morning — and more thieves seem to be arriving by the day.

As the exploitation of last week’s newly-discovered firmware flaw continues, estimated victim losses have topped $130 million from 7,300 wallets and rising. 

Given the number of affected wallets, there are probably thousands of victims, and many long-term holders might not even be aware of their losses. Galaxy Research has heard from 73 victims as of Monday.

The fifteenth attacker surfaced overnight after an owner reported losing less than a single BTC. That report led Galaxy to identify an uncatalogued attacker who had already pulled 12 BTC out of 126 wallet addresses.

Galaxy filed the attacker’s on-chain behavior under footprint “O,” the fifteenth letter of the alphabet.

Researchers are labeling each footprint as victims come forward, and the letters are still going up.

Because the vulnerability is public knowledge, any hacker with sufficient knowledge and computational power can join the crime wave.

Stealing money from Coldcard users simply requires scanning Bitcoin’s blockchain for vulnerable wallets and brute-force guessing of private keys that have low entropy due to Coldcard’s faulty firmware.

Bitcoin price rebounded above $64,000 as Qatar reported progress in efforts to restart US-Iran negotiations, while technical charts pointed to a possible breakout from a descending channel.

Bitcoin price rebounds above $64,000

According to data from crypto.news, Bitcoin (BTC) price traded near $64,100 late Tuesday, recovering from an intraday low around $63,300 and extending its rebound from the $62,400-$62,500 support area.

The daily chart showed BTC closing above the 61.8% Fibonacci retracement level at $63,496. Holding this threshold would keep the recovery structure intact and allow buyers to target the 78.6% retracement at $65,026.

Momentum has also improved. The daily Relative Strength Index stood at 50.30, moving slightly above its signal line at 49.94. The reading places Bitcoin in neutral territory and suggests neither buyers nor sellers have full control.

The Aroon indicator offered a more positive signal. Aroon Up stood at 78.57%, while Aroon Down fell to zero, showing that recent highs are becoming more relevant than recent lows.

However, Bitcoin remains inside a broader consolidation range between approximately $57,868 and $66,975. A daily close above $65,026 would strengthen the short-term recovery, but the July high near $66,975 remains the larger breakout level.

US-Iran talks support demand for risk assets

Bitcoin’s rebound followed Qatar’s confirmation that regional mediators were working to bring the United States and Iran back to negotiations.

Qatari Foreign Ministry spokesperson Majed Al-Ansari said Doha wanted conditions in the Strait of Hormuz to return to normal. Qatar, Pakistan, and Oman are exchanging proposals between Washington and Tehran, although no timetable has been set for an agreement.

“What matters to us now is the resumption of negotiations, and to achieve this, a ceasefire and the reopening of the Strait of Hormuz must be guaranteed,” Al-Ansari said.

The diplomatic push has eased some concerns surrounding global energy supplies. The Strait of Hormuz remains one of the world’s most important oil transit routes, meaning any reopening could reduce pressure on crude prices and improve demand for risk assets.

Still, the negotiations remain uncertain. Iran has denied holding direct talks with Washington, describing its discussions as negotiations with Oman. Shipping activity through the strait also remains restricted despite reported diplomatic progress.

For US investors, the outcome could affect Bitcoin through oil prices, inflation expectations, and broader risk sentiment. A ceasefire and restored shipping traffic could support crypto and equities, while another breakdown in talks may renew demand for cash and other defensive assets.

Bitcoin tests descending channel resistance

The 4-hour chart showed Bitcoin testing the upper boundary of a descending parallel channel that has guided price action since the July 21 peak near $66,700.

BTC briefly moved above the channel boundary before returning toward $64,100, showing that buyers have yet to confirm a breakout. The Supertrend indicator also placed immediate resistance near $64,115, almost level with the current price.

Analyst Ali Martinez identified $64,300 as the key confirmation level. According to Martinez, a 4-hour close above that price could validate the channel breakout and open the way toward $65,500 or $66,500.

The Awesome Oscillator climbed to 277.98 and printed rising green bars, indicating that bullish momentum was building on the 4-hour timeframe. However, momentum alone may not be enough if Bitcoin fails to absorb overhead supply.

Order-book data shared by analyst Ted Pillows showed large sell orders appearing between $64,000 and $65,000. This supply helps explain why BTC has repeatedly struggled to extend gains above the current range.

A confirmed break above $65,000 would place the next targets at $65,500 and $66,641. Failure to clear the channel could send the price back toward $63,500 and the 4-hour Supertrend support near $62,316.

Liquidation map keeps $62,000 in focus

The one-week Bitcoin liquidation heatmap showed a large concentration of leveraged positions near $62,000. It was the brightest liquidity band below the current price and may attract price if the recovery loses momentum.

Smaller liquidity clusters appeared around $63,000, while several bands were visible above Bitcoin between $64,500 and $66,000. These levels could fuel a short squeeze if BTC closes above $64,300 and forces bearish positions to exit.

The bullish scenario depends on Bitcoin holding $63,496 and breaking the $64,300-$65,000 supply zone. That would support targets at $65,500, $66,500, and eventually $66,975.

The bearish scenario begins with a loss of $63,500. Such a move could expose $62,421, followed by the liquidation cluster near $62,000. A deeper decline would bring the $61,347 Fibonacci level back into focus.

US-Iran diplomacy may determine which liquidity zone Bitcoin reaches first. Continued progress toward a ceasefire could support a breakout, but stalled talks or renewed disruption in the Strait of Hormuz would leave the recovery vulnerable.

At least 15 different attackers have exploited the Coldcard vulnerability, according to Galaxy Digital’s head of research, Alex Thorn, citing new victim reports received since the incident.

Thorn said Tuesday that the victim reports helped the company label new attackers that would have gone undiscovered, as the nature of the exploit was different from a hack on a centralized exchange. 

“Due to one single victim’s report of less than 1 BTC stolen, we identified a new attack with 12 BTC siphoned from 126 addresses,” Thorn wrote in a Tuesday X post.

The estimated losses from the Coldcard exploit have grown to $100 million across three confirmed attack waves, according to Galaxy Research. The company also identified a suspected fourth wave that could bring total losses to about $130 million in Bitcoin (BTC).

The ongoing attack reignited debate about the security of cold storage wallets and whether users are safer by holding their own Bitcoin. 

$2 worth of AI hardening could have prevented the exploit: Dragonfly partner

Roughly “$2 of AI hardening” could have prevented the Coldcard exploit, wrote Dragonfly managing partner Haseeb Qureshi, citing social media reports that some AI models rediscovered the vulnerability that led to the attack in less than 20 minutes.

Qureshi’s remarks came in response to multiple social media users claiming that Claude was able to regenerate the vulnerability in just eight minutes. He argued that these results may have been contaminated by web search and added that open-source AI model GLM 5.2 was able to rediscover the attack in 20 minutes with web access turned off.

However, it is unlikely that AI models would have independently discovered this vulnerability before it was made public, crypto analytics platform Tokenomist’s data lead, Tatsapat Saerejittima, told Cointelegraph. He said:

“The claim that AI found it in 2 mins came from a pseudonymous Reddit user who scanned the code after the vulnerability had already become public. There was no blind test, no documented methodology, and no assessment of the model’s false-positive rate.” 

Related: AI has not triggered DeFi ‘hackpocalypse,’ Dragonfly partner says

Vulnerability seen in private key setup

Crypto research company Castle Labs’ co-founder, Francesco, said that the growing capabilities of AI models are drastically reducing the cost and time it takes to discover new cryptocurrency vulnerabilities, but added that Coldcard’s private key may have played a role in the vulnerability.

Coldcard used a “level of private key entropy (40 bits) much lower than the standard adopted by other wallets (a 12-word seed is 128 bits), a result of a firmware bug, making the job easier,” he told Cointelegraph.

Francesco, who asked that Cointelegraph not use his last name, said he expects the cost of bug discovery to continue decreasing as AI models gain more capabilities and become more prominent in both cybersecurity and exploits.

Magazine: Does Botanix’s failure prove Bitcoiners don’t care about DeFi? 

Bitcoin saw new August highs into Tuesday’s Wall Street open as markets bet on US-Iran tensions again easing.

Key points:

• Bitcoin (BTC) edges higher as optimism over the Strait of Hormuz reopening pushes stocks to new all-time highs.
• Oil prices drop to their lowest levels since July 13 with oil traffic potentially returning on Wednesday.
• BTC acts between two daily moving averages as analysis sees “strong accumulation.”

S&P 500 tops $70 trillion market cap to new high

Data from TradingView showed BTC/USD climbing to $64,176 on Bitstamp, marking maximum daily gains of around 1%.

BTC/USD one-hour chart. Source: Cointelegraph/TradingView

Oil prices reacted immediately after US Treasury Secretary Scott Bessent suggested that traffic through the Strait of Hormuz could restart as soon as Wednesday.

Bessent told CNBC that there was “a chance we may have a deal today or tomorrow to open the Strait and move towards a more normalized position” in the US-Iran war amid ongoing talks between the two sides.

The comments came a day after US President Donald Trump confirmed the waterway reopening dialogue, saying that this could happen “as soon as tomorrow.”

WTI and Brent crude traded 4.8% and 4.6% lower, respectively, at the time of writing, hitting their lowest levels since July 13.

CFDs on US WTI crude oil four-hour chart. Source: Cointelegraph/TradingView

US stocks futures gained prior to the open, which in turn saw the S&P 500 index hit a new record high of 7,713, with its market cap reaching $70 trillion for the first time.

S&P 500 index one-hour chart. Source: Cointelegraph/TradingView

Analysts noted resolution of the Hormuz closure as one factor apt to influence market sentiment when it came to future Federal Reserve policy decisions. Amid an emerging hawkish split between Fed officials on interest rates, markets see 56.7% odds of central bank policymakers approving a 0.25% rate hike at its September meeting, per data from CME Group’s FedWatch Tool.

“Chairman Kevin Warsh’s limited guidance on the Fed’s reaction function means upcoming data, oil prices and the bond market will have a greater influence on the market’s expectations for the policy path,” Bloomberg macro strategist Michael Ball said.

Fed target-rate probabilities for September FOMC meeting.
Source: CME Group

BTC accumulation “strong” in stubborn local range

Bitcoin price action remained comparatively subdued compared to stocks as BTC/USD passed $64,000.

Related: US yen intervention puts Bitcoin, risk assets on notice for liquidity flux

The pair remained held in check by its 21-day simple moving average (SMA) at $64,388, while its 50-day SMA functioned as support on hourly time frames.

BTC/USD one-hour chart with 21-day, 50-day SMA.
Source: Cointelegraph/TradingView

With price rangebound, analysis from onchain analytics platform CryptoQuant reported “strong accumulation” among investors. 0.7% of the BTC supply, equivalent to around 155,000 coins, now belongs to investors with a cost basis between $62,000 and $65,000.

“This points to absorption rather than capitulation, as buyers accumulated into weakness,” it reported on Monday.

Magazine: How Fake World Assets and onchain gacha became crypto’s latest craze

Kalshi has partnered with compliance technology provider Comply to help financial firms monitor employee activity on prediction markets as the platform expands its institutional business while fighting a multibillion-dollar lawsuit in New York.

Kalshi adds employee trade surveillance

The partnership will integrate Kalshi trading data into Comply’s regulatory software, according to CNBC. Financial firms using the compliance platform will be able to track whether employees are trading event contracts and determine if those positions comply with internal policies.

The monitoring tools are designed to help employers identify suspicious activity, including trades that may involve material non-public information. Companies can also use the system to enforce restrictions on contracts linked to events that employees could influence or know about before the public.

Kalshi already operates an internal market surveillance program. However, conversations with institutional clients showed that firms wanted direct access to employee trading data through the compliance systems they already use.

The planned integration would place prediction market contracts alongside assets such as stocks, bonds and cryptocurrencies that are routinely covered by workplace trading controls. Kalshi also expects the system to monitor its planned perpetual futures products once those contracts become available.

Why compliance matters for prediction markets

Employee monitoring could address a major concern for banks, asset managers and other regulated financial firms considering prediction market exposure. Event contracts can cover elections, economic data, corporate developments and other outcomes that may involve sensitive information.

Traditional financial firms generally require employees to disclose brokerage accounts and receive approval for certain trades. Applying similar controls to prediction markets could make it easier for those companies to permit limited participation without creating an unmonitored source of regulatory risk.

The partnership also gives Kalshi a way to present its contracts as regulated financial products rather than conventional bets. Chief Executive Tarek Mansour recently compared the company’s structure to Nasdaq while defending its business during an Aug. 3 CNBC interview.

However, stronger private surveillance does not settle the wider legal debate over whether certain event contracts fall under federal derivatives rules or state gambling laws. That dispute has become central to Kalshi’s expansion in the United States.

Kalshi faces $36B New York lawsuit

New York Attorney General Letitia James sued Kalshi on July 31, seeking at least $36 billion in damages, penalties and other relief. Mansour said the state’s allegations could threaten the broader event contract industry.

Kalshi removed the proceeding from state court to the U.S. District Court for the Southern District of New York shortly after the complaint was filed.

New York Supreme Court Justice Melissa A. Crane then treated the state’s request for a preliminary injunction as moot because the case was no longer before her court, according to records shared by gaming law attorney Daniel Wallach. The procedural decision did not dismiss or reject the state’s allegations.

The Commodity Futures Trading Commission has also sought federal court intervention to prevent state enforcement against federally registered prediction market operators. Meanwhile, court disputes involving sports event contracts continue to test where federal oversight ends and state gaming authority begins.

Santos case shows surveillance stakes

Kalshi’s monitoring push follows a CFTC settlement involving former U.S. Representative George Santos. Regulators found that Santos made misleading public statements while holding contracts tied to whether he would attend President Donald Trump’s State of the Union address.

Under a July 31 order, Santos agreed to return $17,569.98 in trading gains, pay a $17,500 civil penalty and accept a three-year ban from trading through CFTC-registered entities. He neither admitted nor denied the agency’s findings or legal conclusions.

Kalshi referred Santos’ activity to regulators, showing how platform surveillance can lead to federal enforcement. The Comply partnership would extend part of that oversight to employers, giving institutional clients another way to detect conflicts before they develop into regulatory cases.

The rollout comes as Kalshi seeks approval for additional derivatives products. Its ability to attract financial firms will likely depend on both the effectiveness of its compliance tools and the outcome of legal challenges over prediction markets in the U.S.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.