Coldcard has temporarily suspended its automatic customer data deletion process because of legal obligations tied to the security incident disclosed on July 30, preserving records that would otherwise have been erased after 120 days.

Coldcard announced the policy change in a post on X, saying it must retain customer records that could be relevant to ongoing and anticipated legal proceedings arising from the wallet security incident.

The company said the temporary measure overrides its published data-retention schedule but added that customers who do not want their information preserved under the legal protocol can still request the application of its existing retention policy by contacting customer support.

Coldcard has paused automatic data deletion

Explaining the change, the company said its standard practice has been to “automatically blank customer records after 120 days,” keeping only customers’ email addresses and country of residence. It also noted that buyers have long been able to request accelerated deletion after their orders were delivered.

The company said the July 30 security incident has changed those procedures because it is now legally required to preserve records that may become relevant during litigation.

As a result, customer records that were scheduled for deletion under the normal 120-day policy will now be retained until further notice.

Coldcard said customers who prefer not to have their records included in that legal preservation process can contact its support team to request that their information be handled under the original retention policy instead.

Addressing privacy concerns, the company wrote that it understood the decision “is a departure from our published practices” and acknowledged that customers value the privacy protections it previously committed to maintaining.

It added that retained customer information will remain securely stored, access will be limited to authorized personnel, and the data “will not be used for any purpose other than compliance with legal obligations.” 

According to the company, the previous automated deletion system will return once legal requirements no longer require record preservation.

Security incident has already triggered investigations

The revised retention policy follows one of the largest known hardware wallet security incidents affecting Bitcoin users.

As previously reported by Galaxy Research, attackers have stolen 1,596 BTC from about 7,300 wallet addresses across three confirmed attack waves linked to the Coldcard vulnerability. The research firm said a fourth suspected wave could increase total losses to about 2,055 BTC, although it has not yet received enough victim confirmations to classify those additional thefts as confirmed.

Galaxy has distinguished its confirmed figures from blockchain-only observations. While earlier on-chain analysis identified approximately 1,815.75 BTC moving across four observed waves, the firm’s latest estimate is based on confirmed reports from affected wallet owners.

Separately, Galaxy’s head of firmwide research, Alex Thorn, said blockchain activity indicates the suspected fourth wave was “substantially comprised of” a single attacker. Even so, the firm has continued treating the additional addresses as unconfirmed until more victims come forward.

Investigators have also shared confirmed attacker and victim addresses with U.S. federal law enforcement agencies, cryptocurrency exchanges and cyber-investigation groups so the stolen funds can be monitored if they move through regulated platforms.

Firmware flaw reduced wallet seed randomness

According to Coinkite’s earlier technical disclosure, the vulnerability originated in March 2021 during the integration of a new cryptographic library into Coldcard firmware.

Instead of generating wallet seeds through the intended hardware-backed random-number generator, affected firmware accidentally relied on MicroPython’s deterministic pseudo-random generator during wallet creation.

Block’s Bitcoin engineering and security team independently reviewed the firmware and reached the same conclusion, stating that vulnerable versions called the deterministic MicroPython fallback instead of the STM32 hardware random-number generator while generating seed phrases.

Coinkite estimated that affected Mk2 and Mk3 devices provided roughly 40 bits of effective entropy, while vulnerable Mk4, Mk5 and Coldcard Q devices generated about 72 bits rather than the intended 128 bits.

Because of that weakness, attackers were able to reproduce possible wallet seeds offline, derive Bitcoin addresses from those seeds and compare them with publicly visible blockchain data. The attack did not require physical possession of affected devices, users’ PINs or any weakness in the Bitcoin protocol itself.

Most stolen Bitcoin remains untouched

Although the investigation has expanded, most of the stolen cryptocurrency has not yet moved.

Galaxy previously said about 90% of the stolen Bitcoin remained untouched, giving investigators additional time to monitor attacker-controlled addresses. Later on-chain analysis found that the largest identified attacker still holds 1,159 BTC spread across seven addresses without moving the funds.

Separate blockchain monitoring has identified activity from another attacker, however. According to analysts tracking the transactions, 64 BTC entered a transaction flow associated with a cryptocurrency mixer. Roughly 10 BTC was initially mixed, while approximately 54 BTC returned as change before being split into outputs of about 7 BTC each.

Researchers said the activity appears unrelated to the seven-address cluster holding the 1,159 BTC, indicating that multiple attackers likely exploited the same wallet weakness.

At the same time, Coinkite has continued urging affected users to replace vulnerable wallet seeds even after installing updated firmware. The company has already released patched firmware for all affected Coldcard models and destroyed remaining inventory containing vulnerable versions.

According to Coinkite, firmware updates protect only wallets created after the fix. Users whose seed phrases were generated with vulnerable firmware are advised to create entirely new seeds, verify a receiving address, send a small test transaction and move the remaining balance only after confirming the transfer works. Existing wallets created with at least 50 fair private dice rolls are not affected by this specific random-number-generation flaw.

Bitcoiners are facing a renewed warning over an active social-engineering campaign that hijacks trusted Telegram accounts and funnels cryptocurrency professionals into fake Zoom or Microsoft Teams meetings. 

Lightning News raised the alarm on Aug. 7, citing recent accounts from Bitcoin community members. Independent security research confirms the core attack chain, though not every claim has been verified.

JUMPSEC said in July that it obtained source code from an active BlueNoroff phishing kit after exposed JavaScript source maps. The researchers found a victim-acquisition platform that abuses compromised Telegram contacts, profiles cryptocurrency wallets and delivers malware to selected targets on Windows and macOS systems. JUMPSEC said identified campaign infrastructure remained active as of July 22.

BlueNoroff turns trusted Telegram contacts into lures

The attack begins with trust rather than a blockchain vulnerability. JUMPSEC found operators using compromised Telegram accounts belonging to real industry contacts to invite targets to fake video meetings. Because messages arrive from genuine accounts and can reference existing relationships, sender recognition alone provides limited protection.

Google Mandiant independently documented a similar UNC1069 intrusion in February. A victim received messages from a compromised crypto executive’s Telegram account, scheduled a meeting and was redirected to a spoofed Zoom domain. The victim reported seeing what appeared to be an AI-generated video of another crypto executive during the staged call.

Attribution needs precision. Mandiant tracks the actor as UNC1069 and says it overlaps with BlueNoroff. U.S. Treasury has formally designated BlueNoroff, also known as APT38, as a North Korean state-sponsored group controlled by the Reconnaissance General Bureau. Security Alliance likewise attributes the fake-meeting campaign to UNC1069, or BlueNoroff.

Fake meetings push ClickFix commands and malware

JUMPSEC’s reconstructed kit shows a staged meeting interface asking for webcam access before an operator joins with prerecorded video. The victim then sees a supposed audio problem and a fake software update. The displayed troubleshooting text is deceptive: copying it places an attacker-controlled ClickFix command onto the clipboard.

On Windows, JUMPSEC observed PowerShell and VBScript components capable of disabling defenses, conducting reconnaissance and supporting follow-on access. On macOS, researchers found shell scripts and Mach-O payloads designed to steal credentials and other sensitive data. The kit also scans for browser wallet providers before malware delivery, helping operators identify valuable targets.

That means the claim that merely opening a meeting link automatically drains a wallet is too broad. In the documented chains, compromise requires another action, such as running a copied command or malicious update. However, once malware executes, Mandiant found tooling capable of stealing browser data, Keychain credentials and Telegram user data.

As previously reported, Martin Kuchař said his Telegram account was compromised and used in a similar attack. Earlier victim coverage also documented crypto executives being approached through trusted contacts before fake meeting prompts attempted to install malware.

Security researchers say the campaign remains broad

Security Alliance reported that it attributed 164 blocked domains to UNC1069 between Feb. 6 and April 7. Its advisory described multi-week social engineering through Telegram, LinkedIn and Slack before fraudulent Zoom or Teams links were delivered. JUMPSEC later expanded the infrastructure picture and said high- and medium-confidence infrastructure remained active in late July.

The FBI has warned separately that North Korean actors conduct highly tailored social engineering against cryptocurrency and DeFi employees. Its guidance specifically flags requests to execute code, install unfamiliar applications, run scripts to fix video calls or move conversations between communication platforms.

The FBI recommends verifying identities through an independent channel and keeping wallet credentials, seed phrases and private keys off internet-connected devices. Two-factor authentication remains useful, but infected devices can expose session data, so compromised sessions should also be revoked from a clean device.

What Bitcoin and crypto users should watch next

The most important correction to the Aug. 7 warning is that researchers have not established one universal method for the initial Telegram takeover. Claims that expired or temporary phone numbers are the main cause remain unverified in the material reviewed. Researchers confirm compromised accounts, but the takeover mechanism can vary.

In separate Telegram platform coverage, Apple briefly removed the messaging app from its App Store over a CSAM policy review before restoring it after Telegram removed the flagged content and banned the responsible user.

Users should treat unexpected meeting requests, domain changes, audio-fix prompts and requests to paste commands as high-risk signals. If suspicious code has already run, the FBI advises disconnecting the affected device from the internet while leaving it powered on for potential forensic recovery, then contacting incident-response specialists and law enforcement.

The campaign is therefore best described as an ongoing, North Korea-linked social-engineering operation targeting the human layer around crypto custody. Its effectiveness comes from exploiting trusted identities and familiar workplace tools, not from breaking Bitcoin itself.

United States court records unsealed on Thursday show that a federal judge backed crypto exchange Bybit’s effort to trace assets stolen in the $1.5 billion North Korea-linked hack by granting the company expedited discovery. 

According to the records,  Bybit filed the lawsuit under seal on June 18 against North Korea, its Reconnaissance General Bureau, the Lazarus Group and 20 unidentified defendants. The court granted Bybit’s request for expedited discovery on June 19.

The discovery authority gives Bybit a practical route to identify alleged intermediaries and pursue a small portion of stolen assets that remains traceable, rather than relying solely on a judgment against North Korea. 

In its complaint, Bybit alleged that some traceable assets reached exchanges operating or maintaining infrastructure in the US. The company sought account-holder identities, balances and transaction histories, saying certain platforms had indicated they would cooperate after receiving a court order.

Bybit says 90% of stolen funds became untraceable

Bybit also obtained a temporary restraining order on June 19 preventing the unidentified defendants from transferring certain traceable assets. The court renewed the order on July 16 and partially granted Bybit’s request for a preliminary injunction on July 30. Some exhibits and other records remain sealed.

As of the June 18 filing, Bybit said 90.2% of the stolen assets had become untraceable after passing through mixers, cross-chain bridges and over-the-counter dealers. The remaining 9.8% had been traced to identifiable wallets, including 5.3% of the total, about $75.5 million, that had been frozen or recovered.

The figures mark a sharp drop from more than a year ago, when Bybit CEO Ben Zhou said at the time that 68.57% of the funds remained traceable. 

Related: Bybit made ‘slow but steady comeback’ in 2025 after massive hack: CoinGecko

The hack occured on Feb. 21, 2025, after attackers compromised Safe Wallet’s infrastructure. Forensic investigators said compromised credentials belonging to a Safe developer allowed the attackers to inject malicious code into its cloud infrastructure. The FBI attributed the theft to North Korea on Feb. 26, 2025. 

The lawsuit shows that Bybit is seeking the return of the stolen assets, approximately $1.5 billion in compensatory damages, punitive damages and treble damages under the US Racketeer Influenced and Corrupt Organizations Act.

Magazine: 10 weirdest things ever tokenized… including farts

HYPE price climbed above $56.80 as strong quarterly revenue, token buybacks, and rising RWA trading activity helped it rebound from the $51 support area.

HYPE price rebounds from $51 support

According to data from crypto.news, Hyperliquid (HYPE) price traded near $56.80 on Aug. 7, gaining about 2.5% over 24 hours after recovering from an early-August low around $51.20. The token reached an intraday high near $57.04 before buyers and sellers began competing around the $57 level.

The rebound has lifted HYPE roughly 11% from its weekly low, although its net seven-day gain remained closer to 3.7%. Trading volume stood near $250 million over the previous 24 hours.

The 4-hour chart shows HYPE establishing a sequence of higher lows after defending the $51–$52 region. Price has also moved above the Supertrend indicator, which currently provides dynamic support near $54.44.

The 4-hour relative strength index stood at 60.08, slightly above its signal average of 59.49. This reading points to improving buying pressure without placing HYPE in overbought territory on the shorter timeframe.

However, the token remains about 26% below its June record near $76.70. The broader chart therefore shows a recovery within a larger correction rather than a confirmed return to its previous uptrend.

Hyperliquid buybacks support the recovery

The latest move followed the release of Hyperliquid’s second-quarter performance figures. The protocol reported $169 million in quarterly revenue and said $141 million was directed toward HYPE buybacks.

Hyperliquid also passed $1 billion in cumulative protocol revenue during the quarter. HIP-3 real-world asset perpetual contracts generated $213 billion in trading volume and represented 32.2% of activity in the category covered by the report.

RWA trading contributed 6.6% of total quarterly revenue, according to the Q2 figures. The data strengthened the view that Hyperliquid is expanding beyond crypto perpetual futures into tokenized commodities, equities and other traditional-market products.

Buybacks can support HYPE by creating recurring demand using protocol revenue. Still, their effect depends on whether platform trading activity and fee generation remain high enough to offset token sales and future supply growth.

HYPE’s fully diluted valuation stood near $54 billion, compared with a circulating market capitalization of approximately $12.6 billion. That gap remains a longer-term risk because only part of the maximum token supply currently circulates.

HYPE price faces $57.30 liquidation wall

The daily chart shows HYPE attempting to move above the upper boundary of a descending channel that has guided price lower since early July. A sustained daily close above $57 would strengthen the breakout case.

The Awesome Oscillator remained negative at -5.39, showing that the broader momentum structure has not fully turned bullish. Its histogram bars have nevertheless shifted higher, indicating that bearish momentum is weakening.

The Stochastic RSI presents a more immediate warning. Its two lines stood at 95.80 and 88.35, placing the indicator deep in overbought territory. That setup does not guarantee a decline, but it raises the chance of consolidation or a short pullback before another advance.

CoinGlass’ 24-hour liquidation heatmap shows the largest nearby liquidity concentration above the market at approximately $57.20–$57.35. A move through that zone could force leveraged short positions to close and push HYPE toward $58 and $60.

Below the current price, another major liquidation cluster sits around $54.90–$55. Losing that area could accelerate a decline toward the 4-hour Supertrend support at $54.44. The next lower zones are $52 and the recent low near $51.

Analysts Split Over HYPE’s Next Target

Crypto trader Altcoin Sherpa said HYPE may be building a bottom near its current range, although he expected the outcome to depend on wider market conditions.

“The level to watch is still $50; lose that and I think we see low/mid $40s in a slow fashion,” he wrote in an Aug. 6 post.

The analyst added that he remained constructive on HYPE over the longer term. His chart placed a broader demand zone across the low-to-mid-$40 region if the $50 floor fails.

HypeDojo offered a more bullish scenario, comparing the latest $51.50 bottom with the token’s earlier rebound from $52.50 to its June record. The trader projected a possible move toward $80 by the end of August.

That target would require HYPE to clear several resistance areas, including $60, $64, $68 and the previous record around $76.70. The overbought daily Stochastic RSI also suggests that such a move may not develop in a straight line.

US competition adds risk to HYPE outlook

JPMorgan analysts have warned that momentum in HYPE-linked investment products weakened after strong inflows during May and June. A reported 12-session outflow streak reached approximately $29.8 million through Aug. 3.

The bank also pointed to competition from regulated derivatives and prediction-market platforms, according to Blockhead. That risk is particularly relevant in the United States, where regulated venues are expanding access to perpetual-style contracts.

For now, the HYPE price outlook depends on whether buyers can convert the rebound into a confirmed daily channel breakout. A close above $57.30 would open a path toward $60, while rejection and a break below $54.40 would bring $52 and $50 back into focus.

Blanket, an independently developed AI tool, is using Kalshi’s regulated event-contract markets to help small businesses identify and hedge operational risks.

Blanket matches business risks with Kalshi contracts

Blanket is designed to evaluate the risks facing a business and identify Kalshi contracts that may provide a hedge against specific outcomes. Potential exposures include unusual weather, changes in energy costs, new tariffs, and election results that could affect revenue or operating expenses.

A small business could provide information about its operations and the events most likely to disrupt them. Blanket’s AI system would then analyze those exposures and recommend available contracts connected to the relevant outcome.

The tool does not automatically place orders, control customer accounts, or handle funds. Business owners retain responsibility for reviewing the recommendations and deciding whether to trade through Kalshi.

This distinction also separates Blanket from Kalshi itself. Zminsky built the tool independently using markets available on Kalshi’s platform. Kalshi provides the underlying event contracts and regulated trading infrastructure, but Blanket is not one of its internal products.

How event contracts can hedge operational risks

Event contracts are derivatives whose payouts depend on whether a specified event occurs or a defined value is reached. The Commodity Futures Trading Commission cites corporate earnings, snowfall levels, economic indicators and hurricane damage as examples of outcomes that can underpin these contracts.

That structure can allow a business to take a position that may offset losses caused by an external event. For example, a company exposed to high energy costs could use a contract tied to future energy prices. A weather-dependent business could consider a contract linked to snowfall, temperature, or storm activity.

Blanket aims to make that process more accessible by using AI to connect a company’s stated risks with relevant markets. Small firms may lack the dedicated risk teams employed by larger corporations, making it harder to identify suitable hedging instruments.

However, an event contract does not provide the same coverage as an insurance policy. Its payout depends on the contract’s specific terms, while the recommended position may not fully match the business’s actual financial loss. AI-generated recommendations also require human review.

Kalshi pushes further into institutional risk management

Kalshi operates as a CFTC-designated contract market, a status it received in November 2020. Its role in Blanket gives the independent tool access to contracts traded through a federally regulated U.S. venue.

The development follows Kalshi’s move to expand beyond retail prediction trading. As crypto.news reported on Aug. 4, the platform partnered with compliance technology provider Comply to help financial firms monitor employee activity involving event contracts.

The planned integration will place Kalshi trades within workplace surveillance systems already used to track stocks, bonds and cryptocurrencies. Employers will be able to identify restricted positions or activity that may involve material non-public information.

Kalshi also expects the compliance system to cover its planned perpetual futures products when they become available.

Market oversight remains a key issue

The focus on surveillance follows enforcement cases involving the misuse of prediction markets. Crypto.news reported that former U.S. Representative George Santos agreed to return $17,569.98 in gains, pay a $17,500 civil penalty and accept a three-year trading ban in a CFTC settlement involving Kalshi contracts.

Kalshi had referred Santos’ activity to regulators after he traded on whether he would attend President Donald Trump’s State of the Union address while making public statements related to the outcome. Santos neither admitted nor denied the CFTC’s findings.

Blanket’s launch points to another potential use for prediction markets: commercial risk management. Its adoption will depend on whether its recommendations closely match the financial exposures of small businesses and whether users understand the limits of event-contract hedges.