Blockchain security firm CertiK says it has observed early laundering behavior tied to the ongoing Coldcard hardware wallet exploit: about 64 Bitcoin (valued at roughly $4.17 million) and 200 Ether (about $380,000) were reportedly sent to crypto mixing services after the theft began.

CertiK-linked onchain movements include a transfer of the 64 BTC from a source address labeled by CertiK to the Wasabi mixing protocol on Tuesday, while the 200 ETH was reportedly moved to Tornado Cash on Wednesday, according to CertiK’s X updates and address-level data shared by the firm.

Key takeaways

• CertiK reports 64 BTC and 200 ETH connected to the Coldcard exploit were routed through Wasabi and Tornado Cash, respectively.
• Mixing services pool funds and obscure transaction linkages, which can reduce recovery odds for stolen assets.
• TRM Labs’ analysis suggests most victim funds remain concentrated in a limited set of attacker-controlled addresses with relatively few mixing attempts so far.
• Galaxy Digital previously estimated losses from the Coldcard incident are at least $100 million in BTC, with a possible larger figure if additional attack waves are confirmed.

Laundering signals after the Coldcard theft

According to blockchain security platform CertiK, a portion of the stolen funds has already been processed through privacy-focused tooling designed to break onchain traceability. The Bitcoin leg involved approximately 64 BTC moving to Wasabi, a well-known mixing protocol that pools deposits and then redistributes funds in ways that make sender-recipient matching significantly harder.

On the Ethereum side, CertiK said 200 ETH was transferred to Tornado Cash. As with other mixers, Tornado Cash works by combining deposits and obfuscating the direct onchain relationship between the address that initiated a transaction and the eventual withdrawal target.

CertiK also suggested the behavior may not reflect only a single actor. “We think it might be a smaller exploiter. There’s likely a few copycats after the initial exploit,” a CertiK spokesperson told Cointelegraph. That aligns with broader incident reporting that has described multiple parties attempting to monetize the same underlying vulnerability.

Why mixers matter for recovery efforts

When stolen assets are transferred into mixers, investigators often lose the clean “paper trail” that typically helps identify where funds end up. Mixing protocols generally work by aggregating multiple users’ funds and then redistributing in a way that disrupts public linkage between deposits and withdrawals.

That structural design can lower the probability of timely asset recovery, especially when stolen funds are quickly moved and there is limited opportunity for authorities and compliance teams to intervene. Even so, blockchain analysis is not rendered useless—large-scale monitoring can still sometimes detect patterns, track high-level flows, and correlate timing and fund sources, depending on how thoroughly attackers operationalize the mixing step.

The wider context also underscores the stakes: earlier this year, the Kelp DAO hack saw an attacker launder nearly all of roughly 75,700 ETH—then valued around $175 million—primarily through THORChain, with additional use of the Umbra privacy protocol. That precedent illustrates how quickly adversaries can shift stolen funds across multiple privacy and liquidity layers.

Coldcard losses still mounting, with wave-by-wave tracking

The Coldcard exploit has already grown into one of the largest crypto hacks reported for 2026. Galaxy Digital previously stated the incident drained at least $100 million worth of Bitcoin across three confirmed attack waves sourced from around 7,300 victim wallets.

Galaxy also identified a suspected fourth wave, which—if confirmed—could lift projected losses to approximately $130 million in BTC. This “wave” framing matters to traders, holders, and incident responders because it implies the attacker activity may not be confined to a single moment, and that additional funds could be moving even after initial reports.

In parallel, CertiK’s observations of mixer usage offer a practical marker of how quickly some stolen funds are being processed. While the amounts highlighted by CertiK are not the full scale of the event, they signal that at least some attackers appear to be prioritizing trace obfuscation early in the lifecycle of the theft.

TRM Labs: most funds remain concentrated, suggesting limited follow-through

Further insight comes from onchain tracing by TRM Labs, which—according to a Thursday report—found that the majority of victim funds were still pooled in a relatively small number of attacker-controlled addresses, with limited mixing activity so far.

TRM Labs also said that differences in transaction construction across each attack wave suggest multiple attackers behind the exploit. This is consistent with Galaxy’s earlier findings that at least 15 different attackers may have exploited the Coldcard vulnerability.

TRM Labs attributed the underlying issue to a firmware bug from March 2021 that weakened seed randomness on some Coldcard wallets. The company said that the reduced key strength made the affected keys brute-forceable without physical access, highlighting why the exploit could be rapidly replicated once the vulnerability’s practical impact became known.

On the broader theme of prevention, Dragonfly managing partner Haseeb Qureshi argued on social media that comparatively small improvements could have mitigated the risk. He referenced “$2 of AI hardening” as a shorthand for strengthening defenses, citing reports that some AI models rediscovered the vulnerability leading to the attack in less than 20 minutes.

What to watch next

As the Coldcard case continues to evolve, the key variable is whether additional funds keep flowing into mixers and whether concentration patterns change across wallets and attacker clusters. Investors and incident-trackers should watch for confirmation of further attack waves, and for whether laundering activity expands beyond the early examples highlighted by CertiK and the limited mixing behavior observed by TRM Labs.

Crypto ETF options let traders buy calls and puts on Bitcoin and Ethereum exchange-traded funds. This guide explains how they work, why they matter, and what strategies traders actually use.

Options on cryptocurrency exchange-traded funds arrived in the United States in late 2024 and immediately changed how institutional and retail traders interact with the crypto market. Before these products existed, traders who wanted leveraged or hedged exposure to Bitcoin or Ethereum had two choices: trade perpetual futures on offshore exchanges or use the limited options contracts available on platforms like Deribit. Both paths carried counterparty risk, regulatory ambiguity, and operational complexity that kept most traditional finance participants on the sidelines.

The approval of options on spot Bitcoin ETFs changed that equation. For the first time, a trader with a standard brokerage account at Fidelity, Schwab, or Interactive Brokers could buy a call option on Bitcoin exposure using the same interface, the same clearing infrastructure, and the same regulatory protections that apply to options on the S&P 500.

This guide explains what crypto ETF options are, how they are priced, what strategies traders use, and where the risks hide.

How options work at the most basic level

An option is a contract that gives the buyer the right, but not the obligation, to buy or sell an underlying asset at a specific price on or before a specific date. The buyer pays a premium for this right. The seller (also called the writer) collects the premium and takes on the obligation.

There are two types of options. A call option gives the buyer the right to buy the underlying asset at the strike price. A put option gives the buyer the right to sell the underlying asset at the strike price. Every option contract specifies four things: the underlying asset (in this case, shares of a crypto ETF), the strike price, the expiration date, and whether it is a call or a put.

When a trader buys a call option on IBIT (BlackRock’s spot Bitcoin ETF) with a strike price of $50 and an expiration date 30 days away, they are paying a premium today for the right to buy 100 shares of IBIT at $50 per share at any point in the next 30 days. If IBIT rises to $60, the option is worth at least $10 per share, or $1,000 per contract. If IBIT stays below $50, the option expires worthless and the trader loses only the premium paid.

Put options work in the opposite direction. A trader who buys a put option on IBIT with a $50 strike profits when IBIT falls below $50. The put gives them the right to sell at $50 even if the market price drops to $40, $30, or lower.

Which crypto ETF options are available

As of mid 2026, options are available on several spot cryptocurrency ETFs listed in the United States. The most actively traded include options on IBIT (BlackRock iShares Bitcoin Trust), FBTC (Fidelity Wise Origin Bitcoin Fund), and ETHA (BlackRock iShares Ethereum Trust). The Options Clearing Corporation (OCC) clears all of these contracts, providing the same counterparty guarantee that backs every listed option in the US market.

The approval process was not instant. The SEC approved spot Bitcoin ETFs in January 2024 but did not approve options on those ETFs until October 2024. The delay reflected concerns about market manipulation, position limits, and the interaction between spot crypto markets (which trade 24/7) and options markets (which trade during US exchange hours). The SEC ultimately set position limits of 25,000 contracts for Bitcoin ETF options, later expanded as liquidity grew.

Ethereum ETF options followed a similar path. Spot Ethereum ETFs launched in July 2024, and options approval came in 2025 after the SEC reviewed trading data from the initial months of spot ETF trading.

The volume numbers tell the adoption story. IBIT options regularly rank among the top 10 most actively traded option contracts in the entire US market, alongside options on SPY, QQQ, and AAPL. On peak days, IBIT options volume has exceeded 1.5 million contracts, representing notional exposure to billions of dollars in Bitcoin.

How crypto ETF options are priced

Options pricing follows the Black-Scholes framework, modified for the specific characteristics of crypto ETFs. The five primary inputs are the current price of the underlying ETF, the strike price, the time to expiration, the risk-free interest rate, and the implied volatility of the underlying asset.

Implied volatility is where crypto ETF options diverge most dramatically from traditional equity options. The implied volatility of Bitcoin ETF options typically ranges from 50% to 90% annualized, compared to 15% to 25% for S&P 500 options. This higher volatility means crypto ETF options are significantly more expensive in absolute terms than options on traditional equity ETFs.

The volatility smile, a pattern where out-of-the-money options trade at higher implied volatilities than at-the-money options, is particularly pronounced in crypto ETF options. Put options on Bitcoin ETFs tend to trade at elevated implied volatilities because the market prices in the possibility of sharp drawdowns. Call options far above the current price also carry premium because Bitcoin has historically produced large upside moves that would be considered extreme outliers in equity markets.

Time decay, measured by the Greek letter theta, erodes option value as expiration approaches. This effect is especially important for crypto ETF options because the high implied volatility means the absolute dollar amount of daily time decay is larger than for comparable equity options. A 30-day at-the-money call option on IBIT might lose $0.15 to $0.25 per day in time value, while a similar option on SPY might lose $0.05 to $0.10.

Delta measures how much the option price changes for a $1 move in the underlying ETF. An at-the-money call has a delta near 0.50, meaning it moves roughly $0.50 for every $1 move in the ETF. Deep in-the-money options have deltas approaching 1.0 and behave almost like the underlying shares. Far out-of-the-money options have low deltas and are essentially leveraged bets on large price moves.

Strategies traders actually use

The strategies applied to crypto ETF options range from simple directional bets to complex multi-leg structures. The most common fall into four categories: directional, income, hedging, and volatility.

Long calls and long puts are the simplest directional strategies. A trader who expects Bitcoin to rise buys calls. A trader who expects Bitcoin to fall buys puts. The maximum loss is limited to the premium paid, while the potential profit is theoretically unlimited for calls and substantial for puts (down to zero on the underlying). The appeal of long options is defined risk: a trader knows exactly how much they can lose before entering the trade.

Covered calls are the most popular income strategy. A trader who holds shares of IBIT sells call options against those shares, collecting the premium as income. If IBIT stays below the strike price, the calls expire worthless and the trader keeps both the shares and the premium. If IBIT rises above the strike, the shares are called away at the strike price, capping the upside. Covered call strategies on Bitcoin ETFs can generate annualized yields of 20% to 40% because of the high implied volatility, far above the 5% to 10% typical for equity covered calls.

Protective puts serve as portfolio insurance. A trader who holds IBIT and wants to protect against a drawdown buys put options at a strike price below the current market. If Bitcoin drops sharply, the put gains value and offsets losses on the underlying position. The cost of this insurance is the put premium, which can be significant given crypto’s high implied volatility.

Vertical spreads reduce the cost of directional bets by combining a long option with a short option at a different strike. A bull call spread involves buying a call at a lower strike and selling a call at a higher strike. The sold call reduces the net premium paid but caps the maximum profit. Bear put spreads work the same way in reverse. Spreads are popular among traders who have a directional view but want to reduce their cost basis and define their maximum risk.

Straddles and strangles are volatility strategies that profit from large moves in either direction. A straddle involves buying both a call and a put at the same strike price. A strangle involves buying a call and a put at different strike prices, with the call strike above and the put strike below the current price. These strategies are commonly used around major events such as Federal Reserve meetings, Bitcoin halving events, or regulatory announcements that could move the market sharply in either direction.

Calendar spreads exploit differences in time decay between near-term and longer-term options. A trader sells a short-dated option and buys a longer-dated option at the same strike price. The trade profits when the near-term option decays faster than the longer-term option, which typically occurs when the underlying price stays near the strike. Calendar spreads are particularly attractive on crypto ETFs because the high implied volatility produces larger absolute differences in time decay between expirations, creating wider profit zones than the same structure would offer on a traditional equity ETF.

Why the options market matters for crypto prices

The growth of the crypto ETF options market has introduced a feedback mechanism that did not previously exist in cryptocurrency markets. Market makers who sell options must continuously hedge their exposure by buying or selling the underlying ETF shares. This hedging activity, known as delta hedging, can amplify or dampen price moves depending on the aggregate positioning of the options market.

When market makers are net short gamma (meaning they have sold more options than they have bought), their hedging activity amplifies price moves. They must buy more shares as prices rise and sell more shares as prices fall, creating a positive feedback loop. When market makers are net long gamma, the opposite occurs: their hedging activity dampens price moves by requiring them to sell into rallies and buy during dips.

The concept of a “max pain” price, the price at which the most options expire worthless and option sellers retain the most premium, has become a closely watched metric in crypto markets. As expiration approaches, the hedging flows of market makers tend to push the price of the underlying ETF toward the max pain level, creating a gravitational effect that did not exist when crypto traded without a listed options market.

Open interest data from crypto ETF options provides a transparent view of market positioning that was previously available only through offshore derivatives exchanges. Analysts can see where large concentrations of calls and puts are positioned, which strike prices act as support or resistance, and how the market’s expectations for future volatility compare to realized volatility.

Risks specific to crypto ETF options

Crypto ETF options carry all the standard risks of options trading plus several risks unique to the crypto market.

Volatility risk cuts both ways. High implied volatility makes options expensive to buy. A trader who buys a call option may be correct about the direction of Bitcoin but still lose money if implied volatility drops (a phenomenon called “vol crush”). This commonly occurs after anticipated events when uncertainty resolves and implied volatility collapses.

Weekend and after-hours risk exists because Bitcoin trades 24/7 but ETF options trade only during US market hours. A significant price move over the weekend is fully reflected in the ETF price at Monday’s open, which can cause large gaps in option values. A trader who sold puts on Friday afternoon may face substantial losses on Monday morning if Bitcoin dropped 15% over the weekend.

Liquidity risk varies significantly across strikes and expirations. At-the-money options on IBIT are extremely liquid, with tight bid-ask spreads of $0.01 to $0.03. But far out-of-the-money options or options with distant expirations can have spreads of $0.10 to $0.30, which materially affects the cost of entering and exiting positions.

Correlation risk affects traders who use crypto ETF options to hedge positions in actual cryptocurrency. The ETF price tracks the spot price of Bitcoin closely but not perfectly. Tracking error, fund fees, and the mismatch between 24/7 crypto markets and traditional market hours can cause the ETF to diverge from spot Bitcoin at exactly the moment a hedge is needed most.

Assignment risk applies to sellers of American-style options, which can be exercised at any time before expiration. A trader who has sold in-the-money call options may be assigned at an inconvenient time, forcing them to deliver shares they may not hold.

What this does not cover

This guide does not cover the tax treatment of options trading, which varies by jurisdiction and can be complex when options expire, are exercised, or are closed before expiration. It does not cover the specific margin requirements set by individual brokers, which can differ from the minimum requirements set by the OCC. It does not cover options strategies involving more than two legs, such as iron condors, butterflies, or ratio spreads, which require a deeper understanding of options Greeks and risk management. It does not cover options on crypto futures ETFs, which existed before spot ETFs and have different pricing dynamics due to the futures roll cost embedded in the underlying product.

Practical checks for evaluating a crypto ETF options trade

Check the implied volatility rank. Compare the current implied volatility to its range over the past 30, 60, and 90 days. If implied volatility is in the top quartile of its recent range, options are relatively expensive, which favors selling strategies. If implied volatility is in the bottom quartile, options are relatively cheap, which favors buying strategies.

Check the bid-ask spread. Divide the spread by the midpoint price to get the spread as a percentage of the option value. If this number exceeds 5%, the transaction costs will significantly erode returns, particularly for strategies that require multiple legs.

Check the event calendar. Identify any upcoming events (FOMC meetings, ETF flow reports, Bitcoin network upgrades, regulatory deadlines) that could cause a volatility spike or collapse. Buying options before a volatility event and selling them after is a common mistake that results in losses even when the directional call is correct.

Check the Greeks. Know your delta exposure (directional risk), gamma exposure (how delta will change), theta (daily time decay cost), and vega (sensitivity to implied volatility changes). For multi-leg strategies, calculate the net Greeks of the entire position, not just the individual legs.

Check the position size. Options provide leverage, which means losses can accumulate quickly. A common guideline is to risk no more than 1% to 3% of total portfolio value on any single options trade. For crypto ETF options, where the underlying asset can move 10% or more in a single day, conservative position sizing is especially important.

Disclaimer

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency investments carry significant risk, and you should conduct your own research before making any investment decisions. Information is accurate as of August 6, 2026.

Rarible has launched its NFT marketplace on Solana after months of development, naming Claynosaurz as its first featured collection.

Rarible expands its marketplace to Solana

Rarible announced the launch on Thursday, marking its latest expansion beyond the blockchain networks already supported by its NFT marketplace.

Claynosaurz, a Solana-based entertainment and NFT brand built around animated dinosaur characters, will serve as the first featured collection. Rarible said it would onboard additional projects from across the network over the coming days and weeks.

“We’ve actually been working on Solana for months,” the company said. “Today, we’re incredibly excited to finally say it: Rarible is now live on Solana.”

The company did not disclose how many collections would be added during the initial rollout or provide a fixed schedule for future integrations.

Rarible said its team spent several months developing and testing the Solana marketplace. It also consulted NFT communities to understand how individual projects approach their identities, cultures, and collector bases.

According to the company, feedback from those discussions shaped some of its product decisions. Rarible said it wants to create collection-specific experiences instead of merely listing assets on a standard marketplace interface.

Gacha Station previewed Rarible’s Solana plans

Rarible described its earlier Gacha Station release on Solana as an initial look at the broader integration rather than a standalone product.

Gacha Station lets users purchase randomized digital collectibles, borrowing its format from capsule-toy and loot-box systems. Its rollout gave Rarible an early way to test products and user activity on Solana before launching the wider marketplace.

The company characterized the current marketplace as a foundation for a larger expansion. Planned updates include additional collections, new features, improvements to the trading experience, editorial content and community campaigns.

Rarible did not provide transaction-volume targets or details about how it plans to compete with established Solana NFT platforms. Marketplace adoption will depend partly on the collections it secures and whether it can attract collectors already active elsewhere in the ecosystem.

Why Solana matters for Rarible

Solana offers relatively low transaction fees and faster settlement than several older blockchain networks, making it a common venue for frequent NFT trading and lower-priced digital collectibles.

Adding the network allows Rarible to reach Solana-native creators and collectors without requiring them to move assets to another blockchain. It also gives projects another marketplace through which they can present and trade their collections.

The launch comes as NFT marketplaces face pressure to distinguish themselves through creator tools, community features and collection-specific products. Trading fees have also fallen across the sector as competing platforms seek to attract liquidity.

For U.S. users, Rarible’s announcement did not identify any new geographic restrictions or changes to marketplace access. NFT regulatory treatment in the United States can depend on how a collection is marketed and structured, rather than the blockchain on which it trades.

EU lawmakers seek a review of NFT rules

Rarible’s Solana expansion also arrives as European policymakers consider whether NFTs should fall more clearly within the bloc’s crypto regulations.

In July, the European Parliament adopted a policy report calling on the European Commission to examine decentralized finance, staking, crypto lending, borrowing and NFTs following the full rollout of the Markets in Crypto-Assets regulation.

The report did not change MiCA or create immediate obligations for NFT marketplaces. However, it established Parliament’s position that areas outside the existing framework may require further review.

MiCA’s transition period ended on July 1, requiring covered crypto-asset service providers to secure EU-wide or national authorization to continue operating across the bloc. Whether future rules extend more explicitly to NFT services could affect marketplaces such as Rarible as they add networks, collections and users.

For now, Rarible plans to continue expanding its Solana marketplace gradually, with its next phase centered on onboarding projects and refining the platform using feedback from the network’s communities.

Canaan has authorized management to sell part of its Bitcoin and Ethereum holdings to finance share repurchases under an existing $30 million program.

Canaan opens crypto treasury to fund buybacks

Nasdaq-listed Bitcoin miner Canaan has authorized management to monetize part of its digital asset treasury and use the proceeds to repurchase its American depositary shares.

The purchases will fall under an existing program that allows Canaan to buy back up to $30 million of its ADSs or Class A ordinary shares during the 12 months beginning Dec. 12, 2025, according to the company’s Aug. 4 announcement.

Canaan did not disclose how much cryptocurrency it intends to sell or when any sales will occur. The company also did not commit to using the entire remaining authorization.

Canaan did not disclose how much cryptocurrency it intends to sell or when any sales will occur. The company also did not commit to using the entire remaining authorization.

Further transactions will depend on Canaan’s share price, broader market conditions, working capital requirements, and board approval. Repurchases may take place through open-market transactions, block trades, or privately negotiated deals.

As of May 19, Canaan had spent approximately $2 million to repurchase 2.8 million ADSs. This left a nominal $28 million under the authorization at the time, although the company has not disclosed whether it completed additional purchases before the latest announcement.

Crypto holdings reached $130 million

Canaan held 1,915 BTC and 3,952 ETH at the end of June. The company valued the combined portfolio at approximately $130 million using market prices from Aug. 3.

Its Bitcoin balance increased by 49 BTC in June after accounting for operating costs and BTC received as payment for mining-machine sales. Canaan mined 64 BTC during the month.

Chairman and CEO Nangeng Zhang said the company’s mining operations provide a continuing source of Bitcoin that can be used as capital.

“At current trading levels, we believe Canaan’s market value does not fully reflect the value of our digital asset holdings, cash position, and the strength of our underlying business.”

Canaan said it was trading below the combined value of its cryptocurrency holdings and the cash and cash equivalents reported at the end of March. However, the comparison does not account for the company’s liabilities or restrictions affecting parts of its treasury.

At the end of March, Canaan held $43.5 million in cash. It also reported that 905 BTC had been pledged against secured term loans, while another 100 BTC had been transferred to a fixed-term product.

Mining efficiency improves as capacity stays idle

The decision follows improvements in Canaan’s North American mining efficiency despite underused capacity.

Canaan achieved fleet efficiency of 17.9 joules per terahash across its North American non-joint venture operations in May. It marlet, an 11% improvement from the previous year and a roughly 4% gain from the 18.7 J/TH recorded in March and April.

Operating activity nevertheless remained below installed capacity. At the end of May, Canaan had 10.05 exahashes per second of installed non-joint venture capacity, while only 6.47 EH/s was operating after a hosting agreement expired.

By June, non-joint venture operating hashrate had fallen further to 3.36 EH/s. Joint venture operations recovered to 4.09 EH/s following wildfire-related disruption at facilities in West Texas.

Nasdaq compliance remains a risk

Canaan’s ADSs were trading near $0.19 on Aug. 6, well below Nasdaq’s $1 minimum bid-price requirement. Each ADS represents 15 Class A ordinary shares.

Nasdaq granted the company an additional 180 days, until Jan. 11, 2027, to regain compliance. Canaan must maintain a closing bid price of at least $1 for a minimum of ten consecutive business days.

The company has not directly linked the buyback decision to its listing deficiency. Still, repurchases could reduce the number of outstanding shares and offer price support, while selling cryptocurrency would lower the reserves available for mining operations, debt obligations, and working capital.

About 64 Bitcoin, worth $4.17 million, and 200 Ether, worth $380,000, linked to the recent Coldcard exploit were sent to cryptocurrency mixing protocols, according to blockchain security platform CertiK. 

The Bitcoin transfer was from address bc1q0 to crypto mixing protocol Wasabi on Tuesday, according to blockchain data shared by CertiK.

“We think it might be a smaller exploiter. There’s likely a few copycats after the initial exploit,” a CertiK spokesperson told Cointelegraph. The 200 Ether (ETH) was transferred to Tornado Cash on Wednesday, according to CertiK’s X post.

Crypto mixing protocols such as Tornado Cash typically pool and then scramble the cryptocurrency from multiple users, breaking the publicly traceable onchain link between senders and recipients. This makes it difficult to trace the stolen funds, decreasing the chances of asset recovery.

In April, the hacker behind a $293 million Kelp DAO hack laundered about 75,700 Ether, then worth $175 million, primarily through THORChain, generating about $910,000 in fee revenue for the protocol. The attacker also used the Umbra privacy protocol.

The Coldcard exploit has now become the third-largest cryptocurrency hack so far in 2026. It drained at least $100 million in Bitcoin across three confirmed attack waves from 7,300 victim wallets, according to Galaxy Digital. The company also identified a suspected fourth wave that could bring total losses to about $130 million in BTC.

Source: CertiK

Most copycats haven’t moved stolen funds

Onchain tracing by TRM Labs showed that the majority of victim funds were still pooled in a small number of attacker-controlled addresses with limited mixing attempts, according to a Thursday report.

The blockchain intelligence company said that the “differences in transaction construction” during each attack wave hint at multiple attackers behind the exploit.

The analysis is in line with Galaxy’s previous findings that showed at least 15 different attackers who exploited the Coldcard vulnerability.

Related: AI has not triggered DeFi ‘hackpocalypse,’ Dragonfly partner says 

TRM Labs said that a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets, cutting key strength to 40 bits from 128 bits, making it “brute-forceable without physical access.” 

Dragonfly managing partner Haseeb Qureshi wrote that roughly “$2 of AI hardening” could have prevented the Coldcard exploit, citing social media reports that some AI models rediscovered the vulnerability that led to the attack in less than 20 minutes. 

Magazine: Does Botanix’s failure prove Bitcoiners don’t care about DeFi?  

Bitcoin (BTC) institutional investment vehicles have shed 10% of their BTC holdings since May as analysis warns of a “breaking” sector.

Key points:

• Bitcoin institutional funds see a blanket 10% reduction in holdings over three months.
• Analysis says that the Bitcoin treasury model is “breaking” as company valuations fall below net asset value.
• Coinbase premium has been negative for a record 93 days. 

Fund exposure drops as Bitcoin treasury companies face squeeze 

Data from onchain analytics platform CryptoQuant shows that combined institutional BTC exposure, which includes trusts, exchange-traded funds (ETFs) and closed-end funds, has fallen from 1.33 million to 1.20 million BTC over three months.

Bitcoin fund holdings. Source: CryptoQuant

The drawdown comes as another major Bitcoin institutional investment vehicle, corporate treasuries, faces upheaval. Business intelligence software company Strategy, which holds the largest Bitcoin treasury of any public corporation, sold 1,638 BTC last week. 

“Bitcoin treasury companies once amplified demand through a reflexive financing loop. Their shares traded above the value of their Bitcoin holdings, allowing them to issue equity or debt, buy more Bitcoin and reinforce the premium. That mechanism weakens when market capitalisations fall below net asset value, and financing becomes dilutive,” contributing analyst Novaque Research commented.

CryptoQuant highlights the plight of several Bitcoin treasury companies with stock trading below the net asset value (NAV) of their BTC holdings. In Strategy’s case, the discount disappears according to the valuation methodology used.

Basic share count puts the discount at 0.7 as of Thursday, but once the company’s $8 billion debt and liquidation preference of its STRC preferred stock is factored in, the mNAV equals 1.03.

Strategy Updated mNAV. Source: Bitcoin Treasuries

“The on-chain evidence supports a loss of institutional demand, although it cannot directly isolate treasury companies,” CryptoQuant notes.

Coinbase Premium sees record negative stint

The drawdown in both fund exposure and Bitcoin treasury holdings comes as the Coinbase Premium index sees a record 93 days of negative readings.

Related: Bitcoin price-metric basket sees longest capitulation since FTX blow-up: Glassnode

As Cointelegraph reported this week, the Index, which measures the difference in price between Coinbase’s and Binance’s BTC/USDT pairs, has been negative since the start of May — a record streak.

Coinbase Premium Index. Source: CryptoQuant

Analysis sees the return of the Premium as a prerequisite for a BTC price recovery. This week, Web3 marketing platform FOUR argued that the genesis of the months-long negative reading did not lie in blanket US selling pressure.

“Until the premium flips positive, institutional buying from U.S. investors appears muted—suggesting this is more of a demand shortage than aggressive selling,” it told X followers.

In a note quoted by Reuters last month, Citi highlighted ETF flows in particular as an “important driver of prices” while cutting its BTC price forecast to $53,000 through 2027.