Crypto World
Coldcard flaw exposed $116M self-custody risk: Gray
The Coldcard seed-generation failure has exposed about $116 million in Bitcoin to theft while renewing questions about how users verify the security of self-custody tools, according to TEXITcoin founder Bobby Gray.
Summary
- Attackers have reportedly drained about 1,816 BTC worth $116 million from more than 5,200 addresses.
- A firmware error left some Coldcard seeds with about 40 bits of entropy instead of 128 bits.
- Gray said users who added independent dice-generated entropy were not affected by the reported attacks.
- Coinkite has released patched firmware, but existing vulnerable seeds require a complete wallet migration.
Bobby Gray, founder of TEXITcoin, told crypto.news that Coldcard users suffered losses because they trusted the hardware wallet to generate secure seed phrases without independently checking the source of randomness.
“Coldcard sat on a broken seed generator for five years, and it still cost people $116 million,” Gray said.
“Some of these wallets were generating seeds with as little as 40 bits of entropy instead of the 128 they promised.”
Gray said the lower entropy turned recovery phrases designed to resist brute-force attacks into targets that determined attackers could search without gaining physical access to the devices.
Coldcard seed flaw weakened wallet security
Coldcard is a Bitcoin-only hardware wallet made by Canadian hardware manufacturer Coinkite. Hardware wallets keep private keys away from internet-connected computers and sign transactions within the device, reducing exposure to malware and online attacks.
Coldcard’s reported failure occurred before the private keys entered secure storage. According to a Coinkite security advisory, a firmware integration error caused affected devices to use a predictable software random-number generator instead of the intended hardware source while creating wallet seeds.
Firmware versions 4.0.1 through 4.1.9 on Coldcard Mk2 and Mk3 devices were affected. The first vulnerable release arrived in March 2021, leaving the error active for more than five years before Coinkite disclosed it on July 30.
Coinkite estimated that seeds created on affected Mk2 and Mk3 devices contained about 40 bits of effective entropy. Vulnerable Mk4, Mk5, and Q devices generated about 72 bits rather than the expected 128 bits, according to the advisory.
A correctly generated 128-bit seed provides an extremely large set of possible combinations. Reducing the effective randomness to 40 bits leaves about one trillion possibilities, a range that specialized computing systems can search when attackers have enough information about the wallet’s seed-generation process.
TRM Labs said the attackers could reconstruct affected private keys without opening, stealing, or modifying the hardware wallets. The blockchain intelligence firm attributed the error to a build configuration introduced with firmware version 4.0.1.
On-chain estimates cited by TRM Labs placed the preliminary loss at about 1,816 BTC, worth approximately $116 million, across more than 5,200 addresses. Four suspected waves began on July 30, though TRM warned that the total could change as investigators confirm victim reports and trace additional addresses.
Gray says self-custody itself did not fail
In an Aug. 6 analysis, Gray described the incident as a failure in the process used to create private keys rather than a compromise of Bitcoin or the physical security components inside Coldcard devices.
No attacker needed to steal a device, obtain its PIN, or install malicious firmware, according to Gray. Once attackers reconstructed a vulnerable seed, they could derive its associated private keys and sign transactions from another system.
“The people who bothered adding their own dice rolls for extra entropy walked away untouched, while the people who just trusted the device to handle it got wiped out,” Gray said.
Coinkite’s advisory supports the distinction involving independent randomness. Users who entered at least 50 fair, private, and independent dice rolls while creating their seed are not considered at risk from the random-number-generator flaw alone. Between 50 and 98 rolls added at least 128 bits of entropy, while 99 or more added about 256 bits, the company said.
Fewer than 50 rolls do not meet Coinkite’s stated exception. Users who cannot remember how many rolls they entered, whether the process was private, or which final seed words they retained were advised to migrate their funds.
Gray argued that the incident should not be treated as evidence that centralized custody is safer in every case. In his view, self-custody requires users to verify how their keys are created instead of relying only on the product’s listed security features.
“Blind trust is what failed here, and self-custody is taking the blame it doesn’t deserve. If you haven’t independently verified your entropy, you don’t actually know what you’re holding, no matter how many security features are stacked around it.”
His TEXITcoin post also separated the event from phishing, malicious firmware, and supply-chain attacks. Gray classified the firmware problem as a severe mistake by a wallet maker rather than evidence that Coinkite designed the product to steal customer funds.
Coldcard losses have changed custody decisions
User behavior has moved in a different direction from Gray’s recommendation. OKX reported record deposits after the incident, as some Bitcoin holders transferred assets from personal wallets to centralized platforms.
As previously reported by crypto.news, OKX Chief Compliance Officer Jonathan Brockmeier said the inflows represented the opposite of the behavior seen after FTX collapsed, when users withdrew assets from exchanges and moved them into self-custody.
Gray rejected the idea that leaving Bitcoin on an exchange resolves the problem. Centralized services control customer keys and can freeze withdrawals, suffer security breaches, or fail financially, he said.
“Running back to an exchange because a device let you down isn’t a solution either, since that’s just handing your risk, and your keys, to someone else to lose instead,” Gray said.
Blockchain investigators have not attributed the theft to one identified group. TRM said differences in transaction construction across the suspected waves could indicate several attackers, while most stolen Bitcoin had initially remained in consolidation addresses.
The firm detected limited laundering activity, including a 64.9 BTC deposit to Wasabi and 200 ETH sent through Tornado Cash on Aug. 4. TRM said the transaction pattern differed from the fast laundering methods often associated with organized state-backed hacking groups.
US investors face a different custody trade-off
For American investors who only want exposure to Bitcoin’s price, U.S.-listed spot Bitcoin exchange-traded funds remove the need to generate seeds, update wallet firmware, or maintain physical backups.
Bloomberg Intelligence analyst Eric Balchunas said the Coldcard losses strengthened the case for regulated spot Bitcoin ETFs. A report on ETF custody noted that products such as BlackRock’s iShares Bitcoin Trust ETF rely on institutional custodians rather than requiring shareholders to control private keys.
BlackRock’s SEC filing identifies Coinbase Custody as the main custodian for IBIT’s Bitcoin and names Anchorage Digital Bank as another custodian the trust may use. Shareholders own exchange-traded securities, however, and cannot withdraw the underlying Bitcoin to a personal wallet or use it for payments.
Institutional custody also transfers risk instead of removing it. IBIT’s filing lists hacking, employee misconduct, technical failures, and unauthorized transfers among possible sources of loss. The filing also says insurance shared by Coinbase may not cover every potential incident.
Coldcard users must replace vulnerable seeds
Coinkite has released fixed firmware for every affected model, including version 4.2.0 for Mk2 and Mk3 devices, version 5.6.0 for standard Mk4 and Mk5 devices, and version 1.5.0Q for the standard Coldcard Q.
Installing an update only corrects the generation of future seeds. Coinkite said firmware cannot add randomness to an existing recovery phrase because the weakness remains attached to the seed even if a user imports it into another wallet.
Affected users were instructed to install the correct firmware, generate a completely new seed, verify its fingerprint and receiving address, and send a small test transaction before moving the remaining balance. Coinkite advised users to retain the old backup until the transfer reaches the replacement wallet and receives network confirmation.
Crypto World
Morgan Stanley’s infrastructure partner Zerohash rebuffed in pitch to be U.S. trust bank
Unlike denials (as received by Wise and Bunq) a return doesn’t come with a detailed explanation. The company didn’t publicly disclose the development when it happened, as it had with the submission of its application. And Zerohash hadn’t voluntarily withdrawn the filing, as was its option.
A spokesperson for the OCC didn’t immediately respond to questions about the application, and spokespeople for Morgan Stanley declined to comment.
Just a month before returning Zerohash’s effort, the regulator issued an explanation for how it makes such decisions, including its new approach to returning applications without registering a decision. The OCC will return a filing, the agency said, if it doesn’t contain necessary information on the company’s finances or officers. Or, it noted, “the OCC may return a filing as materially deficient if, after attempting to have the filer furnish all required information for the OCC to assess the statutory or regulatory criteria through an additional information request, the responses do not sufficiently respond to the requests.”
When the Independent Community Bankers of America filed an objection to the application in April, the community-bank group’s letter noted: “In less than twelve months the OCC has conditionally approved or received applications from Circle Internet Group, Ripple, Paxos Trust, BitGo, Fidelity Digital Assets, Crypto.com, Payoneer (PAYO), and now Zerohash. This pace — eleven filings or approvals in under one hundred days in some windows — precludes deliberate, transparent policymaking.”
Solana (SOL) came within five percentage points of a full network halt on Wednesday morning. One routing glitch at one hosting company knocked 28.83% of all staked SOL offline in minutes.
Almost nobody noticed. Staking platform Marinade Finance reconstructed the incident and found the network got 86% of the way to the 33.34% line where Solana stops finalizing transactions.
Follow us on X to get the latest news as it happens
How One Bad Route Nearly Halted the Solana Network
The fault began at Teraswitch, a hosting provider popular with Solana validators. A broken route left its Miami site, then spread through an internal relay in Amsterdam. Twelve sites from London to Tokyo lost their connection. North America never felt it.
“Solana got 86% of the way to a halt this morning and it barely registered anywhere,” Marinade Finance indicated.
Teraswitch found the bug in about 10 minutes. Full recovery took 33. At the peak, roughly 20 million SOL of online stake stood between the network and a freeze.
Around 90 validators went dark. Their combined lost rewards came to 333 SOL, about $25,600 at current prices. Validator bonds will cover that at the end of the epoch.
Solana’s Own Safety Cap Is Already Broken
An autonomous system number (ASN) is the block of internet addresses one network operator controls. One ASN, AS20326, hosts 27.34% of everything staked on Solana. During the fault, 94% of that stake went offline at once.
The Solana Foundation Delegation Program (SFDP), which steers foundation stake to validators, caps any single ASN at 25%. That cap exists for exactly this failure. It is already broken.
Another 14 million SOL dropped in the same minutes on unrelated providers. Marinade could not explain the overlap. Provider labels clearly miss some shared points of failure.
Backup systems failed the test too. Of 74 validators Marinade measured, only three switched to a second site. The rest sat offline until the internet healed. Helius, Solana’s second-largest validator, stayed down all 33 minutes.
Marinade admitted its own numbers look similar, with four ASNs holding two-thirds of the stake it allocates. It now plans tighter caps per ASN and data center, and will publish which validators run automatic failover.
A Near Miss With a Long History
SOL trades near $76.46, up 0.6% on the day. The market shrugged. No user funds were ever at risk, and bonds cover the lost rewards. The worry is structural, not immediate.
Solana has seen this movie before. In November 2022, German host Hetzner kicked 1,000 validators offline and pushed delinquent stake past 20%. Wednesday’s fault went further.
The chain’s last full network halt, in February 2024, ended a 351-day uptime streak and took about five hours to fix. No bond covers that outcome. A halt freezes every SOL holder at once.
The timing stings. Validators are preparing the Alpenglow finality upgrade, due by October, which promises faster confirmations. Speed means little if one provider’s routing table can stall the whole chain.
The open question is whether stake spreads out before the next bad route finds it.
The post Solana Network Nearly Stopped Working Today. Should SOL Investors Worry? appeared first on BeInCrypto.
The deal would add NEOS’ $30 billion ETF business, including Bitcoin- and Ether-linked income funds, to Goldman Sachs Asset Management.
BitGo Chief Financial Officer Edward Reginelli will resign effective Sept. 15, the digital-asset infrastructure company disclosed on Aug. 12. In the same announcement, BitGo reported a $19.0 million second-quarter net loss, reversing a $38.3 million profit a year earlier even as revenue climbed… Read the full story at The Defiant
Crypto World
Boltz Founders Exit as Unnamed Bitcoin Group Agrees to Take Over Suspended Swap Service
Boltz’s original founders have stepped down, and an unnamed group of “veteran Bitcoiners” has agreed to take over the suspended Bitcoin swap service, the company said Wednesday. The incoming operators will provide capital and engineering resources, while work to find and fix vulnerabilities is… Read the full story at The Defiant
Crypto World
Bitget Institutional Launches $300 Million Project Archimedes to Back Quant Firms and Asset Managers
Bitget, the world’s largest Universal Exchange (UEX), has launched Project Archimedes, a $300 million institutional capital program for quantitative trading firms, asset managers and market makers.
With the vision of backing minds that move markets, Project Archimedes will support firms at different stages of growth through two programs:
- Capital Provider Program ($100 million): Allocated to accelerate emerging and growing quantitative firms running market-neutral strategies. Bitget will provide capital, with returns shared under an agreed structure and risk framework.
- Interest-Free Lending Program ($200 million): Available to established institutions with mature strategies and existing trading scale. Eligible firms can access interest-free capital by meeting defined trading volume or position requirements, reducing funding costs while increasing the capital available to their strategies.
Institutional trading is entering a period where access to capital, execution quality and risk control increasingly determine which strategies can scale. Arbitrage returns across established crypto markets have tightened as competition has increased, leading quantitative firms to explore market structures such as basis spreads, funding-rate differences and tokenized assets.
“Strong strategies often reach a point where talent is no longer the constraint but capital might,” said Gracy Chen, CEO at Bitget. “Project Archimedes gives capable teams the acceleration it needs to scale, while aligning capital, risk and execution around sustainable performance. Our goal is to boost over fifty projects in the next six months with this capital.”
The program takes its name from Archimedes’ principle that the right fulcrum can move the world. For institutional trading firms, capital provides that fulcrum, while product structure and infrastructure determine how effectively it can be used.
Tokenized US stocks offer one example. Arbitrage opportunities can arise from differences in basis and funding rates across spot and derivative markets. These strategies typically require firms to maintain positions on both sides of a trade, which can tie up margin across separate accounts.
Under Bitget’s Unified Account, eligible rToken spot positions can serve as collateral for derivatives trading without requiring transfers between accounts. This structure allows institutions to maintain tokenized stock exposure while deploying related contract strategies through the same account, improving the use of available capital. Weekend collateral valuation follows the underlying stock’s Friday closing price, providing a fixed reference while traditional US markets are closed.
Project Archimedes will focus initially on market-neutral strategies with established operating histories and measurable risk controls. Participating institutions will undergo strategy assessment, due diligence and drawdown reviews.
The program is structured as a long-term capital cooperation framework with rolling admissions and phased deployment. Bitget Institutional plans to disclose program developments over time, including participation figures, deployed capital and strategy distribution. Product specifications, market-structure research and institutional case studies will provide further insight into how participating firms use capital and trading infrastructure.
Project Archimedes also supports Bitget Institutional’s broader role as a capital partner with market insight, connecting firms with liquidity, unified trading infrastructure and an international institutional network. Through capital allocation and interest-free lending, the program aims to help emerging teams establish stronger foundations and enable mature institutions to convert proven strategies into greater trading scale.
About Bitget
Bitget is the world’s largest Universal Exchange (UEX), serving over 125 million users and offering access to over 2M crypto tokens, 500+ tokenized stocks, ETFs, commodities, FX, and precious metals such as gold. The ecosystem is committed to helping users trade smarter with its AI agent, which co-pilots trade execution. Bitget is driving crypto adoption through strategic partnerships such as MotoGP™. Aligned with its global impact strategy, Bitget has joined hands with UNICEF to support blockchain education for 1.1 million people by 2027. Bitget currently leads in the tokenized TradFi market, providing the industry’s lowest fees and highest liquidity across 150 regions worldwide.
For more information, visit: Website | X | Telegram | LinkedIn | Discord
Risk Warning: Digital asset prices are subject to fluctuation and may experience significant volatility. Investors are advised to only allocate funds they can afford to lose. The value of any investment may be impacted, and there is a possibility that financial objectives may not be met, nor the principal investment recovered. Independent financial advice should always be sought, and personal financial experience and standing carefully considered. Past performance is not a reliable indicator of future results. Bitget accepts no liability for any potential losses incurred. Nothing contained herein should be construed as financial advice. For further information, please refer to our Terms of Use.
The post Bitget Institutional Launches $300 Million Project Archimedes to Back Quant Firms and Asset Managers appeared first on BeInCrypto.
Bitcoin’s bounce off Tuesday’s low near $63,200 is coming mostly from leveraged futures positioning, not real spot buying, according to CryptoQuant data cited by the analytics account XWIN Japan.
That’s the same setup that preceded April 2026’s failed rally, which is why some analysts are treating the current recovery as fragile until spot demand actually shows up.
Futures Are Leading, Spot Is Lagging
XWIN Japan laid out the numbers plainly: 30-day perpetual futures demand has turned positive again, while on-chain spot demand remains negative. Traders, in other words, are adding leveraged exposure before real spot buying has caught up.
The account pointed to April 2026 as the precedent, when Bitcoin ran from roughly $66,000 to $79,000 on rising futures demand while spot stayed weak, and the rally eventually faded once that leverage unwound.
One difference this time is that US spot Bitcoin ETF inflows have started recovering too. As XWIN Japan put it, “the key question is not simply whether Bitcoin is rising.”
Ki Young Ju, CEO of CryptoQuant, had made a near-identical call earlier in the day: open interest is climbing while on-chain spot demand stays negative, and “a sustainable rally needs both spot and future demand.”
He’d said almost the same thing on April 27, noting that Bitcoin was futures-driven even with ETF inflows and Michael Saylor’s Strategy purchases in play, and that bear markets historically only end once spot and futures demand recover together.
Bitcoin was trading near $64,000 at the time of writing, having oscillated within a 24-hour range of roughly $63,200 to $64,400 per CoinGecko data.
Price Under Pressure, and a Familiar Setup
It’s been a choppy stretch for the asset as it first got turned back at $65,000 earlier this month after the CLARITY Act stalled in the Senate, then rallied a few hundred bucks above that same level on a weak US jobs report last Friday before getting rejected there again on Monday. It slipped as low as the aforementioned $63,200 on Tuesday, a nine-day low, before clawing back some ground.
Zoom out, and the picture softens further: BTC is up only 1.4% across 30 days and still down 46% from a year ago. Its market cap sits near $1.28 trillion, with dominance over the rest of the crypto market just over 57%.
Other traders are watching the same tension play out technically. Glassnode data shows 54.6% of Bitcoin’s supply still sitting in profit even as the price has stuck in the $63,500 to $65,000 band, with the firm treating $65,000 as the level that would need to break before anyone calls a bottom confirmed.
A weekly chart shared separately by trader Titan adds another wrinkle: the same moving-average crossover that preceded Bitcoin’s three prior cycle bottoms, in 2015, 2019, and 2022, has just printed again, with price sitting in the same zone the chart flags as a potential bottoming range.
That lines up with XWIN Japan’s framing regardless: the rebound holds together only if spot buying, ETF flows, and futures demand all turn up together, and if open interest keeps climbing without spot behind it, the setup looks like April all over again.
The post Bitcoin Rebound Faces Risk as Futures Demand Outpaces Spot Buying: Analysts appeared first on CryptoPotato.
Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.
All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.
Market analyst Jamie Coutts said x402 daily settlement volume is down 93% year-to-date as a late-2025 testing wave died out.
The decline contrasts with growing infrastructure for AI agents, leaving the protocol’s actual payment activity well behind the expectations surrounding the agentic economy.
x402 Activity Remains Far Below Late-2025 Levels
Coutts posted the assessment on August 12, pointing to a Helios Analytics chart tracking x402 settlement volume from October 2025 through July 2026. The data shows heavy activity during the final quarter of 2025, with several daily peaks approaching or passing $800,000 and $1 million.
That activity did not last. Settlement volume fell steeply after December and remained subdued through most of 2026. The chart puts the seven-day average at around $41,800, while the latest provisional daily figure is roughly $28,400.
The wider figure tells a similar story. x402 volume is down 55% over three months and 93% year-to-date. Yet the one-year figure is still 358 times higher, largely because activity was starting from a very low base.
Coutts described the numbers as a “reality check” for claims that the agentic economy is already here. Still, he does not see the current slowdown as permanent. He expects agent activity to begin rising alongside greater use of agent harnesses in the fourth quarter.
His argument rests partly on a recent development involving Cloudflare. On July 1, the company launched its Monetization Gateway, which lets customers charge for pages, APIs, datasets and MCP tools. The service uses x402 for stablecoin settlement and handles usage measurement and settlement at the edge.
Coutts said the system expands Cloudflare’s earlier Pay Per Crawl model. That service focused on charging AI bots, while the new gateway can charge any caller, including people and AI agents.
Infrastructure Is Growing While Usage Catches Up
The muted settlement data comes despite a series of developments aimed at machine-to-machine payments. On July 14, Ripple joined the newly launched x402 Foundation, hosted by the Linux Foundation, as a premier member alongside other crypto firms overseeing the Coinbase-built protocol.
Markus Infranger, senior vice president of RippleX, said “open standards like x402 help lay the foundation for trusted, interoperable machine-to-machine payments.” Ripple said its XRP Ledger already supports x402, meaning agents could transact using XRP or its RLUSD stablecoin, something it had previewed a month earlier with an AI Starter Kit for building autonomous payment apps on the XRPL, built with t54.
A16z had flagged x402 by name back in December 2025, predicting AI agents would need payments that move at internet speed and calling programmable settlement tools a way to make value transfer “a native network function rather than a separate operational layer.” Almost eight months later, Coutts’ chart shows the anticipated activity has mostly gone quiet.
The post x402 Volume Plunges 93% YTD as Agentic AI Economy Hype Fades appeared first on CryptoPotato.
Circle renewed its push for cirBTC as neutral institutional collateral in an Aug. 12 post, but the product is not a new launch. It has been live on Ethereum since June 8 and had only about 40 tokens outstanding at the time of review, compared with more than 116,000 WBTC and 97,000 cbBTC. cirBTC… Read the full story at The Defiant
How Gamification is Redefining Workplace Team Building
Morgan Stanley’s infrastructure partner Zerohash rebuffed in pitch to be U.S. trust bank
Beyond the Gates Early Spoilers Aug 17-21: Joey Explodes in Rage as Vernon Grows Anxious
-
Fashion5 days agoWeekend Open Thread: Mattifying Sunscreen
-
Fashion5 days agoFrugal Friday’s Workwear Report: Cap-Sleeve Pointelle Crewneck Sweater
-
News Videos4 days agoCan Astrology Help Find Gold and Silver Trends? A Financial Astrology Guide
-
Sports7 days agoJordan Coyle & Cordiamo take Laya Arena Stakes at RDS
-
Business7 days agoUS stocks: Dow closes at record on Mideast optimism; SpaceX, AMD drag Nasdaq
-
Politics7 days agoReform UK And Greens Sink To Lowest Favourability Ratings To Date
-
Tech5 days agoRinn Pharma & Biopharma to join NordicPharmaTrain network
-
Business4 days agoHow to Start a Cleaning Business: A Step-by-Step Guide
-
Business3 days agoDatadog: Best Of Breed For Multiple Reasons
-
Business4 days agoBDC Weekly Review: Private BDC Q2 Numbers Are Strong
-
NewsBeat23 hours agoCommunication cards help banking customers access services or report scams
-
Sports7 days ago
Spider-Man: Brand New Day ending explained: Is Peter Parker alive?
-
Tech6 days agoPrice Hikes May Be Coming for PC Motherboards Next
-
Business6 days agoBrightwater secures funding for WA-first dementia projects
-
Crypto World7 days agoGalaxy Digital Stock Slides 14% as Crypto Prices Hit Earnings
-
Politics7 days agoThe Not-So Talented Mr Arday
-
Business2 days agoOil Price Today (August 11): Crude oil rises to $88 after Trump’s compensation demand dents Hormuz opening. Here’s why
-
Tech7 days agoHow to Use Your Phone as a Webcam on PC and Mac (2026)
-
Business7 days agoSpaceX Shares Plunge 13.6% After First Public Earnings as AI Capex Surge and Lockup Spark Selloff
-
Fashion5 days agoWeekly News Update, 8.6.26 – Corporette.com
You must be logged in to post a comment Login