Rumors that Trade.XYZ has been seeking a $200 million equity financing at a $1.5 billion valuation have sparked conflicting views across the crypto community, with supporters calling the report credible while others have dismissed the claim.

According to market chatter circulating on X and Telegram, speculation about the funding round gained traction after several community figures discussed the possibility of Trade.XYZ raising outside capital.

Source: ProMint on X.

The reported terms describe a $200 million equity round valuing the company at $1.5 billion, although Trade.XYZ has not publicly confirmed that such a fundraising process is underway.

Community debate has split over Trade.XYZ funding rumors

The discussion gathered pace after crypto commentator ProMint said he had heard the fundraising claim from people he knows and had seen similar reports circulating across the crypto community. In the same post, he said he believed the reports were more likely to be genuine than market noise, while arguing that venture investors can provide legal, strategic and networking support in addition to capital.

Earlier reports shared by the Telegram channel whoiskevin radar also claimed, citing what it described as “good authority,” that Trade.XYZ was raising a new equity round. A follow-up message from the same channel stated that the reported valuation was $1.5 billion and that the fundraising would be structured as an equity financing.

Not everyone accepted the claims. Cobie said the probability of Trade.XYZ completing such a financing round was zero, directly challenging the speculation spreading through social media.

The differing opinions prompted further debate within the community. One participant questioned why Trade.XYZ would seek external investors if it required additional capital, asking why the company would not instead obtain funding from the Hyperliquid team led by Jeff.

Trade.xyz has not confirmed the reported fundraising

Despite the growing discussion, Trade.XYZ has not announced an equity financing, disclosed fundraising plans or commented publicly on the reported valuation.

As a result, the reported $200 million raise remains an unverified market rumor rather than a confirmed corporate transaction.

Community members supporting the possibility of a financing have pointed to Trade.XYZ’s existing business as a reason institutional investors could still be interested, arguing that strategic investors often contribute expertise alongside capital. Those views, however, remain opinions expressed by individual commentators rather than statements from the company.

Advertisement

Trade.xyz recently reimbursed users after SK Hynix liquidation event

The financing speculation has surfaced only days after Trade.xyz announced a reimbursement program for users affected by an unusual SK Hynix liquidation event.

On July 29, the company said it would compensate eligible liquidation losses tied to an SK Hynix price anomaly that occurred at 23:01 UTC on July 27. Trade.xyz described the reimbursement as a one-time discretionary decision and said eligibility requirements would be released separately before distributions begin.

Earlier reporting by crypto.news showed that the SK Hynix mark price briefly dropped from $1,127.90 to $917.25, triggering forced liquidations of leveraged long positions before prices recovered.

Trade.xyz said multiple independent market data providers transmitted an executed trade from South Korea’s NextTrade pre-market and that its oracle behaved according to its published design because it tracked that external venue.

Advertisement

Hyperliquid separately said the affected market was independently deployed and operated by Trade.xyz under the HIP-3 framework. Under that model, external builders are responsible for defining oracle and mark-price inputs for their own markets, while Hyperliquid provides the trading, margin, and liquidation infrastructure.

Luno customers covered by the exchange’s regional-exit notice can no longer send cryptocurrency to another wallet or platform. 

They must sell their holdings before withdrawing cash to a bank by Aug. 31.

The restrictions apply to an undisclosed group of customers whose accounts will close permanently on Sept. 1. As of Aug. 3, Luno had not publicly identified the affected regions or stated how many users received the notice.

Luno crypto transfers ended on June 29

Luno began limiting the affected accounts on June 1. It disabled deposits, crypto purchases, incoming transfers, recurring purchases and pending orders. Customers could still sell assets, withdraw money to a bank and send crypto elsewhere until June 29.

The transfer window has now closed. Users who missed it cannot preserve their holdings by moving the assets through the standard account process. Luno’s guidance says their remaining ordinary option is to sell the crypto and withdraw the fiat proceeds by Aug. 31.

🚨 Luno users in affected regions are running out of time.

Customers who can no longer transfer crypto to external wallets may have to sell their holdings and withdraw to a bank before account closures begin.

Advertisement

Missing the deadline could leave remaining balances subject to… pic.twitter.com/6X3ppwt6MU

— Crypto Arena Team (@CryptoArena_Co) August 3, 2026

Meanwhile, selling and normal bank withdrawals will stop after Aug. 31, while wallet access will end when accounts close on Sept. 1. Luno advises customers who have never verified a withdrawal account to contact support because deposits, which some regions use for bank verification, are already disabled.

Customers seeking help must provide a bank statement or letter issued within the previous three months. It must show their name and account details. Luno says manual withdrawals after closure usually take three to five business days once the required information has been confirmed.

Remaining balances could face monthly fees

Luno says balances below the equivalent of $10 cannot be processed because of minimum withdrawal thresholds. Under the notice, the company will retain those balances after Sept. 1 rather than placing them into the manual-withdrawal process.

Balances above $10 remain eligible for manual withdrawal after closure, but charges begin in September. Luno says it will impose a $2 monthly inactivity fee. From December, an additional $50 dormancy charge applies, raising the stated monthly cost to $52 while funds remain stored.

Luno still has not named the affected regions

The company says it is withdrawing to “focus on our core markets across Africa and South East Asia.” Its current availability page names Kenya, Nigeria and South Africa as supported African markets, alongside Indonesia and Malaysia in Southeast Asia. The list does not establish which other regions received closure notices.

Luno also maintains a separate list of 33 unsupported countries and territories. However, the regional-exit guidance does not connect the Sept. 1 closures to that list, a regulator, a security incident or financial distress. Customers must therefore rely on direct account notices to determine whether the timetable applies to them.

The withdrawal deadline arrives during a wider company restructuring.As crypto.news reported, Luno confirmed plans on July 28 to cut about 20% of its global workforce while directing more resources toward institutional and business-to-business services. Chief Executive James Lanigan did not disclose the number of positions or regions affected.

The account closures and job cuts should not automatically be treated as the same action. Luno has not publicly linked them. Still, both move narrow parts of its earlier global retail footprint while management concentrates spending on selected markets, infrastructure and professional services.

Luno previously used a country-specific wind-down when it exited Singapore in 2023. In related coverage, crypto.news reported that Singapore customers received a named service-ending date and were told to remove both crypto and local-currency balances. The current notice differs because Luno has not publicly named the regions involved.

The next firm deadlines are Aug. 31 for ordinary sales and bank withdrawals, Sept. 1 for account closure, and December for the additional monthly dormancy fee. Affected users with bank-verification problems must contact Luno before the ordinary withdrawal route closes.

Coldcard’s five-year seed-generation flaw has renewed calls for independent testing of hardware wallet firmware after suspected attacks have drained nearly $90 million worth of Bitcoin from thousands of wallets.

Kraken chief security officer Nick Percoco said in a post on X on Sunday that the incident should serve as a warning for the hardware wallet industry, arguing that manufacturers should not be the only parties verifying how wallet seed phrases are generated. 

He said production firmware should undergo independent testing to confirm that the approved source of randomness is the one actually used when creating wallet secrets.

Advertisement

According to Galaxy Research’s latest blockchain analysis, suspected attackers have now swept more than 1,800 BTC from over 5,200 potential victim addresses across four observed attack waves, although the firm has stressed that those figures are on-chain estimates rather than confirmed losses. Coinkite has not verified every affected wallet, and blockchain data alone cannot determine whether a single actor carried out all of the attacks.

Coldcard flaw escaped review for more than five years

Coinkite disclosed on Thursday that the vulnerability dates back to March 2021, when the company migrated part of its firmware while integrating a new cryptographic library.

Instead of using Coldcard’s intended hardware-backed true random number generator to create wallet seeds, the updated firmware accidentally called a weaker deterministic pseudo-random generator provided by MicroPython. 

According to Coinkite’s postmortem, the intended random-number generator remained active elsewhere in the firmware, allowing code reviews to verify its presence without revealing that wallet creation relied on a different source of entropy.

Advertisement

The company said it was unaware that the MicroPython generator existed in the relevant code path until the investigation. While the hardware random-number generator continued operating for other functions, it was no longer responsible for generating new wallet secrets.

Block’s Bitcoin engineering and security team independently reached the same conclusion during its technical review. The company said the affected firmware invoked the deterministic MicroPython fallback instead of the STM32 hardware random-number generator when creating wallet seeds. Although Block said it had not completed full empirical testing of every device, it decided to disclose its findings because reports of active theft had already emerged.

Coinkite estimates that seeds created on affected Mk2 and Mk3 devices may contain about 40 bits of effective entropy, while affected Mk4, Mk5 and Q models may contain about 72 bits instead of the intended 128 bits.

Advertisement

Hardware wallet testing has lacked entropy verification

Using the Coldcard incident as an example, Percoco argued that hardware wallet certification has overlooked one of the most important parts of wallet security.

He said users currently have to trust that manufacturers correctly implement seed generation because no independent process verifies that production firmware actually calls the approved entropy source. Existing certifications, including Common Criteria evaluations for secure elements, CSPN reviews and vendor-sponsored audits, do not systematically validate that relationship, according to Percoco.

To illustrate the gap, he pointed to NIST SP 800-90B, the U.S. standard governing the design and validation of true random-number generators used in cryptographic systems, along with Germany’s BSI AIS-31 framework, which sets similar testing requirements. He argued that comparable end-to-end verification does not currently exist for hardware wallets.

Percoco also compared the sector with payment security, noting that PIN entry devices cannot be shipped without independent laboratory testing, while U.S. government cryptographic modules require entropy source validation before approval.

Advertisement

Coldcard users still need new wallet seeds

As attack activity continued over the weekend, Coinkite said it had halted all shipments after confirming the vulnerability and destroyed every remaining device in its facilities containing the affected firmware.

The company nevertheless advised customers not to discard affected devices because they may become important if stolen funds are eventually recovered through legal proceedings. Coinkite added that its legal team would coordinate with law enforcement agencies in multiple jurisdictions where appropriate.

Firmware updates have already been released for every affected model, including version 4.2.0 for Mk2 and Mk3, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for Coldcard Q, and versions 6.6.0X and 6.6.0QX for Edge releases. According to the company, installing updated firmware only fixes future wallet creation and does not strengthen seed phrases generated before the patch.

For that reason, users covered by the advisory are being instructed to generate entirely new seed phrases after updating their devices, verify a receiving address, send a small test transaction, and migrate the remaining balance only after confirming the transfer succeeded.

Advertisement

Coinkite said wallets created using at least 50 fair, private dice rolls are not considered exposed by the random-number-generation flaw alone. The company added that a strong and unique BIP-39 passphrase provides another layer of protection but does not remove the weakness from an already affected seed, meaning migration remains the recommended course of action.

Ongoing attacks continue to expand the known losses

Separate blockchain analysis from Galaxy Research indicates that the attacks have continued since the vulnerability became public.

Alex Thorn, head of research at Galaxy, identified a suspected fourth coordinated attack wave on Aug. 3, bringing the firm’s observed total to about 1,815.75 BTC across 5,294 potential victim addresses if none of the address groups overlap. Thorn described the wallets as “likely Coldcard victims” and emphasized that the figures come from blockchain analysis rather than confirmed device records or law enforcement findings.

Galaxy also reported that attack activity reached 13.8 wallet sweeps per block during the latest wave, compared with a baseline of 0.3 sweeps per block before the incident. The firm observed that most victim balances were sent to newly created addresses instead of a single collection wallet, while some funds had already moved through second-hop transactions, making the stolen Bitcoin harder to trace.

Advertisement

According to Galaxy, users whose stolen funds remain in unconfirmed Bitcoin transactions may still have a narrow opportunity to broadcast a higher-fee replacement transaction before miners confirm the original transfer. 

Citing Bitcoin Core documentation, the research firm noted that Replace-by-Fee can only be attempted while the transaction remains unconfirmed and does not guarantee recovery even when the legitimate owner still controls the affected keys.

Nasdaq-listed crypto treasury company ZeroStack warned that substantial doubt exists about its ability to continue operating over the next year, reversing its assessment from three months earlier. 

In a Form 10-Q filed with the US Securities and Exchange Commission (SEC) on Friday, ZeroStack reported $2.6 million in cash, negative working capital of $600,000 and an accumulated deficit of $339.1 million as of June 30. The company also posted an $82.5 million fair value loss on digital assets and a net loss of $61.3 million for the first half of 2026.

ZeroStack said its 75.1 million Zero Gravity (0G) tokens had an aggregate cost of $163.3 million and a fair value of $15.2 million as of June 30, leaving the holdings valued about 91% below their recorded costs. 

ZeroStack relies on staking rewards and token sales to fund operations, making its ability to raise cash dependent on 0G’s price and trading liquidity.

ZeroStack’s 0G strategy faces a liquidity test 

ZeroStack reported $3.8 million in staking revenue during the first half of the year, earning about 6.6 million 0G tokens after validator commissions. It sold nearly 4.9 million tokens for $2.4 million to fund its operating expenses. 

The company expects its cash and staking reward sales to cover forecast operating costs and said it could sell some of its treasury holdings if needed. However, management said it could not conclude that those plans would be enough to ease doubts about its ability to continue operating.

Related: BitMart withdrawals appear to slow following wind-down announcement

The latest assessment reverses the company’s position in its previous two reports. In its first-quarter filing, ZeroStack said its cash and staking rewards would be sufficient to meet its working capital requirements and obligations for at least another year.

The company was previously the cannabis and CBD products firm Flora Growth. On Sept. 19, Flora announced $401 million in funding for a 0G treasury strategy, including $35 million in cash and equivalent commitments and more than $366 million in in-kind digital assets. The company subsequently rebranded as ZeroStack and retained its Nasdaq listing.

Magazine: The real reason DeFi projects that survived 2022 crash are shutting down now

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Coldcard’s five-year seed-generation flaw has become more than a single-vendor incident, with Kraken’s chief security officer Nick Percoco arguing that it highlights a structural gap in how hardware wallets are independently tested. In particular, he says security reviews often verify that the “right” entropy source exists in the codebase, but may not confirm that production firmware actually calls the validated randomness path.

Percoco’s warning follows an ongoing exploit campaign widely believed to target weak seed phrases produced by affected Coldcard devices. As of Sunday, more than 4,500 addresses were reported impacted, with losses estimated at nearly $90 million in Bitcoin, according to Cointelegraph’s ongoing coverage.

Key takeaways

• Kraken’s Nick Percoco says hardware wallets are often not subject to end-to-end verification that the approved entropy/RNG source is the one production firmware executes.
• Coldcard’s vulnerability traces to a process change approved in March 2021, after Coinkite integrated a new cryptographic library.
• Coinkite’s postmortem describes a shift where seed generation relied on a weaker MicroPython generator instead of the intended TRNG most of the time.
• Percoco points to established standards like NIST SP 800-90B and BSI AIS-31 as models for how entropy sources should be validated.
• Coinkite says it halted shipments of affected devices and destroyed remaining units containing the vulnerable firmware, while advising users not to dispose of hardware immediately.

Why the Coldcard case is a test-process problem, not just a bug

In an X post on Sunday, Percoco characterized the Coldcard issue as a “wake-up call” for hardware-wallet manufacturers. His core point was that consumers are asked to rely on a vendor’s implementation of the system’s most critical function—secure randomness—without a corresponding independent check that the validated randomness path is actually what ends up running in production.

“Consumers are asked to trust a manufacturer’s implementation of the single most critical function in the system, with no independent verification that the approved entropy path is the one actually executing,” Percoco wrote, arguing that this gap can allow critical cryptographic expectations to be silently violated.

He contrasted the state of digital-asset self-custody testing with practices in other security-critical sectors. As he framed it, industries that handle sensitive authentication hardware and cryptographic modules typically require more rigorous verification of entropy sources than what is commonly enforced in the hardware-wallet ecosystem.

What Coinkite says went wrong in March 2021

Coldcard’s broader timeline centers on changes made in March 2021. Coinkite disclosed that a software flaw had been present since then, when Coldcard altered its seed-generation approach as part of integrating a new cryptographic library.

According to Coinkite’s postmortem, the migration inadvertently routed wallet creation through a weaker MicroPython generator that already existed in the codebase, rather than using Coldcard’s intended true random number generator (TRNG). The company’s account describes a situation where the TRNG code was present and could be reviewed and confirmed, but it was not the primary source used during seed generation.

Coinkite summarized the problem by saying that “the bulk of randomness on the COLDCARD was coming from a PRNG that I didn’t know was actually in the source code base,” while the carefully crafted TRNG code was being used only “by chance” and “only for less important things.”

This distinction matters because it reframes the vulnerability: rather than the TRNG being entirely missing or nonfunctional, the risk appears to stem from the firmware executing a different randomness source than the one reviewers might reasonably assume would be used for security-critical seed creation.

Standards exist—yet Percoco says they aren’t applied end to end

Percoco said the failure to detect the issue for years is consistent with how many wallet evaluations are structured. He argued that while code reviews can establish that a TRNG is included and appears to work, there is often no systematic check that verifies the entropy source actually invoked by production firmware matches the entropy that was validated.

He pointed to requirements used for physical true random number generator design and validation, citing NIST SP 800-90B, a US standard for cryptographic randomness validation, and BSI AIS-31, an analogous German standard from the Federal Office for Information Security.

“Such checks are already standard across the rest of the security industry,” Percoco said. His broader critique was that hardware wallets currently lack an equivalent, universally enforced process that forces end-to-end validation of the RNG path—from approved design, to tested behavior, to the exact call executed at runtime.

For investors and security-focused users, the implication is straightforward: if independent testing does not verify the operational link between validated randomness and deployed firmware, the security model can be weakened even when the codebase contains the correct components.

Coldcard and Coinkite response: halted shipments and guidance to users

Following disclosure of the underlying flaw, Coldcard said Sunday it has halted all device shipments since confirming the vulnerability on Thursday. Coinkite also stated it destroyed remaining units at its facilities that contained the affected firmware.

At the same time, Coinkite advised users with affected devices not to dispose of them, noting that they “may become essential if funds are recovered.” The company also said its legal team will coordinate, as warranted, with law enforcement across multiple jurisdictions to support efforts to identify those responsible.

The ongoing nature of the exploit makes the guidance more than a technical footnote. When seed phrase weaknesses are involved, practical remediation often depends on forensic details and the potential recovery process, which can be complicated if devices are discarded.

Earlier reporting from Cointelegraph has described the exploit as targeting weak seed phrases generated by affected Coldcard devices, with additional analysis of theft totals and affected addresses. The scale reported as of Sunday—over 4,500 addresses impacted and losses approaching $90 million in Bitcoin—adds urgency to both user instructions and improvements to how wallets are tested before release.

What to watch next

For the market, the key question is whether this incident drives a measurable shift in independent validation practice—specifically, whether future hardware-wallet reviews will include end-to-end confirmation that production firmware uses the validated entropy source for seed generation. Until that standard becomes routine, incidents like Coldcard’s may continue to reveal weaknesses that are invisible to partial audits.

Bitcoin traded near $62,747 early on Aug. 3 after reaching an intraday high of $63,697, as investors prepared for five major U.S. economic releases and several closely watched corporate earnings reports.

The week begins with the July ISM Manufacturing PMI on Monday. It ends with the official July employment report on Friday. Between those releases, traders will receive job-opening data, private payroll figures and the ISM Services PMI. Together, the reports could alter expectations for Federal Reserve policy after officials kept interest rates unchanged last week.

Bitcoin’s response to Iran diplomacy remains muted

The first potential catalyst arrived before the U.S. trading week began. President Donald Trump canceled planned strikes against Iran and said negotiations intended to reopen the Strait of Hormuz would begin on Monday.

BREAKING: US stock market futures rise after President Trump calls off strikes on Iran and says a deal is near:

1. S&P 500: +0.5%
2. Nasdaq 100: +0.8%
3. Dow Jones: +0.4%
4. WTI Crude: -7.5%
5. Brent: -10.0%
6. Gold: +0.7%

Peace deal headlines are back.

— The Kobeissi Letter (@KobeissiLetter) August 2, 2026

Advertisement

Oil reacted sharply. Brent crude fell more than 5% to around $83 per barrel, while West Texas Intermediate dropped below $80. Bitcoin briefly moved toward $63,700 but failed to hold the advance, showing a weaker response than energy markets.

Trump has claimed “there’s a deal” concerning the strait. However, no final agreement had been publicly verified early Monday, and Iranian representatives disputed reports that Tehran had already accepted the proposed arrangement. The planned talks therefore represent a diplomatic opening rather than a completed settlement.

The limited Bitcoin move follows a pattern seen during earlier negotiations. As previously reported, oil has often responded more directly because shipping disruptions affect global energy supplies. Bitcoin has remained more sensitive to liquidity, interest rates and institutional demand.

Five U.S. releases could reset Fed expectations

The ISM Manufacturing PMI will arrive at 10 a.m. ET on Monday. The Bureau of Labor Statistics will publish June job openings at 10 a.m. ET on Tuesday, followed by ADP’s July private-employment report and the ISM Services PMI on Wednesday.

Key Events This Week:

1. Markets React to Trump Cancelling US Strikes on Iran – Today, 6 PM ET

2. July ISM Manufacturing PMI data – Monday

3. June JOLTS Job Openings data – Tuesday

4. AMD, $AMD, and SpaceX, $SPCX, Report Earnings – Tuesday

Advertisement

5. July ADP Nonfarm Employment…

— The Kobeissi Letter (@KobeissiLetter) August 2, 2026

The final and most closely watched release is Friday’s July employment report at 8:30 a.m. ET. June payroll growth slowed to 57,000 jobs, while the government revised April and May employment growth lower by a combined 74,000. The unemployment rate fell to 4.2%, partly because the labor force contracted.

The Federal Reserve held its target rate at 3.5% to 3.75% on July 29. Its statement said economic activity continued to expand at a solid pace despite elevated uncertainty connected partly to the Middle East conflict. The decision passed by a 9–3 vote.

Stronger employment or services data could support expectations that the Fed will keep rates elevated or consider another increase. A broader slowdown could reduce pressure on bond yields and support risk assets. Neither outcome guarantees a Bitcoin breakout because markets will react to how far each figure differs from expectations.

Bitcoin needs more than one favorable report

Bitcoin’s muted response to the canceled Iran strikes suggests that one positive headline may not be enough to end the current consolidation. A durable move would likely require several data points to tell the same economic story.

For example, weak job openings followed by slowing private payrolls and softer official employment growth could strengthen the case that labor demand is cooling. However, that effect could be offset if the ISM reports show rising input prices or stronger services activity.

Crypto markets have reacted quickly to labor surprises before. As crypto.news reported, Bitcoin moved above $62,000 after June payroll growth missed forecasts, as traders reduced expectations for tighter monetary policy.

Still, the latest Fed decision showed that policymakers remain focused on inflation as well as employment. In related coverage, Bitcoin weakened before the July meeting as traders reduced risk and waited for clearer guidance.

Earnings add another test before Friday’s jobs report

Corporate results will create another source of volatility. AMD and SpaceX are scheduled to publish quarterly results after Tuesday’s market close. Sandisk will report on Wednesday, followed by other major U.S. companies later in the week.

FactSet reported that 61% of S&P 500 companies had released second-quarter results by July 31. Of those companies, 86% exceeded earnings estimates and 77% surpassed revenue forecasts. The index’s blended annual earnings growth rate stood at 47.4%.

Strong technology earnings could support general risk appetite. However, those companies do not provide a direct catalyst for Bitcoin comparable with interest-rate expectations, ETF demand or changes in dollar liquidity.

The clearest timetable is therefore Monday’s manufacturing report, Tuesday’s job openings, Wednesday’s private payroll and services data, and Friday’s official employment figures. A Bitcoin breakout would require sustained buying after those releases rather than a brief reaction to one favorable number.

But whatever the label on Sunday’s transaction, the direction has not changed since December.

Trump Media bought 11,542 bitcoin for about $1.37 billion at an average of $118,522 a coin, close to the top of last year’s cycle. Wallets linked to the company have since moved out 7,281 of them.

Onchain analytics firm Lookonchain said those flows as sales averaging $74,855 a coin, which against the original cost basis would mark roughly $318 million in realized losses, with another $237 million sitting unrealized on what is left.

And the treasury has been shrinking faster than the business it sits on. Trump Media posted a $405.9 million net loss in the first quarter on $871,200 in revenue, with $368.7 million of that coming from markdowns on digital assets and equity holdings, including 756 million Cronos tokens acquired through the Crypto.com partnership that has now handled two of these transfers.

Crypto.com is one of the company’s two named custodians alongside Anchorage Digital, so a deposit there is what a custody move would look like. It also runs the exchange, so it is exactly what a sale would look like too, and the chain will not separate them.

The answer will be in the second-quarter 10-Q. A sale shows up as a realized loss on the income statement, while a custody move shows up nowhere. Whatever the wallets have been doing since December has to appear in one column or the other.

Treasuries rallied across the curve as the oil move eased inflation worries, taking the 10-year yield down four basis points to 4.69% after it hit its highest since January 2025 last week. Nasdaq 100 futures and European share futures both gained 0.8%. Gold added 0.3% to about $4,060 an ounce.

Falling oil, falling yields and rising stock futures usually give crypto a lift. This time bitcoin ignored all three — because the pressure on it is coming from a broken hardware wallet rather than from the macro.

As CoinDesk reported Sunday, a third wave of sweeps against Coldcard-generated addresses were found over the weekend, bringing observed losses to 1,367 bitcoin, nearly $89 million, across 4,585 addresses.

The average haul per address has fallen with each wave, which suggests the attacker has worked through the large balances, and later moved to emptying wallets worth a few thousand dollars.

Wave one took 1,083 bitcoin from 1,196 addresses on July 30, but wave three took 208 BTC from 1,912 wallets, which is more wallets for a fifth of the money.

Meanwhile, ether funds took small inflows on Friday while bitcoin funds saw an outflow, an unusual split for a market where bitcoin normally sets the direction and ether follows.