Emerson College Polling surveys of likely midterm election voters paint a similar picture. In March, 49% of respondents said they planned to support the Democratic candidate, while 42% said they would vote Republican. By May, Democrats widened that lead by 2 percentage points, and by July, the gap widened by another 2 points to 53% for Democrats and 42% for the GOP.

George Santos has settled CFTC case over Kalshi prediction market trades by accepting penalties and a three-year trading ban after regulators found he made misleading public statements while betting on his attendance at President Donald Trump’s State of the Union address.

According to a July 31 order from the U.S. Commodity Futures Trading Commission (CFTC), former U.S. Representative George Santos must return $17,569.98 in trading gains, pay a $17,500 civil monetary penalty, comply with a cease-and-desist order, and stay away from trading on any CFTC-registered entity for three years after settling allegations tied to trades on prediction market platform Kalshi.

The settlement closes an investigation that began earlier this year after Kalshi referred Santos’ trading activity to regulators. While Santos accepted the settlement, the order states that he neither admitted nor denied the agency’s findings or legal conclusions.

CFTC says Santos traded both sides of Kalshi market

Regulators said Santos opened a Kalshi account on Feb. 11, roughly four months after President Donald Trump commuted his prison sentence. The former congressman funded the account with about $7,000 and traded only one event contract, which asked whether he would attend Trump’s State of the Union address.

Trading records included in the order show Santos initially accumulated 30,874 “Yes” contracts between Feb. 12 and Feb. 22 for $6,695.94.

Around the same period, Santos posted on X asking followers whether he should wear a serious or bedazzled suit to the address. The CFTC said the market price for the “Yes” outcome climbed from about $0.15 to $0.70 after the post. Santos later sold his entire position, making a profit of $3,448.43, before withdrawing $10,146.07 through a newly created Venmo account.

Later that day, his airline informed him that his flight to Washington had been canceled. Although he purchased a train ticket and continued posting publicly that he expected to attend, regulators said his trading activity soon moved in the opposite direction.

According to the order, Santos posted another video on Feb. 23 stating that he would attend the speech from the House gallery. About 40 minutes later, he started buying contracts that would pay out if he did not attend.

The CFTC said Santos eventually accumulated 23,855 “No” contracts worth $8,650.66. His train was canceled about an hour after he began building that position. Even after another X user asked whether he would still attend, Santos replied that he would, despite already knowing that both his flight and train had been canceled, information the agency said was not disclosed to the public.

Kalshi activity led to the CFTC investigation

On the day of the State of the Union address, internet records cited by the commission showed Santos accessing Kalshi from his residence rather than traveling to Washington. He later posted that watching the speech on an airport television had not been his original plan.

As the event unfolded, the “Yes” contract price dropped from $0.73 to $0.02, increasing the value of Santos’ “No” position. The order states that he exited those trades early on Feb. 25 with a reported profit of $14,390.57.

Based on that trading sequence, the CFTC concluded that Santos made misleading public statements and omitted material information that influenced the market price for his own financial benefit.

Instead of treating the conduct as a conventional insider trading case based on confidential information, the commission pursued the matter under the Commodity Exchange Act’s anti-manipulation provisions and CFTC Regulation 180.1. The order also classified the State of the Union attendance contract as a swap subject to the agency’s enforcement authority.

Earlier reporting by NPR in June said both the Department of Justice and the CFTC had opened investigations after Kalshi froze Santos’ account and referred the matter to regulators. However, the Washington Examiner later reported that a DOJ official denied the department had an active case, leaving the CFTC settlement as the only confirmed federal enforcement action tied to the trades.

Santos disputes allegations while accepting settlement

Responding through his attorney, Joseph W. Murray, Santos said he originally intended to attend the State of the Union address before severe winter weather disrupted his travel plans.

Murray denied that Santos intended to mislead traders or manipulate the prediction market. He also said his client chose to resolve the matter through settlement rather than continue with expensive litigation.

The CFTC order, however, concluded that Santos’ public statements and omissions occurred while he actively traded positions tied to the same event, allowing him to benefit from price movements in both directions.

Separately, Kalshi said it detected the unusual trading activity through its surveillance systems, froze Santos’ account, and supplied evidence to federal regulators.

Speaking to Axios last month, Kalshi Chief Executive Officer Tarek Mansour said the platform flagged the activity within seconds and received roughly 100 whistleblower complaints within minutes. He added that the exchange plans to pursue its own enforcement action for violations of exchange rules.

Kalshi also said it may reimburse affected traders if it successfully recovers funds from Santos. The company linked its monitoring process to integrity systems developed through its partnership with Sportradar.

Prediction markets continue facing regulatory scrutiny

The Santos case arrives as prediction markets continue drawing attention from regulators over insider trading and market manipulation concerns.

Earlier this year, Kalshi suspended three federal political candidates after determining they had traded on markets involving their own election contests. According to the company, candidates who can directly influence an event’s outcome violate exchange rules regardless of trade size.

Unlike those disciplinary actions, the Santos matter resulted in a referral to federal regulators and ultimately concluded with a formal CFTC enforcement order.

The agency’s approach also follows other recent prediction market cases. Federal prosecutors have charged U.S. Army Master Sgt. Gannon Ken Van Dyke with allegedly using advance knowledge of a military operation to generate more than $404,000 from Polymarket trades tied to Venezuelan President Nicolás Maduro. 

In another case, prosecutors accused former Google software engineer Michele Spagnuolo of using confidential Google search ranking data to place multimillion-dollar bets on Polymarket before the information became public.

As regulatory attention has increased, Kalshi has introduced screening tools designed to identify participants directly connected to events listed on its platform, while Polymarket has expanded surveillance programs and hired blockchain analytics firm Chainalysis to assist investigations into insider trading and market manipulation.

South Korea has finalized its 2026 tax reform package while keeping the planned 22% tax on cryptocurrency investment gains set to begin on Jan. 1, 2027.

South Korea’s Ministry of Economy and Finance confirmed on Aug. 3 that it had finalized the 2026 tax reform proposal without including another postponement for virtual asset taxation, clearing the way for the long-delayed measure to proceed next year if lawmakers approve the package in the National Assembly.

Under the current Income Tax Act, profits from transferring or lending virtual assets will be taxed as other income from Jan. 1, 2027. Investors will pay a 20% national tax, with an additional 2% local income tax, on annual gains exceeding 2.5 million won ($1,740). The first tax return covering crypto income earned during 2027 will be filed in May 2028.

The ministry also included an example showing how the tax would apply. An investor earning a 5 million won annual profit from Bitcoin trading would first deduct the 2.5 million won exemption before paying 22% tax on the remaining amount, resulting in a tax bill of 550,000 won.

South Korea has ended another delay in its tax proposal

The tax was originally scheduled to take effect in January 2022 after lawmakers approved amendments to the Income Tax Act in 2020. However, implementation was postponed three times, first to 2023, then to 2025, and later to 2027, as authorities cited incomplete reporting systems and unresolved administrative infrastructure.

Government officials now say those preparations have largely been completed.

The ministry pointed to the Organisation for Economic Co-operation and Development’s Crypto-Asset Reporting Framework (CARF), under which South Korea expects to receive overseas virtual asset transaction data from tax authorities in 48 participating jurisdictions, including Japan, Germany and France, beginning next year. Officials said the international reporting system would significantly reduce blind spots involving offshore crypto transactions.

Finance Minister Koo Yun-cheol had already indicated during a National Assembly Finance and Economic Planning Committee meeting on July 29 that the government intended to proceed with the tax as scheduled while improving the system after implementation where necessary.

Parliament can still change the crypto tax timeline

Although the government has finalized its proposal, the tax reform package still requires approval from the National Assembly before becoming law.

The ministry acknowledged that parliamentary discussions could still result in another delay or other legislative changes before the tax takes effect.

The opposition People Power Party continues to oppose the measure and has proposed amendments to remove crypto income from the Income Tax Act altogether. Party lawmakers have argued that taxing retail cryptocurrency investors while most retail stock investment gains remain exempt creates unequal treatment.

Earlier committee discussions also raised concerns over the current tax design. During the July 29 hearing, People Power Party lawmaker Kim Sang-hoon questioned the absence of rules allowing investors to carry forward trading losses, warning that the framework could encourage traders to move activity from domestic exchanges such as Upbit, Bithumb, Coinone and Korbit to overseas centralized exchanges, decentralized finance platforms or peer-to-peer markets.

Responding during the hearing, Koo said moving virtual assets into South Korea’s capital gains tax framework would require a broader review of the country’s financial tax system. He added that authorities could consider revisions after gaining experience with the tax’s operation.

Digital asset rules continue developing alongside the crypto tax

Separate from the tax package, South Korea is also preparing a wider regulatory framework for digital assets.

The Financial Services Commission told the National Assembly in late July that it is working with the ruling Democratic Party on a consolidated Digital Asset Basic Act. The proposed legislation would combine 10 pending digital asset and stablecoin bills into one framework covering stablecoin issuance, exchanges, disclosures, internal controls and system resilience.

Several issues remain unresolved, including ownership requirements for issuers of won-backed stablecoins and possible ownership limits for major cryptocurrency exchanges.

At the same time, the National Tax Service has established a dedicated digital asset unit and continues preparing implementation guidance for the upcoming crypto tax, according to previous government statements.

Tax policy is expanding beyond cryptocurrencies

South Korea has also begun clarifying how other blockchain-based assets could be taxed.

In June, the Ministry of Economy and Finance said tokenized stocks should generally be treated as securities rather than virtual assets because their economic characteristics resemble conventional securities despite using blockchain technology.

The ministry said taxation could begin under existing securities tax rules once the Financial Services Commission formally determines that tokenized stocks qualify as securities. Officials also indicated that overseas-issued tokenized stocks could still fall under South Korean tax rules depending on the rights attached to the assets.

Meanwhile, tax authorities have been strengthening information-sharing arrangements with overseas counterparts. Alongside participation in the OECD’s Crypto-Asset Reporting Framework, officials have previously said they are expanding cooperation with foreign tax agencies to improve oversight of cross-border digital asset transactions.

Unless lawmakers approve another postponement or pass the pending repeal proposal before the end of 2026, South Korea’s 22% tax on annual cryptocurrency gains above 2.5 million won will take effect on Jan. 1, 2027, ending several years of repeated delays.

Nigeria’s revenue agency has issued rules requiring crypto platforms and peer-to-peer (P2P) marketplaces to collect, report and remit taxes, including paying some withheld amounts in digital tokens.

In its Guidelines on Taxation of Virtual Assets, the Nigeria Revenue Service (NRS) said income tax deducted at source and stamp duty “shall be remitted to the Service in the originating token of the transaction.” Value-added tax, by contrast, must be remitted in the currency used for the payment. 

The guidelines place exchanges and P2P marketplaces at the center of withholding, reporting and remittance under the country’s existing laws.

Under the guidelines, platforms must withhold 1% of proceeds from taxable disposals of crypto assets, security tokens and applicable non-fungible tokens. A 10% withholding rate applies to staking, mining, airdrops and decentralized finance, while token-to-fiat and fiat-to-token transfers are subject to a 1.5% stamp duty.  

The withheld amounts are advance payments credited against the taxpayer’s final income tax liability. Individuals are taxed at progressive rates, while companies other than small companies face a 30% rate. Stablecoin sales are exempt from the 1% withholding tax. 

Nigeria’s crypto tax framework takes shape

The new guidelines follow an executive order signed by President Bola Tinubu that established a Virtual Asset Council chaired by the central bank, with the NRS and the Securities and Exchange Commission serving as vice chairs. On July 18, the presidency said that the NRS would release a policy to implement Nigeria’s tax laws for virtual assets. 

Nigeria’s broader tax overhaul took effect on Jan. 1 under the Nigeria Tax Act and Nigeria Tax Administration Act of 2025. The legislation treats digital assets as chargeable assets and requires virtual asset service providers to report transaction details, including customers’ names, contact information and Tax Identification Numbers. 

Related: South Africa proposes crypto tax guidance under existing framework

Nigeria first explicitly subjected gains from crypto disposals to tax through the Finance Act 2023, which imposed a flat 10% capital gains tax. The 2025 framework replaced that treatment, while the new guidelines specify how gains are valued and how taxes are withheld, remitted and reconciled. 

Magazine: How Fake World Assets and onchain gacha became crypto’s latest craze

South Korea’s two largest crypto exchanges announced four new trading markets on Aug. 4, expanding local access to the HOME, META2 and USDG tokens.

Upbit will add Defi App’s HOME token to its Korean won and Tether markets at 17:00 Korea Standard Time. Bithumb plans to open Korean won markets for MetaDAO’s META2 and Global Dollar, or USDG, at 16:00 KST. The exchanges said the opening times could change if they do not secure enough liquidity.

The announcements place a cross chain DeFi token, a market based governance token and a dollar stablecoin in front of South Korea’s active retail market. However, the listings do not change the projects’ underlying technology, token supply or regulatory status.

Upbit gives HOME direct won and USDT access

Upbit said deposits and withdrawals for HOME would open within two hours of its notice. It will support the token through Base only. Users who send HOME through another network may face delays while seeking a return of the unsupported deposit.

The exchange identified the supported HOME contract as 0x4bfaa776991e85e5f8b1255461cbbd216cfc714f. It quoted the previous closing prices at 10.1 won and 0.007069 USDT. Those figures provide reference points for Upbit’s opening restrictions rather than guaranteed launch prices.

Defi App describes itself as a self custody platform for swaps, perpetual contracts and yield products across EVM networks and Solana. Its documentation says the platform connects to outside liquidity sources and protocols while presenting them through one interface. HOME supports governance and staking within the ecosystem.

The HOME token itself uses Base for the market supported by Upbit. The distinction matters because the wider application can interact with several networks, while the exchange accepts deposits only through the chain named in its listing notice.

Bithumb adds META2 and USDG to its won market

Bithumb scheduled both META2 and USDG trading to begin at 16:00 KST. Deposits and withdrawals were expected to open within two hours of the announcement. The exchange set a reference price of 7,558 won for META2 and 1,429 won for USDG.

Both assets will use Solana for deposits and withdrawals. Bithumb initially identified Ethereum as the network for USDG but amended its notice to support Solana instead. Sending either asset through an unsupported network could prevent the deposit from being credited.

MetaDAO uses decision markets, also known as futarchy, for protocol governance. Traders take positions based on whether a proposal would raise or lower a project token’s value. The protocol then uses market prices to determine whether the proposal passes. MetaDAO’s documentation calls its token META, while Korean exchanges use META2 to distinguish it from other assets carrying similar symbols.

USDG is different because it is designed to maintain a stable value rather than deliver market driven price appreciation. Paxos Digital Singapore issues the token and operates under supervision from the Monetary Authority of Singapore. Paxos says holders can redeem USDG for U.S. dollars at a one to one rate.

As crypto.news previously reported, Paxos expanded USDG to Solana to support payments, transfers and treasury uses on the network. The stablecoin is also available on Ethereum, Ink, X Layer and Robinhood Chain.

HOME rises while USDG holds its dollar peg

HOME traded near $0.00872 during research, representing a gain of about 32.1% over 24 hours. Its daily range extended from approximately $0.00617 to $0.00924, while reported volume approached $89.4 million. The timing connects the move with the Upbit announcement, but the listing cannot be confirmed as the only cause.

META traded near $6.39, with its 24 hour trading volume rising about 50.3% to $13.6 million. The token had also gained about 55.1% over seven days. Its earlier Upbit listing and activity within MetaDAO make it difficult to isolate any reaction to Bithumb’s announcement.

USDG remained close to its intended peg at approximately $0.9993. CoinGecko reported a narrow 24 hour range between $0.9976 and $1.00, alongside a market capitalization of about $3.44 billion. Its stablecoin structure means a lasting price surge would not represent the same type of listing reaction seen in HOME or META2.

The listings continue a busy period for Korean exchanges. In related coverage, crypto.news reported that Upbit added Morpho and Euler won markets, while Bithumb has also expanded direct won access for several newer crypto assets.

New listings carry network and order restrictions

Upbit will block HOME buy orders for about five minutes after trading begins. It will also restrict sell orders priced more than 10% below the previous closing price during that period. Only limit orders will be accepted for roughly the first two hours.

Bithumb will apply similar controls to META2 and USDG. Buy orders will be unavailable for five minutes. Sell orders below 90% or above 200% of the stated reference price will also face temporary restrictions, while nonlimit orders will remain unavailable for about two hours.

Crypto security teams are facing a new imbalance: while AI model developers are restricting their most capable cyber-related systems, only a small number of crypto firms appear to have gained early access to those “frontier” tools.

Coinbase has said it secured access to Anthropic’s restricted Mythos model, and Zcash co-founder Zooko Wilcox has described how Anthropic used Mythos to audit the Zcash protocol at the request of Shielded Labs. Meanwhile, Binance’s chief security officer Jimmy Su told Cointelegraph that the exchange has been trying to make progress but has not obtained the most advanced frontier model.

Key takeaways

• Only select crypto companies have reportedly received early access to restricted frontier AI models used for cybersecurity work.
• Executives argue that gating advanced models may be necessary at first, but maintaining restrictions could become harder to justify as capabilities converge with public releases.
• Uneven access may widen the security gap between defenders and attackers, particularly as AI-assisted exploit workflows reportedly speed up.
• Some crypto-adjacent organizations, such as those embedded in critical infrastructure or security tooling, have also joined gated programs.

Why restricted “frontier” models are hard to distribute

The core issue is not whether AI can help security—many teams already use mainstream models for testing and review—but whether defenders get access to the most cyber-capable systems under developer guardrails.

Anthropic has stated that Mythos 5 shares the same underlying model as its publicly available Fable 5, but operates without safeguards that limit sensitive cybersecurity use. OpenAI is described as running a similar tiered approach, with a “Trusted Access for Cyber” pathway for verified defenders and a more permissive cyber-oriented version reserved for a smaller group conducting authorized penetration testing.

Crypto security executives interviewed by Cointelegraph suggested this kind of restricted rollout is likely warranted initially. However, they also highlighted a growing tension: once publicly available models begin to approach the same practical capabilities, continuous gating may become harder to defend—especially if attackers can leverage comparable tools from elsewhere.

Crypto executives push for faster verification pathways

Jimmy Su said Anthropic’s controlled release can be responsible because attackers may benefit from newly released capabilities sooner than defenders. In his framing, limiting early access can reduce the “blast radius,” at least during an initial testing period.

Solana Foundation’s chief information security officer Michael Coates supported guardrails but argued that “legitimate defenders” need a faster route to the models. He said the process should streamline verification and acceptance programs so security teams can use the best available systems to match the pace of exploitation.

Blockchain Capital’s Sean Cheetham expressed a similar long-term view. While restrictions can help avoid immediate misuse, broader availability could ultimately benefit defense because the population of legitimate security researchers is typically far larger than the small groups able to run highly sophisticated attacks. That scale dynamic—more defenders than adversaries—may flip the risk calculus over time.

Who has access—and who appears to be waiting

Despite being the world’s largest exchange by daily trading volume, Binance has not reportedly secured access to Mythos, according to Su. The exchange’s scale underscores the potential operational impact: Binance holds substantial assets on its platform, and a lack of frontier defensive tooling could leave major ecosystems to rely on less capable alternatives.

Beyond exchanges, other organizations have taken different approaches. Cointelegraph previously reported that Fireblocks, which provides custody and security services at large scale, sought access to Mythos but at the time relied on Anthropic’s publicly available model for pentesting. Cointelegraph also cited that Uniswap founder Hayden Adams criticized the safeguards on Fable 5 around cybersecurity prompts earlier this year.

The Ethereum Foundation has said it has been using “coordinated AI agents” to identify bugs across its systems, without disclosing which models were used. Cointelegraph reached out to the Ethereum Foundation, Fireblocks, and Uniswap to confirm whether they had received access to frontier restricted models since then.

Some crypto-adjacent companies, however, have moved further into gated programs. FIS—an infrastructure provider that partnered with Circle for USDC payments functionality last year—reportedly joined Anthropic’s Project Glasswing last month. Project Glasswing is described as Anthropic’s gated program for vetted cyber defenders and organizations responsible for critical software infrastructure to access restricted Mythos models.

HackerOne, which supports bug bounty and security testing for major organizations including crypto exchanges, also said it joined Project Glasswing, though its testing is confined to its own infrastructure rather than customer programs. Separately, Cointelegraph reached out to OpenAI and Anthropic to ask how many crypto firms had received access to restricted models.

AI-assisted attacks are reported to be accelerating

The access gap matters because defenders are not operating in a static threat environment. Cointelegraph reported that Boltz, a Bitcoin swap service, chose to halt its non-custodial bridge after observing a steady rise in AI-assisted hacking attempts over the prior few months. Boltz said attackers are now iterating faster than a team its size can find and patch, pointing to a practical pressure on incident response and code review cycles.

Other security events also suggest attackers are applying automation to find real weaknesses. Cointelegraph reported that Coinkite disclosed a vulnerability affecting some Coldcard devices, where a flaw in wallet seed generation produced less randomness than expected. Coinkite speculated that the attacker could have used AI to review earlier firmware versions to locate and exploit the weakness—even though the company had used what it described as one of the best available AI models to review its code in the weeks before.

Taken together, these reports support a broader concern: even strong internal testing using public AI tools may not be enough if adversaries deploy higher-end capabilities and iterate faster than teams can remediate.

What to watch next for crypto security

The immediate question is whether restricted model access will widen beyond early adopters and whether developers can design guardrails that protect the ecosystem without bottlenecking legitimate defenders. As AI capabilities diffuse—through both public releases and competing models—crypto teams will likely watch not only for new access announcements, but also for changes in exploitation tempo and patch turnaround times across major platforms.

BitGo Holdings launched BitGo Link on Aug. 3, giving institutional trading and treasury teams one interface for viewing and moving capital held across BitGo and connected cryptocurrency exchanges.

The New York Stock Exchange listed digital asset infrastructure provider described Link as a centralized control layer for external exchange accounts. It allows clients to monitor buying power, initiate transfers and manage user permissions without signing into each venue separately.

The product connects with BitGo’s wider custody, settlement and prime brokerage services. However, BitGo did not disclose Link’s fees, customer numbers, supported assets or a complete list of connected exchanges in its official announcement. It said only that the product connects clients with a “large network” of leading venues.

BitGo Link centralizes balances and exchange transfers

Link gives institutions a consolidated view of assets held inside BitGo and in accounts at outside exchanges. The dashboard includes subaccounts and calculates the client’s total buying power across connected venues, according to the company’s official product page.

Trading teams can use the platform to transfer funds between accounts, rebalance capital or meet margin and liquidity requirements. BitGo says Link automatically compares transfers with exchange records and displays each transaction’s progress from initiation through settlement.

The company presents the service as an answer to a common institutional problem. Firms may hold assets with a custodian while maintaining separate accounts at several exchanges. Each venue can have different permissions, reporting systems and settlement processes.

Link does not mean that every connected asset remains in BitGo custody. The service provides visibility and transfer controls for both BitGo and non BitGo accounts. That differs from the company’s off exchange settlement service, where eligible assets can remain in segregated custody while an exchange receives a projected balance for trading.

Policy controls follow capital to connected venues

Every transfer initiated through Link passes through BitGo’s Policy Engine. Institutions can apply approval requirements similar to those already used for transfers from BitGo wallets, including role based access and internal authorization rules.

Administrators can also extend permissions across connected exchange accounts from one place. BitGo said this removes the need to recreate access settings at each venue, although clients will still depend on the technical availability and terms of the participating exchanges.

CEO Mike Belshe described Link as BitGo’s “command center for institutional treasury and trading.” That language reflects the company’s positioning of the product. BitGo has not released usage data showing how many institutions have adopted it or how much capital it currently manages.

The company also identified technical integration failures, transaction errors, digital asset volatility and regulatory scrutiny among the risks that could affect its broader products. Those disclosures mean Link’s planned expansion should be treated as a company objective rather than a confirmed outcome.

Link extends BitGo’s institutional connectivity push

Link complements Go Network, which provides settlement and access to exchange liquidity within BitGo’s custody framework. It also connects with BitGo Prime, which offers execution, financing, collateral management and access to liquidity providers.

As crypto.news reported in related coverage, Gate US joined Go Network in July. That arrangement lets eligible institutional clients trade against the exchange’s liquidity while supported assets remain in BitGo Bank & Trust custody until settlement.

Link addresses a different part of the operating process. It gives treasury teams control over assets already distributed among external accounts, rather than limiting the workflow to balances held under the company’s qualified custody structure.

BitGo has also widened the services available from custody. As previously reported, the firm opened controlled access to Aave, Spark and Tesseract in June. Narval software checks approved contracts and policy rules before BitGo authorizes transactions from eligible custody wallets.

The company said it plans to connect Link with more exchanges and treasury processes over time. It did not provide a rollout calendar or identify the next venues under consideration.

Investors await BitGo’s August 12 earnings report

BTGO last traded near $5.06 on Aug. 3, approximately 4.1% above its previous close of $4.86. The available trading data does not establish that the Link announcement caused the increase.

The share price remained well below BitGo’s $18 January IPO price. The company raised approximately $174.3 million in net proceeds through the offering, according to its first quarter filing.

BitGo reported $3.77 billion in first quarter revenue, up from $1.77 billion one year earlier. Its net loss widened from $25.7 million to $60.7 million. The loss included unrealized changes in the value of its digital asset treasury and expenses connected with the IPO.

Most of the reported revenue came from digital asset sales recorded on a gross basis. Digital asset sales generated $3.66 billion, with associated costs of $3.65 billion. The accounting presentation means the headline revenue figure should not be read as an equivalent measure of service fees or operating profit.

The launch also follows a company restructuring. As crypto.news previously reported, BitGo cut nearly 15% of its workforce in June while directing resources toward security, trading, stablecoins, settlement and artificial intelligence infrastructure.

BitGo will publish second quarter results after the market closes on Aug. 12. Management will hold an earnings call at 5 p.m. Eastern Time. The report may provide the next verified update on client growth, costs and whether newer institutional products are contributing to the business.

Galaxy Research has estimated that losses tied to the Coldcard hardware wallet vulnerability have reached 1,596 Bitcoin across confirmed attack waves and could climb to about 2,055 BTC, or nearly $130 million, if a suspected fourth wave is verified.

Galaxy Research said in a post published Monday on X that it has identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks, along with 14 smaller security incidents linked to the Coldcard seed-generation flaw.

The research firm said its latest estimate excludes a fourth suspected attack wave because it has not yet received enough confirmation from affected wallet owners. If the additional activity is validated, the total would rise to 2,055 BTC, valued at about $130 million at current prices.

Earlier blockchain analysis from Galaxy had estimated roughly 1,815.75 BTC moving across four observed waves, but the firm emphasized at the time that the figures came from on-chain analysis rather than confirmed victim reports. The latest update narrows confirmed losses while keeping the larger estimate tied to the still-unverified fourth wave.

Coldcard attack investigation remains active

Galaxy said it has identified what it believes is a fourth coordinated wave of theft but is still waiting for victim confirmation before adding those addresses to its confirmed tally.

According to the research firm, blockchain activity suggests the suspected fourth wave is “substantially comprised of” one attacker, giving analysts medium-high confidence in that assessment despite the remaining uncertainty over affected wallets.

Alex Thorn, Galaxy’s head of firmwide research, first flagged the potential fourth wave on Aug. 3 after identifying transaction patterns that closely matched the earlier attacks. His running estimate later rose to 448.7 BTC moving from 709 potential victim addresses, although Galaxy stressed that blockchain data alone cannot confirm every victim or determine whether a single operator carried out every theft.

The firm added that its investigators continue refining address mapping as additional information becomes available from wallet owners and other participants in the investigation.

Coldcard flaw dates back to 2021 firmware change

The attacks stem from a vulnerability affecting seeds generated on Coldcard Mk3, Mk4, Mk5 and Coldcard Q devices running vulnerable firmware versions.

Coinkite disclosed last week that the flaw originated in March 2021 while integrating a new cryptographic library into its firmware. Instead of generating wallet seeds through the intended hardware-backed true random number generator, affected firmware mistakenly relied on a deterministic pseudo-random generator provided by MicroPython.

According to Coinkite’s technical review, the hardware random-number generator remained active elsewhere in the firmware, allowing internal reviews to confirm its presence without revealing that wallet creation had switched to a different entropy source.

Block’s Bitcoin engineering and security team independently reached the same conclusion after reviewing the firmware. While the company said it had not completed full empirical testing of every affected device, it concluded that the vulnerable firmware called the deterministic MicroPython fallback instead of the STM32 hardware random-number generator during seed creation.

Coinkite estimates that affected Mk2 and Mk3 devices may provide roughly 40 bits of effective entropy, while vulnerable Mk4, Mk5 and Coldcard Q models may generate about 72 bits instead of the intended 128 bits.

Most stolen Bitcoin has not moved

Galaxy said investigators have been working with U.S. federal law enforcement agencies, cryptocurrency exchanges and cyber investigation groups by sharing confirmed attacker and victim addresses as the investigation expands.

The research firm reported that approximately 90% of the stolen Bitcoin remains untouched. It added that none of the coins stolen during the first three confirmed attack waves have moved since they were taken, giving investigators additional time to monitor the funds.

Galaxy also warned that new attackers could attempt to exploit the same vulnerability while affected devices remain in use. For that reason, it said identifying additional attacker-controlled addresses remains important so exchanges and authorities can respond if funds begin moving.

Earlier blockchain analysis showed attack activity accelerating to about 13.8 wallet sweeps per Bitcoin block during the fourth suspected wave, compared with roughly 0.3 sweeps per block before the incident. Galaxy also observed that most stolen balances were transferred to newly created addresses instead of one central collection wallet, while some funds later moved through second-hop transactions that complicated blockchain tracing.

The firm previously noted that users who still control compromised wallets may have a limited opportunity to replace an unconfirmed theft transaction with a higher-fee transaction under Bitcoin’s Replace-by-Fee mechanism, although the option only exists before miners confirm the original transaction and offers no guarantee of recovery.

Coldcard users are still urged to replace wallet seeds

Galaxy said the attacks remain active and advised affected Coldcard users to move their funds to secure addresses and create entirely new wallet seeds on patched devices.

Coinkite has already released emergency firmware updates for every affected product, including version 4.2.0 for Mk2 and Mk3 devices, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for Coldcard Q, and Edge releases 6.6.0X and 6.6.0QX. The company has also destroyed all remaining inventory containing vulnerable firmware.

According to Coinkite, installing updated firmware protects only wallets created after the fix. Existing seed phrases generated with vulnerable firmware remain exposed and should be replaced.

The company recommends generating a completely new seed after updating the device, verifying a receiving address, sending a small test transaction, and transferring the remaining balance only after confirming the test succeeds.

Coinkite also said wallets created using at least 50 fair private dice rolls are not exposed by this random-number-generation issue alone. While a strong BIP-39 passphrase adds another security layer, the company continues to recommend migration because the original vulnerable seed remains weak.