A new U.S. survey has found that 79% of prediction-market users lost money during the past year, while 51% used borrowed funds to place bets.

Prediction market losses rise among borrowers

BadCredit.org surveyed 1,000 U.S. adults and found that 15% had used a platform such as Kalshi, Polymarket, or PredictIt, placing the consumer findings against a period of rapid trading growth and continued regulatory debate.

Among self-reported users, 79% said they had lost money on prediction markets in the past year. More than one-quarter, or 27%, reported losses above $500, including 9% who lost over $1,000. Only 21% said they had not lost money during the period.

Losses were more common among people who financed their positions with debt. According to the study, 51% of users had funded bets through a credit card, personal loan, or another form of borrowing. Of that group, 88% reported losing money, compared with 69% of users who did not borrow.

Consumer finance expert Erica Sandberg warned that debt adds repayment costs to an already uncertain outcome. Borrowers may owe interest after losing the original amount, increasing the total cost beyond the value placed on the contract.

“Although tempting, borrowing money to place a bet is a universally bad idea,” Sandberg said.

Credit cards and personal loans are meant to finance purchases that borrowers can repay, she added, rather than speculative contracts whose value depends on the result of a future event. Sandberg advised participants to use only cash they can afford to lose without affecting bills or creating debt.

The study measured whether respondents experienced losses during the previous year, but it did not publish platform-level account records or calculate net returns from verified transaction histories. Its results therefore represent participants’ own reports rather than audited trading data.

Income needs are drawing users to prediction markets

Financial motives ranked above entertainment when respondents explained why they began using prediction markets. The survey found that 44% wanted to earn extra income, while another 9% were struggling financially and needed an additional source of money.

Combined, 53% entered for an income-related reason. Entertainment or curiosity attracted 27%, social-media content influenced 10%, and recommendations from friends or relatives brought in 7%. Another 3% said conventional investing felt inaccessible.

Across all surveyed adults, 30% believed prediction markets could realistically improve their financial situation. Men expressed that belief more often than women, at 37% versus 25%.

Usage also showed a gender difference. According to the survey, 24% of men had tried a prediction-market platform, compared with 9% of women. BadCredit.org did not provide account-level data to determine whether bet sizes, contract choices, or returns differed by gender.

The income findings come as prediction markets offer contracts tied to elections, economic releases, cryptocurrency prices, sports, and other events. Participants generally buy contracts priced between $0 and $1, with the value moving according to the market’s estimated probability before settlement.

Separate transaction research has also found that profits can be concentrated among a small number of accounts. In April, crypto.news covered an academic study of 1.72 million Polymarket accounts and about $13.76 billion in volume from 2023 through 2025.

Researchers from London Business School and Yale classified 3.14% of the accounts as skilled winners. Skilled traders and market makers, who together represented less than 3.5% of accounts, captured more than 30% of gains, while 67% of accounts categorized as unlucky or unskilled losers absorbed the platform’s total losses.

Prediction market volume has reached record levels

Consumer losses have drawn attention during a sharp rise in platform activity. Kalshi, Polymarket, and Polymarket US generated a combined $50.59 billion in July trading volume, according to recent market data published on Aug. 3.

The monthly total increased 7.8% from a revised $46.95 billion in June. Kalshi accounted for $37.7 billion, or about 74.5% of the combined figure, while Polymarket US grew 54% to $5 billion.

Polymarket’s international venue recorded $7.9 billion, down 26% from June. Combined activity across its U.S. and international operations reached $12.9 billion.

The figures represent taker notional volume, not customer deposits, platform revenue, or trader losses. Because one contract can change hands several times before settlement, the same capital may contribute to volume repeatedly.

World Cup contracts supplied a large share of summer activity. Chainalysis estimated that about 400,000 wallets generated $5.7 billion during the five-week tournament and that World Cup markets accounted for roughly 63% of prediction-market activity over that period.

Open interest across Kalshi and the two Polymarket venues fell from around $2 billion near the start of July to about $1.2 billion by month-end as tournament positions closed or settled. The decline occurred even as monthly turnover reached a record.

US regulators are examining customer protection

Prediction markets in the United States sit between federal derivatives oversight and state gambling rules. Kalshi operates as a Commodity Futures Trading Commission-designated contract market, while QCX, which operates Polymarket US, also appears on the CFTC’s list of designated markets.

Federal registration has not ended disputes over sports contracts. Several states maintain that products tied to games resemble conventional wagers and require local gambling licenses, while the platforms argue that the Commodity Exchange Act places their event contracts under federal supervision.

In July, the U.S. House Agriculture Committee scheduled a hearing focused on customer protection and market integrity as gaming groups pressed Congress to restrict sports-based contracts. As reported at the time, representatives of the American Gaming Association and Indian Gaming Association argued that some prediction products perform the same economic function as sports bets.

CFTC officials have also told regulated platforms to avoid presenting contracts through American-style gambling odds, which use formats such as +150 or -200. The agency reminded operators that event contracts remain subject to derivatives laws and that marketing, listings, and solicitations cannot use deceptive practices.

State litigation continues alongside federal scrutiny. Courts in different jurisdictions have reached conflicting early decisions on whether commodities law prevents states from applying gambling rules, leaving access and product availability dependent partly on where a user lives.

BadCredit.org conducted its survey through an online panel and used raw, unweighted responses. Questions about borrowing, losses, and motivations went only to respondents who said they had used a prediction market. The organization calculated a margin of error of about ±3.1 percentage points for the full sample and approximately ±8 percentage points for findings drawn from the user subgroup.

How effective are body cameras in law enforcement?

BitMart’s missing proof-of-reserves report and withdrawal complaints from two crypto projects have raised fresh questions about how customer assets are held during the exchange’s wind-down.

BitMart concerns expose verification problem

Arch Lending co-founder and CTO Himanshu Sahay said questions about withdrawals and exchange closures expose the difference between assurances offered by a platform and financial information that customers can independently check.

“Whenever questions arise around withdrawal processing or exchange wind-downs, it points to a structural gap across digital asset markets: the difference between platform-level statements and independent verification,” Sahay said in a statement to crypto.news.

Customers often have no real-time method for establishing whether an exchange holds their assets in segregated accounts or combines them with funds used for other operations, according to the executive. Uncertainty increases when withdrawals slow because customers must rely on the same company processing their requests for information about its financial condition.

Sahay said the crypto industry already has tools that can reduce such uncertainty, including third-party custodians, reserve attestations, and strict asset segregation. Their value depends on whether customers can use them to verify solvency claims before operational problems emerge.

“This isn’t a new issue, but a recurring one that resurfaces whenever a platform faces operational stress.”

BitMart stated in May that it was preparing a proof-of-reserves report after earlier complaints about account restrictions and withdrawal access. The exchange said it would release the report once security and risk-control matters had been addressed, but it did not provide a date.

No comprehensive report had been published as of Aug. 12. BitMart has also not released independently verified data covering both its assets and liabilities, leaving outside parties unable to establish whether the exchange holds enough liquid assets to meet all customer obligations.

Withdrawal complaints add pressure on BitMart

OpenGradient co-founder Matthew Wang alleged on Aug. 10 that his project’s market-making team could not withdraw balances held on BitMart. Wang accused the exchange of insolvency and questioned why it had encouraged token holders to lock assets shortly before announcing its closure.

“Our MM has our balances stuck on BitMart exchange that we can’t get out,” Wang said.

Wang did not disclose the amount or composition of the assets held by the market maker. His insolvency accusation has not been independently verified, and no confirmed evidence currently establishes that BitMart’s liabilities exceed its available assets.

Scandic Coin separately said that withdrawal requests covering approximately 21,898 USDT, 926,635 SNC, and another 256 USDT remained unprocessed after being submitted on July 26. The project stopped short of declaring BitMart insolvent and instead asked the exchange for verifiable evidence that it had enough liquidity to complete customer withdrawals.

The complaints were detailed in an Aug. 10 report on frozen withdrawals, which found that BitMart had not directly answered OpenGradient’s allegation at the time of publication.

BitMart maintains that withdrawals remain available. Under its procedures, requests may face checks involving customer identity, login devices, IP addresses, transaction history, destination wallets, and the source of funds.

Sanctions screening, Travel Rule requirements, and network conditions may also affect processing times, according to the company. BitMart warns that submitting a request does not mean the review has finished or that the transaction has been broadcast to a blockchain.

For customers, the absence of a transaction hash means there is no on-chain evidence showing that their assets have left the exchange. BitMart tells users to follow the status through their account history and avoid filing duplicate requests or support tickets.

Asset segregation must precede a crisis

Sahay said regulated third-party custody can reduce dependence on statements from an exchange because customer collateral remains separate from the company’s operating balance sheet.

“Maintaining collateral with qualified, regulated custodians completely separate from operating balance sheets is what ensures customers never have to rely on trust alone.”

According to Sahay, companies cannot obtain the full benefit of asset segregation by adopting it after withdrawals stall or concerns about liquidity have already surfaced. Custody arrangements need to be built into the platform’s structure from the beginning, with evidence showing where assets reside and how they are protected.

Proof of reserves can provide a snapshot of assets controlled by a platform, but such a report does not establish solvency by itself. A complete assessment also requires information about liabilities owed to customers, lenders, market makers, and other counterparties.

Reserve reports can present other limitations because they usually cover a specific point in time and may exclude certain assets or obligations. Customers also need a way to confirm that their individual balances were included in the review, while auditors must establish that the company controls the disclosed wallets.

Comparable concerns have surfaced at other centralized exchanges. In June, on-chain investigator ZachXBT said AscendEX users had reported withdrawals pending for days or weeks and questioned whether publicly identified hot wallets contained enough large-cap assets.

The resulting AscendEX liquidity concerns could not be confirmed from labeled addresses alone because an exchange may hold funds in undisclosed cold wallets or with external custodians. The episode still showed how limited wallet visibility can prevent customers from evaluating an exchange during withdrawal pressure.

Sahay expects independently verifiable third-party custody to become a basic requirement as institutional and retail participation develops. Platforms that can show where customer assets are held and how they are separated from operating funds will be able to answer such questions with evidence rather than internal assurances, he said.

BitMart will end trading on Aug. 26

BitMart began winding down its global trading platform on July 26, citing its operating conditions, the market environment, and its future strategy. The exchange stopped accepting new registrations and began suspending cryptocurrency and fiat deposits from 01:30 UTC.

Spot markets stopped taking new orders, while futures accounts entered reduce-only mode. BitMart also began discontinuing copy trading, grid trading, API trading, and other automated services.

BMX, the exchange’s platform token, fell approximately 63% during the first 24 hours following the announcement, according to the earlier BitMart shutdown report. CoinGecko data cited at the time placed BMX near $0.164 with around $6.1 million in daily trading volume.

All spot, futures, and other trading services are scheduled to end at 01:00 UTC on Aug. 26. BitMart may settle any futures positions left open at the cutoff using the relevant mark price, index price, or settlement rules.

Customers have been asked to close trading positions, cancel pending orders, and redeem eligible balances held in Earn, staking, lending, and other products. The company recommends submitting withdrawal requests before 05:00 UTC on Aug. 26.

Requests submitted after that time will enter a separate processing procedure. BitMart said affected customers would receive instructions about additional documents and withdrawal steps through official announcements or direct account notifications.

Founder Sheldon Xia denied on Aug. 8 that BitMart had disappeared, planned to avoid its obligations, or misappropriated customer assets. Xia said the core team was conducting an asset inventory, consolidating funds, and maintaining the systems required for the closure.

The founder also said BitMart was considering court involvement and third-party auditors as part of a transparent review. He did not provide a publication date or explain whether the proposed report would cover customer liabilities alongside reserve assets.

BitMart plans to cease trading-platform operations at 15:59 UTC on Jan. 31, 2027. The exchange said customers would retain account access for a specified period afterward to review historical records and submit withdrawals under the procedures then in effect.

For U.S. residents, BitMart stopped accepting new registrations in May 2022, although the company said some older accounts could remain linked to American users. A July 23 notice instructed affected customers to close positions, cancel orders, redeem balances from earning products, and withdraw their assets by 23:59 UTC on Aug. 8.

BitMart said U.S.-linked accounts could face additional restrictions after the deadline, while pending withdrawals may require identity records, proof of address, source-of-funds documents, or evidence that the customer controls the receiving wallet.

Bitcoin traded softer around the Wall Street open on Wednesday as traders digested fresh US inflation data and reassessed how restrictive the Federal Reserve is likely to remain. Despite July CPI coming in line with expectations, BTC/USD slipped below $63,500, erasing earlier gains and bringing renewed attention to the $63,000 area.

Market focus is now shifting to Thursday’s Producer Price Index (PPI), with investors looking for clues on whether inflation momentum is truly cooling or merely pausing—especially after recent labor-market signals have already complicated the rate path debate.

Key takeaways

• BTC/USD slid back below $63,500 after July CPI matched expectations, showing inflation “in line” did not automatically translate into bullish momentum.
• CME Group’s FedWatch Tool indicates a higher probability that the Fed holds rates at the current 3.50%–3.75% range for September compared with a month ago.
• Traders are warning that the $63,000 support zone may be weakening as bounces lose strength, increasing the risk of a cleaner breakdown.
• Options pricing suggests traders are still paying for downside protection, and PPI is set to be the next catalyst for that view.
• Overhead resistance around $65,000–$65,500 remains a recurring barrier, with recent price action failing to produce sustained daily closes above it.

Inflation matched expectations—yet Bitcoin weakened

TradingView data showed BTC/USD moving down below $63,500 after initially holding gains. The broader market reaction was relatively muted in equities, because the July CPI report landed essentially where economists expected.

According to a Bureau of Labor Statistics (BLS) release, CPI increased 0.1% month-on-month and 3.4% year-on-year. The report also highlighted that the “shelter” component rose 0.1% in July and represented about two-thirds of the month’s all-items increase. Food prices edged up 0.1% overall, while the energy index declined 1.5% for the month.

While CPI did not repeat June’s downside surprise, the lack of a supportive reaction matters to crypto traders because it suggests the market is no longer searching for “good news” so much as it is looking for confirmation that the Fed is done tightening—or at least done tightening soon. In other words, a headline number that is merely “in line” may not be enough to shift risk appetite if traders remain focused on policy risk.

Rate expectations cooled, but traders are waiting for the next data point

Fabian Dori, CIO at Sygnum Bank, argued in emailed comments that CPI’s cooling effect—combined with weaker labor-market figures—could strengthen the case for the Fed to avoid additional rate hikes. He suggested this would be supportive for liquidity conditions that tend to benefit crypto and other risk assets.

Dori framed the near-term takeaway as a gradual cooling narrative without forcing markets into a recession scare or an abrupt “hawkish re-pricing.” He also pointed out that September rate odds should stay relatively stable if the macro mix does not deteriorate.

Consistent with that view, CME Group’s FedWatch Tool showed about 60% odds that the Fed would hold rates at its current 3.50%–3.75% range at the September meeting—up from 30% a month earlier. Investors typically watch this kind of shifting probability because it influences discount rates and risk appetite across assets, including crypto.

Still, traders are not fully comfortable treating CPI as a decisive turning point. Andrei Grachev, managing partner at DWF Labs, told Cointelegraph that an in-line CPI print doesn’t “resolve much” after the previous jobs report missed expectations. He also emphasized the state of the derivatives market: he said the Bitcoin options market was continuing to price a meaningful premium for downside protection into the end-August expiry.

Grachev added that Thursday’s PPI report would be the next check on whether that premium begins to fade—an important signal for whether traders see risk as moving toward normalization or remaining skewed to the downside.

Support at $63,000 under pressure as bounces weaken

Beyond macro, technical traders are focused on how price is behaving around the same key levels. Rekt Capital warned on X that each bounce from approximately $63,000 has been losing momentum, with the strength of the support appearing to progressively fade.

His commentary included a sequence indicating that the “support” effects on rebounds had diminished over time—culminating in what he described as support that had thinned to roughly 1.15% “thus far.” He cautioned that once rebounds become too weak, the market may stop defending the floor.

“At some point the bounces will become so weak that the floor will simply break.”

Rekt Capital also referenced earlier analysis that Bitcoin bear-market history may be repeating as the 50-month exponential moving average (EMA), currently around $65,827, acts as resistance rather than support.

That resistance picture is echoed by Bitfinex Alpha, the research arm of exchange Bitfinex. In an update published Wednesday, it said equities set all-time highs over the prior two weeks while Bitcoin continued to struggle with a consistent barrier in the $65,000–$65,500 zone. The research noted that from early August through that period, the market printed daily highs above $65,000 multiple times, but failed to record a daily close above that level since late July.

What to watch next: PPI and whether protection costs ease

With CPI already “in line,” the market’s next move is likely to depend less on whether inflation prints look merely acceptable and more on whether they confirm a sustained trend—something PPI could clarify. For traders, the key questions are whether Bitcoin can stabilize above $63,000 or whether weakening bounces turn into a more decisive break, and whether options pricing starts to show reduced demand for downside protection as expectations evolve.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

Kalshi has opened its live order book to DoubleZero Edge subscribers, providing Level 1 and Level 2 data for sports contracts and crypto perpetual futures through a dedicated fiber network.

Kalshi feed provides full order book depth

DoubleZero Foundation and Kalshi said in an Aug. 12 announcement that the exchange’s live order book is now available through DoubleZero Edge, starting with its most actively traded sports and crypto perpetual futures contracts.

Under the rollout, subscribers can receive Top of Book and Trades information, known as Level 1 data, alongside Depth of Book information, or Level 2 data. Level 1 shows the best available bid and ask prices as well as completed trades, while Level 2 displays orders across several price levels.

Full book depth can give quantitative firms and market makers a more detailed view of liquidity than a basic price feed. According to the companies, subscribers receive the information in a sequenced, machine-readable format that can be integrated into automated pricing, hedging and trading systems.

Before the new feed, DoubleZero said firms often had to gather individual responses from Kalshi’s application programming interfaces and rebuild the order book on their own servers. Edge packages the data into a subscription product, removing part of that internal processing work.

The launch covers every Kalshi sports event and crypto perpetual futures market included in the initial categories, according to the release. Kalshi Research supplies the published information, while DoubleZero handles its delivery to connected subscribers.

Neither company disclosed the subscription price, number of initial customers or measured latency for the Kalshi feed. DoubleZero described the connection as low-latency but did not release independent tests comparing its performance with direct API access or other market-data services.

Historical data is also absent from the first version. DoubleZero said it intends to offer historical Kalshi information in a future release, although the company provided no schedule or pricing details.

DoubleZero applies its fiber network to prediction markets

Rather than sending each subscriber a separate copy of the feed, DoubleZero Edge uses multicast distribution. Under that model, a data publisher sends the information once before the network delivers it simultaneously to connected users.

DoubleZero said its system carries exchange and blockchain data over dedicated fiber instead of relying only on the public internet. Traditional exchanges, including the New York Stock Exchange, Nasdaq and CME, have used similar distribution models to supply trading firms with real-time information.

Austin Federa, co-founder of DoubleZero, said established financial firms have spent years building private networks that move data quickly and consistently. Crypto markets, perpetual futures venues and prediction platforms, he added, developed without the same shared infrastructure.

“Traditional finance got this concept exactly right: data access is a critical part of market structure,” Federa said.

The Kalshi rollout extends a service that first focused on blockchain data. In April, crypto.news reported that DoubleZero had launched its Edge public beta with 379 Solana validators publishing transaction data through the network.

At launch, those validators represented about 43% of Solana’s staked supply. The April service sent raw Solana packets over private fiber and recorded an average delivery improvement of six milliseconds compared with conventional routing, according to DoubleZero data cited in the earlier report.

Subscription prices for the Solana beta ranged from $30 to $100 in USDC per device and per epoch, depending on location. DoubleZero has not said whether the same pricing structure applies to the Kalshi product.

Andy Ross, Kalshi’s head of institutional, said firms using the exchange increasingly overlap with participants in traditional markets. Making the order book available through Edge, Ross said, gives those companies another data connection for markets traded on Kalshi.

Kalshi waives its data revenue share for one year

As part of the commercial arrangement, Kalshi will not collect its normal share of Edge subscription revenue during the feed’s first year.

DoubleZero said data publishers usually receive a percentage of subscription fees after the protocol burn. With Kalshi waiving that share, the initial price will be based on network delivery rather than an added data-licensing charge from the exchange.

The waiver does not provide free access. Trading firms must subscribe to DoubleZero Edge and meet its connection requirements before receiving the feed, while the companies have not disclosed the network fee charged for this specific product.

Once the first year expires, Kalshi could begin receiving part of the subscription revenue under DoubleZero’s standard publisher model. The announcement did not disclose the prospective percentage or confirm whether customer prices will change when the waiver ends.

Demand for a more structured feed comes after trading activity across prediction markets climbed during the summer. Data covered on Aug. 3 showed that combined July prediction-market volume reached $50.59 billion, up 7.8% from the revised June total of $46.95 billion.

Kalshi accounted for $37.7 billion, or about 74.5%, of the combined July figure for Kalshi, Polymarket and Polymarket US. The data measured taker notional volume, meaning the total did not represent exchange revenue or new customer deposits.

U.S. traders gain another route to regulated crypto data

Kalshi’s crypto feed includes contracts introduced during its expansion from event markets into regulated perpetual futures. In June, the exchange launched Bitcoin perpetual futures after receiving approval from the Commodity Futures Trading Commission.

The BTCPERP contract follows Bitcoin’s spot price and remains open without a fixed expiration date. According to the CFTC’s May 29 order, Kalshi must list and maintain the product under the Commodity Exchange Act and the rules that apply to designated contract markets.

Kalshi later added other crypto-linked perpetual contracts. The products gave eligible U.S. traders domestic access to derivatives that had largely been offered by offshore exchanges, while their order book data can now be delivered through the DoubleZero connection.

Kalshi has held CFTC designated contract market status since November 2020. In January 2025, the regulator modified its designation to permit intermediated futures trading, according to the CFTC’s registry.

Federal registration has not settled every legal question surrounding the sports markets included in the new feed. Several states argue that Kalshi’s sports event contracts fall under local gambling laws, while Kalshi maintains that the CFTC has exclusive authority over contracts traded on its federally regulated exchange.

A Washington court blocked Kalshi from offering sports contracts to residents in July after rejecting the company’s federal preemption argument. A Michigan judge had also temporarily restricted the exchange’s sports contracts in June over allegations that Kalshi operated without licenses required under state gambling law.

The Coldcard seed-generation failure has exposed about $116 million in Bitcoin to theft while renewing questions about how users verify the security of self-custody tools, according to TEXITcoin founder Bobby Gray.

Bobby Gray, founder of TEXITcoin, told crypto.news that Coldcard users suffered losses because they trusted the hardware wallet to generate secure seed phrases without independently checking the source of randomness.

“Coldcard sat on a broken seed generator for five years, and it still cost people $116 million,” Gray said.

“Some of these wallets were generating seeds with as little as 40 bits of entropy instead of the 128 they promised.”

Gray said the lower entropy turned recovery phrases designed to resist brute-force attacks into targets that determined attackers could search without gaining physical access to the devices.

Coldcard seed flaw weakened wallet security

Coldcard is a Bitcoin-only hardware wallet made by Canadian hardware manufacturer Coinkite. Hardware wallets keep private keys away from internet-connected computers and sign transactions within the device, reducing exposure to malware and online attacks.

Coldcard’s reported failure occurred before the private keys entered secure storage. According to a Coinkite security advisory, a firmware integration error caused affected devices to use a predictable software random-number generator instead of the intended hardware source while creating wallet seeds.

Firmware versions 4.0.1 through 4.1.9 on Coldcard Mk2 and Mk3 devices were affected. The first vulnerable release arrived in March 2021, leaving the error active for more than five years before Coinkite disclosed it on July 30.

Coinkite estimated that seeds created on affected Mk2 and Mk3 devices contained about 40 bits of effective entropy. Vulnerable Mk4, Mk5, and Q devices generated about 72 bits rather than the expected 128 bits, according to the advisory.

A correctly generated 128-bit seed provides an extremely large set of possible combinations. Reducing the effective randomness to 40 bits leaves about one trillion possibilities, a range that specialized computing systems can search when attackers have enough information about the wallet’s seed-generation process.

TRM Labs said the attackers could reconstruct affected private keys without opening, stealing, or modifying the hardware wallets. The blockchain intelligence firm attributed the error to a build configuration introduced with firmware version 4.0.1.

On-chain estimates cited by TRM Labs placed the preliminary loss at about 1,816 BTC, worth approximately $116 million, across more than 5,200 addresses. Four suspected waves began on July 30, though TRM warned that the total could change as investigators confirm victim reports and trace additional addresses.

Gray says self-custody itself did not fail

In an Aug. 6 analysis, Gray described the incident as a failure in the process used to create private keys rather than a compromise of Bitcoin or the physical security components inside Coldcard devices.

No attacker needed to steal a device, obtain its PIN, or install malicious firmware, according to Gray. Once attackers reconstructed a vulnerable seed, they could derive its associated private keys and sign transactions from another system.

“The people who bothered adding their own dice rolls for extra entropy walked away untouched, while the people who just trusted the device to handle it got wiped out,” Gray said.

Coinkite’s advisory supports the distinction involving independent randomness. Users who entered at least 50 fair, private, and independent dice rolls while creating their seed are not considered at risk from the random-number-generator flaw alone. Between 50 and 98 rolls added at least 128 bits of entropy, while 99 or more added about 256 bits, the company said.

Fewer than 50 rolls do not meet Coinkite’s stated exception. Users who cannot remember how many rolls they entered, whether the process was private, or which final seed words they retained were advised to migrate their funds.

Gray argued that the incident should not be treated as evidence that centralized custody is safer in every case. In his view, self-custody requires users to verify how their keys are created instead of relying only on the product’s listed security features.

“Blind trust is what failed here, and self-custody is taking the blame it doesn’t deserve. If you haven’t independently verified your entropy, you don’t actually know what you’re holding, no matter how many security features are stacked around it.”

His TEXITcoin post also separated the event from phishing, malicious firmware, and supply-chain attacks. Gray classified the firmware problem as a severe mistake by a wallet maker rather than evidence that Coinkite designed the product to steal customer funds.

Coldcard losses have changed custody decisions

User behavior has moved in a different direction from Gray’s recommendation. OKX reported record deposits after the incident, as some Bitcoin holders transferred assets from personal wallets to centralized platforms.

As previously reported by crypto.news, OKX Chief Compliance Officer Jonathan Brockmeier said the inflows represented the opposite of the behavior seen after FTX collapsed, when users withdrew assets from exchanges and moved them into self-custody.

Gray rejected the idea that leaving Bitcoin on an exchange resolves the problem. Centralized services control customer keys and can freeze withdrawals, suffer security breaches, or fail financially, he said.

“Running back to an exchange because a device let you down isn’t a solution either, since that’s just handing your risk, and your keys, to someone else to lose instead,” Gray said.

Blockchain investigators have not attributed the theft to one identified group. TRM said differences in transaction construction across the suspected waves could indicate several attackers, while most stolen Bitcoin had initially remained in consolidation addresses.

The firm detected limited laundering activity, including a 64.9 BTC deposit to Wasabi and 200 ETH sent through Tornado Cash on Aug. 4. TRM said the transaction pattern differed from the fast laundering methods often associated with organized state-backed hacking groups.

US investors face a different custody trade-off

For American investors who only want exposure to Bitcoin’s price, U.S.-listed spot Bitcoin exchange-traded funds remove the need to generate seeds, update wallet firmware, or maintain physical backups.

Bloomberg Intelligence analyst Eric Balchunas said the Coldcard losses strengthened the case for regulated spot Bitcoin ETFs. A report on ETF custody noted that products such as BlackRock’s iShares Bitcoin Trust ETF rely on institutional custodians rather than requiring shareholders to control private keys.

BlackRock’s SEC filing identifies Coinbase Custody as the main custodian for IBIT’s Bitcoin and names Anchorage Digital Bank as another custodian the trust may use. Shareholders own exchange-traded securities, however, and cannot withdraw the underlying Bitcoin to a personal wallet or use it for payments.

Institutional custody also transfers risk instead of removing it. IBIT’s filing lists hacking, employee misconduct, technical failures, and unauthorized transfers among possible sources of loss. The filing also says insurance shared by Coinbase may not cover every potential incident.

Coldcard users must replace vulnerable seeds

Coinkite has released fixed firmware for every affected model, including version 4.2.0 for Mk2 and Mk3 devices, version 5.6.0 for standard Mk4 and Mk5 devices, and version 1.5.0Q for the standard Coldcard Q.

Installing an update only corrects the generation of future seeds. Coinkite said firmware cannot add randomness to an existing recovery phrase because the weakness remains attached to the seed even if a user imports it into another wallet.

Affected users were instructed to install the correct firmware, generate a completely new seed, verify its fingerprint and receiving address, and send a small test transaction before moving the remaining balance. Coinkite advised users to retain the old backup until the transfer reaches the replacement wallet and receives network confirmation.