Wells Fargo (WFC) will offer tokenized deposits for select corporate and commercial clients later this year, starting with enabling round-the-clock U.S. dollar-to-British pound transactions on its proprietary blockchain.

The bank frames round-the-clock settlement, programmable payments and parity with its existing deposit protections as future enhancements, saying the system will let clients move, program and settle funds 24/7/365 “when fully deployed.”

The limited initial rollout will expand to more clients, countries and currencies throughout 2027. Its system will automatically route eligible payments through tokenized deposits when doing so improves speed or flexibility, without changing how clients interact with the bank.

Tokenized deposits represent conventional bank balances on a blockchain. Unlike stablecoins, they remain commercial bank money and Wells Fargo says they will carry the same regulatory protections and deposit-insurance eligibility as its existing deposit products.

Future features will include conditional payments using smart contracts, according to the bank.

The platform could also support in-house custodial wallets and connections to other blockchains. Wells Fargo said it can integrate with a shared tokenized-deposit network being developed by The Clearing House, according to the Wall Street Journal.

But the Democratic-led states strongly refute this reasoning, insisting in the lawsuit that “the Administration cannot use forced labor as a pretext to continue its illegal tariff scheme. The tariffs the USTR imposed are so broad that they defy the USTR’s own stated aims and make a mockery of the statute used to justify them.”

California Attorney General Rob Bonta, who co-led the coalition, claimed Trump is “so intent on raising the cost of living for Americans that he is willing to break law after law after law to do so.”

“Tariffs are taxes, and the American people cannot and should not shoulder the extra costs that come from the President’s failed and illegal economic policy—no matter how much the President wants them to,” he added, in a statement announcing he is suing the Trump Administration over its tariffs for a third time.

Joining California in the lawsuit are Arizona, New York, Colorado, Connecticut, Delaware, Kentucky, Hawaii, Illinois, Massachusetts, Michigan, Maryland, Maine, Minnesota, Nevada, New Jersey,  North Carolina, New Mexico, Oregon, Pennsylvania, Rhode Island, Vermont, Virginia Washington, and Wisconsin.

Galaxy Digital’s research chief says new victim reports tied to the Coldcard vulnerability have enabled the identification of additional attackers—highlighting that the incident may be broader than earlier estimates suggested.

According to Galaxy Research, the total losses tied to the Coldcard exploit have increased to about $100 million across three confirmed “attack waves,” with a possible fourth wave that could push the figure closer to $130 million in Bitcoin.

Key takeaways

• Galaxy Digital (Alex Thorn) says at least 15 attackers exploited the Coldcard vulnerability, based on newly received victim reports.
• Estimated losses have risen to roughly $100 million across three confirmed waves, with a suspected fourth wave that could increase totals to about $130 million.
• Dragonfly’s Haseeb Qureshi argues that “$2 of AI hardening” might have prevented the exploit, sparking a debate over AI’s role in vulnerability discovery.
• Tokenomist’s Tatsapat Saerejittima cautions that social media claims about rapid AI discovery were not based on a documented blind test.
• Castle Labs co-founder Francesco points to a potential link between the wallet’s private key setup and the vulnerability’s exploitability.

Victim reports reshape the attacker picture

In a Tuesday X post, Alex Thorn, head of research at Galaxy Digital, said Galaxy had received additional victim reports since the incident—reports that helped the firm label attacker activity that might otherwise have gone unnoticed.

Thorn’s comments emphasize that this was not a typical centralized-exchange-style compromise. Instead, the exploit mechanism differed in a way that made new patterns detectable once victims began reporting details.

He also cited an example: “Due to one single victim’s report of less than 1 BTC stolen, we identified a new attack with 12 BTC siphoned from 126 addresses,” Thorn wrote.

Loss estimates climb as confirmed waves expand

The broader impact is reflected in Galaxy Research’s figures. Loss estimates connected to the Coldcard exploit have grown to about $100 million across three confirmed attack waves.

Galaxy Research has also flagged a suspected fourth wave. If that additional wave is confirmed, the total losses could reach approximately $130 million in Bitcoin.

The incident has reopened ongoing security questions for cold storage users: while “offline” storage is generally considered safer than hot, connected systems, the Coldcard incident underscores that vulnerabilities in wallet firmware or key-generation logic can still be exploited—even when the device is designed to minimize exposure to networks.

AI hardening debate: speed claims vs. testability

As the incident spread, discussion intensified around whether advances in AI could accelerate vulnerability discovery and whether defensive “hardening” could have stopped the exploit. Dragonfly managing partner Haseeb Qureshi argued that roughly “$2 of AI hardening” could have prevented the Coldcard attack.

Qureshi referenced social media reports suggesting that some AI models were able to rediscover the underlying vulnerability quickly—one claim centered on Claude regenerating the issue in eight minutes. Qureshi added that the results may have been influenced by web search.

He also pointed to an example involving the open-source AI model GLM 5.2, stating that it was able to rediscover the attack in 20 minutes with web access turned off.

However, the narrative around rapid AI discovery met pushback from analysts who stress methodological rigor. Tokenomist’s data lead, Tatsapat Saerejittima, told Cointelegraph that it is unlikely AI models would have independently found the vulnerability before it was public.

“The claim that AI found it in 2 mins came from a pseudonymous Reddit user who scanned the code after the vulnerability had already become public. There was no blind test, no documented methodology, and no assessment of the model’s false-positive rate.”

Where private key setup may have mattered

Another technical thread concerns how Coldcard structured private key entropy. Crypto research company Castle Labs’ co-founder, Francesco, told Cointelegraph that while AI can reduce the time and cost of discovering cryptocurrency vulnerabilities, the wallet’s private key may have contributed to the exploitability.

Francesco said Coldcard used a level of private key entropy of 40 bits—lower than what other wallets typically adopt. He compared this to a standard approach where a 12-word seed corresponds to 128 bits of entropy. He attributed the difference to a firmware bug, suggesting the conditions for exploitation may have been more favorable than they would be under typical key-entropy assumptions.

Francesco also indicated that, as AI models become more capable and more integrated into both cybersecurity and offensive tooling, the broader cost of bug discovery is likely to keep dropping.

What investors and users should watch next

With Galaxy Research pointing to a possible fourth attack wave and analysts debating how quickly vulnerabilities can be rediscovered and mitigated, attention should shift toward whether additional victims corroborate the suspected wave and how cold-wallet vendors respond—particularly around firmware-level assumptions in key generation and any hardening measures that could reduce the chance of repeat exploitation.

Bitcoin has traded between $60,000 and $67,000 for several weeks, making $63,000 one of the most heavily supplied price areas. The only larger concentration sits between $78,000 and $82,000, where bitcoin topped out in May.

Glassnode’s Entity-Adjusted UTXO Realized Price Distribution (URPD) shows how much bitcoin supply last moved within each price band, with each entity’s balance assigned to its average acquisition price. More than 3% of the supply, approximately 515,000 BTC, is concentrated around $63,000, while more than 2%, or roughly 362,000 BTC, sits around $61,000.

Bitcoin is also trading almost exactly in line with its 200-week moving average, which tracks the asset’s average weekly price over the past 200 weeks. The indicator currently stands at $63,657, compared with bitcoin’s price of $63,822, highlighting significant accumulation in this range.

Glassnode’s 30-day Accumulation Trend Score, broken down by wallet-size cohort, shows that retail investors are currently the most aggressive buyers at these prices. Every other cohort is also accumulating, including whales holding at least 1,000 BTC, which are showing similarly strong accumulation.

A wallet holding about $36 million worth of BTC stolen from Coldcard devices has taken in 23 deposits since the theft while becoming a collection box for an assortment of heartfelt and bizarre notes.

Indeed, 14 of these deposits carried written messages, including one that asked the thief for five BTC to spend on cocaine and prostitutes.

Coinkite, the Toronto company behind Coldcard, disclosed a catastrophic bug in its hardware wallets last week. For over five years, its firmware had been generating seed phrases with roughly 40 bits of entropy instead of its intended 128.

Hackers subsequently set about using computational brute-force to crack customers’ private keys and sweep their BTC.

On-chain thefts now top $100 million, via 1,596 BTC stolen from ~7300 addresses, according to Galaxy Research, graffiti has moved in to communicate with the anonymous adversary.

Meanwhile, 23 depositors have delivered 81,527 satoshis worth about $52 after mining fees, to the hacker. Their senders paid another 9,706 satoshis, roughly $6, in fees.

In April, the MLS serving greater Chicagoland worked with the nation’s largest brokerage to expand its private listing network while restricting public visibility of many home listings. A federal court recently issued a temporary restraining order to ensure the Chicago MLS continues to provide fair access. 

Chicago should be a warning sign to the rest of the country. If this model spreads, public access to home listings could become a fallback rather than the default. We risk breeding the kind of widespread inequity that harkens back to redlining.

Redlining denied generations of Black families’ equal access to mortgages, investment, and the opportunity to build wealth. During the 1930s, federal programs used maps to gauge and rate neighborhoods for lending risk. Minority neighborhoods were often unjustly marked in red ink as “hazardous,” denying them mortgages and investments. Although outlawed by the Fair Housing Act of 1968, its legacy remains visible today in racial wealth gaps, segregation, and unequal opportunity. Now, a modern form of digital redlining threatens to emerge. This is more than an industry dispute. This is a civil rights issue.