Coldcard’s five-year seed-generation issue has turned into a wider debate over how hardware wallets are independently verified, according to Kraken’s chief security officer Nick Percoco. In an X post on Sunday, Percoco said the incident should prompt makers of self-custody devices to require end-to-end checks that confirm the randomness source reviewed in testing is the same one actually executed by production firmware.

The comments arrive amid an ongoing exploit believed to target vulnerable Coldcard devices by abusing weak seed phrases. By Sunday, more than 4,500 addresses had reportedly been affected, with losses estimated at nearly $90 million in Bitcoin, according to Cointelegraph’s reporting linked in the original article.

Key takeaways

• Kraken’s Nick Percoco argues hardware wallet certification should include verification that the approved entropy path is what production firmware uses in practice.
• Coldcard’s RNG-related flaw allegedly persisted for years after a seed-generation change introduced an unintended reliance on a weaker generator.
• Percoco cited existing standards used in the broader security and payments industries—such as NIST SP 800-90B and BSI AIS-31—as models for what should be standard for crypto self-custody.
• Coinkite says affected firmware has been halted in shipments and that remaining units containing the vulnerable code were destroyed, while it advised users not to discard certain devices.

A hardware wallet “wake-up call” for entropy verification

Percoco’s central point is about trust boundaries. Hardware wallet users are asked to rely on a manufacturer’s implementation of the randomness function that ultimately underpins seed phrase generation—yet, he said, there is often no independent method to confirm that the verified randomness source is the one the device will actually call in production.

“Consumers are asked to trust a manufacturer’s implementation of the single most critical function in the system, with no independent verification that the approved entropy path is the one actually executing,” Percoco wrote in his Sunday post.

He described this gap as an industry-wide weakness rather than a one-off mistake, noting that while some certifications exist for hardware components and secure elements, they do not “systematically force end-to-end verification” of the entropy source through to production code execution.

Percoco contrasted the crypto self-custody space with practices in other sectors. He pointed to the payments industry’s use of independent lab testing for devices that collect sensitive inputs, and to government expectations in the US around cryptographic module validation and entropy source testing.

How the Coldcard flaw allegedly slipped through

According to the original reporting, the vulnerability traces back to a software change disclosed by Coinkite. The company said the relevant issue has existed since March 2021, when Coldcard altered its seed-generation process as it integrated a new cryptographic library.

The update, per Coinkite’s postmortem referenced in the article, unintentionally routed wallet creation to a weaker MicroPython generator already present in the codebase. Coinkite’s explanation indicated that Coldcard’s intended true random number generator (TRNG) code existed and could be present and functioning, but was not reliably the one used for the core randomness needed for seeds.

In other words, reviewers could verify that the TRNG code was present and worked—but, without a mechanism to ensure the device actually called that TRNG during seed generation, the system could still produce outcomes derived from a different generator than intended.

The practical consequence is that seed phrases generated under the affected conditions may become more predictable than they should be. That predictive weakness is widely viewed by the security community as especially dangerous in wallet designs because compromised seeds can enable theft without needing to break keys directly.

Attack fallout and what’s changing for users

The ongoing exploit believed to target weak seed phrases generated by affected Coldcard devices has already resulted in extensive on-chain activity. As of Sunday, Cointelegraph’s figures cited in the original article reported over 4,500 impacted addresses and losses approaching $90 million in Bitcoin.

Coldcard (Coinkite) said it has halted all device shipments since confirming the vulnerability on Thursday. It also stated it destroyed remaining units at its facilities that contained the affected firmware.

At the same time, the company advised users with affected devices not to dispose of them immediately, saying doing so might become “essential if funds are recovered.” The company also indicated its legal team would coordinate with law enforcement across multiple jurisdictions to support efforts identifying those responsible.

For affected owners, the new information underscores a key operational point: device handling decisions may need to be aligned with recovery processes rather than treated as purely disposal or cleanup tasks. While that doesn’t eliminate the security risk of continuing exposure, it suggests an active incident-response posture where retaining evidence or workable hardware could matter.

Standards exist—what’s missing is enforcement

Percoco’s critique points to a tension that many investors and builders may recognize: crypto security often emphasizes reviewing code paths and cryptographic primitives, but not always the end-to-end behavior under production conditions—especially the specific entropy source used at runtime.

He referenced NIST SP 800-90B, which sets requirements for designing, testing and validating physical true random number generators for cryptographic security, and BSI AIS-31, a similar standard from Germany’s Federal Office for Information Security. In his view, such frameworks make it more difficult for systems to “pass review” without proving that the approved randomness pathway is actually used for critical operations.

Whether regulators and certifiers will adapt those expectations to consumer self-custody products remains uncertain. However, the Coldcard case demonstrates why the distinction matters: even when a correct TRNG implementation exists in the codebase, the seed-generation workflow can still be compromised if production firmware routes randomness differently than what independent review assumes.

Next, investors and users should watch for two things: clarification from Coinkite on exactly how to identify which devices/firmware are affected and what remediation steps best reduce future risk, and whether independent testers or certifiers move toward stronger “entropy source at runtime” validation—an area Percoco argues should not remain optional in digital asset custody.

South Korea saw 560.3 billion won ($367 million) in stablecoin outflows to overseas exchanges in June, extending the country’s streak of monthly net stablecoin outflows to 18 consecutive months. 

The figure comes from Financial Supervisory Service (FSS) data obtained by Yonhap News Agency through People Power Party lawmaker Lee Jong-wook. South Korea’s five major crypto exchanges — Upbit, Bithumb, Coinone, Korbit and Gopax — transferred 2.7 trillion won ($1.81 billion) in stablecoins offshore in June and received 2.2 trillion won ($1.44 billion) from foreign platforms.

Market participants cited by Yonhap attributed the transfers to demand for products restricted or unavailable on domestic exchanges, such as overseas derivatives, tokenized real-world assets (RWAs), decentralized finance and staking products. 

Lee has called on the government to reassess how it protects investors and supervises cross-border crypto activity as stablecoin outflows continue. “The government must comprehensively examine its investor protection and supervisory frameworks again and move swiftly to improve regulations,” he said, according to The Korea Times.

South Korea weighs tighter rules for offshore activity

The outflows come as South Korea works to complete a broader legal framework for digital assets. On Thursday, a policy report recommended that authorities introduce an interim licensing guidance and phase in stablecoin regulations before the Digital Asset Basic Act is finalized. 

The proposed act would create the country’s first comprehensive digital asset framework, including rules for stablecoin issuance, disclosures and market activity. However, lawmakers have yet to reconcile multiple proposals, with disagreements over which institutions should be allowed to issue won-pegged stablecoins contributing to delays. 

Related: South Korea plans stablecoin rules as opposition pushes crypto tax repeal

South Korean regulators have also sought to expand reporting requirements for crypto transfers. On June 22, South Korea’s Financial Intelligence Unit (FIU) proposed extending Travel Rule reporting requirements to transactions below 1 million won (about $650).

The FIU also called for stronger action against unregistered overseas exchanges serving South Koreans. The agency said uneven licensing and supervision across jurisdictions created opportunities for regulatory arbitrage, a concern underscored by the country’s continued stablecoin outflows.

Magazine: The real reason DeFi projects that survived 2022 crash are shutting down now

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

The CLARITY Act was absent from the U.S. Senate’s published schedule for Monday, Aug. 3, leaving lawmakers with only days to begin floor proceedings before the chamber’s summer break.

The official Monday schedule lists a 5:30 p.m. vote on cloture for the motion to proceed to H.R. 6500, a vehicle for a continuing resolution. It includes no scheduled action on H.R. 3633, the Digital Asset Market Clarity Act. The Senate’s cloture ledger, updated through July 31, also records the July 30 filing for H.R. 6500 but no CLARITY Act petition.

The absence does not formally block the crypto market-structure legislation. However, it leaves Senate leaders without a publicly confirmed vehicle or procedural timetable before the Senate begins its tentative state work period on Aug. 10. That break is scheduled to run through Sept. 11.

CLARITY Act Absent from Monday’s Senate Schedule, Facing a Critical 72-Hour Window Before Recess

Monday’s Senate schedule lists only a vote on a spending bill, with no action on the CLARITY Act. If an ordinary cloture motion is filed on Wednesday, Aug. 5, the Senate could hold a… pic.twitter.com/Y9J8Xd8WKT

— Wu Blockchain (@WuBlockchain) August 3, 2026

CLARITY Act needs a Wednesday filing for Friday action

Under the Senate’s ordinary Rule XXII process, a cloture petition requires 16 senators’ signatures. The cloture question is normally presented one hour after the Senate meets on the following calendar day but one. Therefore, a filing on Wednesday, Aug. 5, could produce a Friday, Aug. 7, vote, provided the Senate remains in session and meets that day.

That vote would not pass the CLARITY Act. It would determine whether the Senate ends debate on the motion to proceed to the legislation. Invoking cloture generally requires three-fifths of senators duly chosen and sworn, normally 60 votes when all seats are filled.

Even after successful cloture, Rule XXII permits up to 30 hours of consideration before the Senate votes on the underlying motion. Senators would then need to debate the bill, consider amendments and eventually vote on passage. A second cloture process could become necessary to end debate on the legislation itself.

Faster routes require bipartisan cooperation

Senate leaders could use a faster version of the cloture procedure, but it requires unusually broad cooperation. The petition must include the majority leader, minority leader, seven additional senators not affiliated with the majority and seven not affiliated with the minority.

Under that procedure, the cloture vote occurs one hour after the Senate meets on the next calendar day. If cloture succeeds, the Senate immediately votes on proceeding without further debate. The rule could shorten the timeline, but assembling the required bipartisan group would itself demonstrate that negotiators had made substantial progress.

A unanimous-consent agreement could compress the process further by setting debate limits and scheduling votes. However, any senator may object. No official filing or leadership notice reviewed for this update confirms that either expedited route has been secured.

Ascrypto.news previously reported, Sen. Cynthia Lummis said Majority Leader John Thune had maintained space for the legislation before the recess. Lummis nevertheless framed that outcome as her belief rather than a confirmed schedule, saying she believed Thune intended to proceed.

Seven Democratic votes remain the central barrier

Republicans control 53 Senate seats, so they would likely need at least seven Democrats to reach the ordinary 60-vote threshold if every Republican supported the motion.

Seven Democratic negotiators — Catherine Cortez Masto, Angela Alsobrooks, Cory Booker, Ruben Gallego, John Hickenlooper, Mark Warner and Raphael Warnock — said on July 22 that the Republican draft “falls short.” They called for stronger language covering ethics, consumer protection, illicit finance, conflicts of interest and market integrity, while saying negotiations would continue.

Senate Banking Committee ranking member Elizabeth Warren has taken a harder position. Warren called the updated legislation “dead on arrival” and argued that its ethics provisions would not adequately restrict President Donald Trump’s crypto interests. Those are Warren’s political and legal assessments, rather than findings by a court or independent regulator.

Meanwhile, Lummis released a merged proposal on July 22 combining work from the Senate Banking and Agriculture committees. She said lawmakers remained committed to reaching an agreement with Democrats. The Banking Committee had advanced its version by a 15–9 vote in May.

In related coverage, Sens. Thom Tillis and Ruben Gallego reportedly proposed letting state authorities enforce restrictions on federal officials issuing or sponsoring digital assets. The White House has not publicly approved final language, leaving the status of that compromise uncertain.

What happens next could shape the midterm fight

The next verified signal will be a cloture filing, leadership floor notice or unanimous-consent request identifying the legislative vehicle. An ordinary filing by Wednesday would keep a Friday procedural vote possible. A later filing would likely require an expedited agreement or additional Senate session days.

Even a successful Friday vote would only begin the process. The Senate could continue considering the bill after the recess, but lawmakers would return to a crowded September calendar. Any amended version must also return to the House, which passed H.R. 3633 by 294–134 in July 2025. The House vote included support from 78 Democrats.

The shrinking window also carries an electoral dimension. A procedural vote would force senators to create a public record before the 2026 midterms. Without one, campaigns and crypto political groups have less evidence for judging whether lawmakers supported advancing the bill.

Axios reported that more than $125 million in crypto-linked political funds remained available as negotiations continued. Separate groups had already announced $1.5 million in advertising supporting Republican Senate candidates in Michigan and Iowa. Fairshake remained neutral during the negotiations, while some Republican operatives wanted the Senate to force a vote and place Democrats on record.

That pressure does not determine the bill’s outcome. However, missing the pre-recess window would move the debate closer to the election, when campaign spending, vulnerable Senate seats and party control could become more closely tied to the legislation’s remaining path.

Cold storage fears after Coldcard users lose $90M in Bitcoin

After $90 million in Bitcoin was drained from Coldcard wallet users, small hodlers desperately sought refuge on centralized exchanges and via alternative custody methods.

Bitcoin transfers below 1 BTC climbed to their highest daily level since 2022 on Friday, with 39,600 BTC moved, according to data shared by CryptoQuant head of research Julio Moreno on Saturday.

The figure was just 300 BTC below the 39,900 BTC transferred on Nov. 16, 2022, days after FTX filed for bankruptcy.

Galaxy Research, the research arm of crypto investment company Galaxy Digital, reported Saturday that the third wave of attacks on users of the hardware wallet on the weekend brought estimated losses to 1,367 BTC ($88.6 million) across 4,585 addresses.

Alex Thorn, Galaxy Digital’s head of firmwide research, warned in an X post on Sunday that the attack was still ongoing and urged users to move funds from Coldcard-generated addresses immediately if they had not already done so. The exploit reportedly targets a flaw in the Coldcard seed generation process, that did not employ a genuinely random number generator.

Source: Alex Thorn

Clarity Act clock running out: No vote, or ‘no’ vote?

President Donald Trump is considering a revised ethics proposal for the Clarity Act that was devised by Senator Thom Tillis and Senator Ruben Gallego.

The original proposal Trump signed off on would have prevented elected officials from endorsing or profiting from crypto projects and would have been enforced by the Department of Justice. The Democrats don’t trust the DoJ and want the State Attorney Generals to enforce it. The compromise proposal would allow the State AGs to sue the DoJ if it does not properly enforce the rules, rather than allow them to sue elected officials *cough, Trump* directly.

With just five days left on the clock, the chances of any kind of Senate vote on the legislation are receding, much less the three separate votes required to pass the bill. Trump’s $1.4 billion in crypto profits are a particular sticking point, with Senate Minority Leader Chuck Schumer introducing a bill (with little hope of passing) called the Anti-Corruption Bureau Creation Act that targets “executive branch corruption.”

Ethics isn’t the only outstanding issue, with the banks still up in arms over paying any kind of yield on stablecoins, and law enforcement groups divided over the impact of the Blockchain Regulatory Certainty Act. Designed to protect blockchain developers, some argue it would thwart investigations into money laundering and fraud.

Changes to the BRCA proposed by the National Association of Assistant US Attorneys and the National District Attorneys Association look dead in the water. White House crypto advisor Patrick Witt scoffed at the proposals and the claim they resulted from “productive negotiations.”

”This is not even close,” he said.

Crypto ‘no earnings’ reports

Nobody is making much money in crypto right now it seems, at least according to this week’s corporate earnings reports for the second quarter.

Coinbase generated roughly $1.2 billion in net revenue, down 19% from a year earlier. It reported a net loss of $359 million, significantly wider than analysts’ expectations for a $122 million loss. Transaction revenue, subscription and services revenue, and adjusted EBITDA all fell short of consensus estimates.

Strategy’s habit of smash-buying every Bitcoin top, helped it to record an $8.22 billion loss in the second quarter, driven almost entirely by its unrealized losses on its Bitcoin holdings. However, the company also said it has now built a $3.75 billion U.S. dollar reserve, which is enough to cover more than two years of preferred dividend payments and interest obligations. 

Online brokerage Robinhood is making loads of money, but not much of it is attributable to crypto. The firm posted record second-quarter revenue and earnings, even as cryptocurrency transaction revenue fell 38% from a year earlier, from $160 million to $100 million.

Crypto enters biggest consolidation phase in history

ARK Invest analyst Lorenzo Valente says the cryptocurrency industry is entering its biggest consolidation phase yet, with revenue increasingly concentrated among a handful of dominant protocols.

Valente noted that perpetual futures exchange Hyperliquid and memecoin launchpad Pump.fun account for roughly 67% of total crypto application revenue between them. Including synthetic dollar protocol Ethena raises the top three’s combined share to nearly 80%.

Valente added that he expects the trend to accelerate in the coming months, leading to more mergers and acquisitions, Chapter 11 bankruptcies, project shutdowns and acqui-hires. Somewhat surprisingly, he concluded that “this is extremely bullish for the space.”

World Cup generated $20B in blockchain prediction market volume

The 2026 FIFA World Cup drove $20 billion in blockchain-based prediction market volume and $24 million in digital collectible trades, with more than 400,000 wallets participating in blockchain-based betting, according to a report from blockchain analytics firm Chainalysis.

The $20 billion figure includes trading before and during the tournament, with bettors placing roughly $5.7 billion in wagers over the five-week World Cup itself. World Cup-related markets accounted for about 63% of all prediction market activity during that period, the report said.

Winners and Losers

At the end of the week, Bitcoin (BTC) is down 3% to trade at $63,350, Ether (ETH) is down 3.5% to trade at $1,879 and XRP (XRP) is down 2.3% and is changing hands for $1.08. The total market cap is at $2.18 trillion, according to CoinMarketCap.

Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are Cardano (ADA) at 14.7%, Uniswap (UNI) at 8%, and Pi (PI) at 3.2%.

The top three altcoin losers of the week are Stable (STABLE) at -16%, Venice Token (VVV) at -14.6% and Lido DAO (LDO) at -14.1%.

Prediction of the Week

Bitcoin may have bottomed before its traditional cycle low

Crypto-focused asset manager Grayscale said that Bitcoin’s price may have bottomed earlier than the traditional four-year cycle, which would imply a cycle low in September or October. 

Head of research, Zach Pandl, argued that Bitcoin (BTC) has “grown up” as an asset and is increasingly driven by macroeconomic factors. 

“If the Fed forgoes rate hikes and economic growth holds up well, Bitcoin’s price may already have bottomed,” Pandl wrote in a report.

However, people have been peddling this hopium for months now. Earlier in July, crypto brokerage K33 pointed to more than 50% of the Bitcoin supply being held at a loss as another signal of an imminent market bottom. In June, Swan Bitcoin CEO Cory Klippsten told Cointelegraph that the holdings of long-term investors, which reached an all-time high of 14.7 million Bitcoin, were another signal of an imminent Bitcoin bottom.

Sooner or later, someone will be right.

Top FUD of the Week

The Russians… and the Australians… are after Telegram’s Pavel Durov

Russian authorities have placed Telegram founder Pavel Durov on an international wanted list as they escalate a criminal case accusing him of facilitating terrorist activity.

Russia’s Federal Security Service (FSB) said on Wednesday that it had charged Durov with facilitating terrorist activity and issued an international warrant for his arrest, local news agency Interfax reported.

The FSB alleged that Telegram failed to remove channels, chats and bots that Ukrainian intelligence services, alleged terrorist groups and extremist organizations used to coordinate attacks, recruit operatives and conduct cyber fraud.

A defiant Durov said on Thursday the Russians had become “confused about who can ban whom from the Internet.”

Meanwhile the Australian eSafety Commisioner has launched court proceedings against Telegram seeking civil penalties, alleging the platform failed to remove terrorism-related content.

Pump.fun laid off workers before they received millions in PUMP tokens

Solana-based memecoin launchpad Pump.fun reportedly fired employees two months before they were due to receive PUMP tokens worth millions of dollars.

According to a Friday Sandmark report, at least one Pump.fun worker was due to receive PUMP tokens worth in the seven-figure range.

The employees were reportedly fired in April, just two months before they were due to start receiving the company’s tokens based on agreements signed in 2025.

Trump teleprompter operator accused over Kalshi bets leaves government

A White House teleprompter operator accused of using inside knowledge to profit from prediction market bets on President Donald Trump’s speeches no longer works for the federal government, according to the Associated Press.

Perez was accused of using nonpublic information to make more than $100,000 betting on Kalshi prediction markets tied to Trump’s speeches, according to an earlier ABC News report.

Best Magazine Stories of the Week

Crypto’s fundamentals have never been stronger, yet degens keep chasing hot new narratives. Behavioral finance may explain why get-rich-quick stories continue to beat substance.

DeFi projects that survived the fallout from the Terra and FTX collapses in 2022 are dying out in 2026. But analysts say it’s not a case of industry consolidation — but the opposite.