The $TRUMP coin was worth more than $46 at its height, but it steadily declined to its current price of $1.47. The token saw brief spikes in value when the company behind it announced it would host dinners — including at Trump’s Mar-a-Lago, with the president as the keynote speaker — but that price action was temporary both times.

In what’s likely to pack more political needling than actual regulatory results, the letter comes as negotiators hoping to finish the Digital Asset Market Clarity Act are awaiting the White House’s response to the latest revamping of the contentious section that would ban senior government officials from direct involvement in crypto projects.

For its part, the SEC has already ruled memecoins as generally outside its sphere of influence. In one of the early staff crypto statements after the Trump administration took over, the agency declared that memecoins have “limited or no use or functionality” and don’t check a box as securities under the law.

The ability for a government official, such as President Trump, to issue such a token is at the center of the negotiation over the ethics section of the Clarity Act. Trump recently agreed to be subjected to a limit, though the restrictions he agreed to would have very narrow practical effect. Democrats refused the approach and said they’d oppose the legislation unless that provision was made stronger, so Senators Thom Tillis, a Republican, and Ruben Gallego, a Democrat, negotiated a tougher version. The rewrite was sent to the White House last week, which hasn’t yet responded days later.

David Schwartz said the Coldcard breach shows that rare custody failures can produce devastating losses, comparing the incident with past breakdowns in traditional finance.

Schwartz compares Coldcard breach with TradFi failures

Ripple CTO Emeritus David Schwartz framed the Coldcard attack as an example of outlier risk—the possibility that a rare technical failure can cause losses far beyond what users expect.

Schwartz compared the incident with the 2011 collapse of MF Global, where customers temporarily lost access to funds after the brokerage misused money that should have remained segregated. His comments challenged the assumption that self-custody removes every form of counterparty or operational risk.

Hardware wallets allow users to control their private keys without relying on an exchange or other financial intermediary. However, owners must still trust that the device’s hardware and firmware generate and protect those keys correctly.

Schwartz also pointed to a major difference between traditional finance and crypto self-custody. Customers of regulated financial institutions may have access to insurance, bankruptcy proceedings, or other recovery mechanisms. Coldcard owners whose Bitcoin was stolen through compromised seeds currently have no comparable safety net.

What is the Coldcard hack?

Coldcard is a Bitcoin-only hardware wallet made by Canadian manufacturer Coinkite. The device stores private keys offline and can sign transactions without directly connecting to the internet.

The current breach did not involve attackers remotely accessing Coldcard devices. Instead, it resulted from a seed-generation flaw introduced through firmware released in March 2021.

According to Coinkite’s technical review, affected firmware used a software-based pseudorandom number generator rather than obtaining sufficient randomness from the device’s hardware generator. The problem affected seeds created on certain Coldcard firmware versions, including Mk2 and Mk3 releases from version 4.0.1 through 4.1.9.

Seed phrases should contain enough randomness to make guessing them computationally unrealistic. The Coldcard flaw reduced that protection, allowing attackers to generate possible seeds offline and compare their derived Bitcoin addresses with publicly visible addresses on the blockchain.

Once attackers found a match, they could recreate the wallet’s private keys and transfer its Bitcoin. They did not need to steal the hardware wallet, know its PIN, or compromise the Bitcoin network.

Coldcard losses exceed $100 million

As reported by crypto.news earlier, Galaxy Research said it had identified 1,596 BTC stolen from about 7,300 addresses across three confirmed attack waves. The firm also linked roughly 14 smaller incidents to the same seed-generation flaw.

A suspected fourth wave could raise the total to about 2,055 BTC, worth close to $130 million. However, Galaxy has not yet confirmed those additional losses.

The first major sweep occurred around July 30, when more than 1,000 BTC was removed from over 1,200 addresses in less than an hour. Two additional waves later targeted other wallets created using vulnerable seeds.

Galaxy shared hundreds of suspected attacker addresses with U.S. federal investigators, exchanges and blockchain security companies. About 90% of the Bitcoin stolen during the confirmed waves had not moved again at the time of its latest update.

The Bitcoin protocol was not compromised. The theft resulted from weak wallet-seed generation, meaning Bitcoin held in wallets created through unaffected software or hardware was not exposed by this specific flaw.

Coldcard owners must replace vulnerable seeds

Coinkite has released corrected firmware for affected Coldcard models. However, installing an update does not make an existing vulnerable seed secure.

The company’s security advisory instructs Mk2 and Mk3 owners who created seeds using firmware versions 4.0.1 through 4.1.9 to update to version 4.2.0 or later, generate a completely new seed and transfer their Bitcoin.

Users should first send a small test transaction and verify the receiving wallet before moving the remaining balance. Coinkite said its corrected seed-generation process is sufficient, while adding at least 50 private dice rolls remains an optional method for users seeking independent entropy.

The breach shows that air-gapped hardware can reduce online attack exposure without eliminating firmware, manufacturing, or seed-generation risks. For affected owners, moving funds to a newly generated wallet remains the only way to remove the immediate threat.

Plenty of classic teen-drama tropes come into play. Not only does Annie get caught in a love triangle, but her two suitors each represent opposing factions of the community: townies and summer people. Ellis (Jacob Whiteduck-Lavoie) is a hard-working, year-round resident, and Rory (Daniel Quinn Toye) a rich New York acquaintance whose family has a luxurious vacation home nearby. As also tends to be the case in stories aimed at teens, the young characters are remarkably autonomous. But creator and co-showrunner Megan Park, whose films The Fallout and My Old Ass displayed deep insight into the inner lives of young women, isn’t mindlessly mimicking the mini-adults of Euphoria and Gossip Girl. (Sterling Point shares co-showrunners with the latter series, in Josh Schwartz and Stephanie Savage, which goes to show how conscious a choice its divergence from its millennial predecessors must be.) Like Annie, most of these characters have been forced by their parents to fend for themselves, emotionally if not quite literally. One of the most charming performances in a show that has many of them comes from Bo Bragason as Oona, a bubbly lesbian flirt whose mom has jetted off to India, leaving her in charge of her little sister (Mabel Strachan) and their houseboat.

Galaxy Digital’s research team says the Coldcard wallet exploit has been used by at least 15 different attackers, based on new victim reports submitted after the incident. In remarks shared this week, Alex Thorn, head of research at Galaxy Digital, suggested that these additional reports helped identify variants that might otherwise have remained hidden.

Thorn also indicated that losses tied to the exploit have risen as investigators mapped multiple waves of activity. Galaxy Research estimates the confirmed thefts total about $100 million across three waves, with an additional suspected fourth wave that could lift the figure to roughly $130 million in Bitcoin.

Key takeaways

• Galaxy Digital reports at least 15 distinct attackers behind the Coldcard exploitation, based on newly received victim accounts.
• Galaxy Research estimates confirmed losses at about $100 million across three attack waves, with a potential fourth wave raising the estimate to ~$130 million.
• Security debate is returning to cold storage practices, particularly how much safety comes from self-custody versus wallet design.
• Industry discussion highlights how emerging AI capabilities could lower the time and cost of vulnerability discovery—though independent validation remains limited.
• Researchers point to wallet entropy and firmware behavior as potential factors that make exploitation easier under certain conditions.

Coldcard thefts widen as investigators compare victim reports

In a Tuesday post on X, Thorn said that new victim reports enabled Galaxy to identify additional attacker activity. He framed the significance of the new reporting as both quantitative and technical: the exploit behavior differed from typical theft patterns seen in hacks against centralized exchanges, making careful attribution and investigation more dependent on detailed victim information.

Thorn wrote that even a relatively small report—less than 1 BTC stolen from a victim—was sufficient to detect a new attack pattern. He noted that this new attack involved roughly 12 BTC siphoned from 126 addresses, underscoring how the same underlying vulnerability could be used in different operational ways.

Earlier coverage of the Coldcard exploitation described multiple “waves” of activity. Galaxy Research’s current figures build on that approach by tracking confirmed incidents and assessing whether activity patterns resemble a further wave of exploitation.

Loss estimates: three confirmed waves, plus a suspected fourth

According to Galaxy Research, the total losses from the Coldcard exploit have grown to approximately $100 million across three confirmed attack waves. Thorn’s research also points to a suspected fourth wave that, if validated, would bring the potential total to about $130 million in Bitcoin.

For users and investors, the practical value of this breakdown is that it turns an incident that initially looked like a one-off event into something closer to an evolving campaign. Waves of theft imply repeated operational access—either through different attacker infrastructure, different timing, or different exploit paths that still converge on the vulnerable behavior.

Debate over “AI hardening” and whether models can rediscover exploits

The renewed attention has also reopened a broader debate: whether AI tools can meaningfully compress the time between disclosure and exploitation, and whether “AI hardening” could have prevented the attack.

Dragonfly managing partner Haseeb Qureshi argued on X that “$2 of AI hardening” could have stopped the Coldcard exploit, citing social media claims that some AI models rediscovered the underlying vulnerability in under 20 minutes. His comments referenced reports that a model named Claude could regenerate the vulnerability in eight minutes, as well as a separate claim that an open-source model (GLM 5.2) could rediscover the exploit in 20 minutes even with web access disabled.

However, Tokenomist data lead Tatsapat Saerejittima told Cointelegraph that it is unlikely AI models would have independently found the vulnerability before it became public. Saerejittima argued that the most prominent “fast rediscovery” claim appears to stem from a pseudonymous user who scanned code after the vulnerability was already known, without a blind test, a documented methodology, or an assessment of false-positive rates.

“The claim that AI found it in 2 mins came from a pseudonymous Reddit user who scanned the code after the vulnerability had already become public. There was no blind test, no documented methodology, and no assessment of the model’s false-positive rate.”

That distinction matters. If “rediscovery” is based on post-disclosure inputs, then the timeframe reflects reuse of known information rather than a model’s ability to autonomously uncover unknown vulnerabilities under real-world conditions. For wallet users, builders, and auditors, the difference affects how confidently security teams can treat AI-assisted testing as a substitute for formal review and threat modeling.

Private key setup and entropy may have made exploitation easier

Another line of analysis focuses less on AI capabilities and more on the cryptographic design and implementation details of the device’s key generation process.

Crypto research company Castle Labs co-founder Francesco said that increasing AI capabilities could reduce the cost and time needed to discover cryptocurrency vulnerabilities. He also suggested that Coldcard’s private key may have played a role in why the exploit worked.

Francesco pointed to a “level of private key entropy (40 bits) much lower than the standard adopted by other wallets (a 12-word seed is 128 bits).” He attributed this discrepancy to a firmware bug, which he said would make exploitation easier because the search space is smaller than it would be under typical seed-based entropy assumptions.

He further stated that he expects the cost of bug discovery to continue decreasing as AI models improve and become more embedded in both cybersecurity workflows and exploitation attempts. Even without relying on any single “AI rediscovery” claim, the underlying idea—that automation can accelerate identification and exploitation—aligns with the broader security trend toward faster vulnerability discovery and weaponization.

In practice, these findings shift attention to what should change next for hardware wallet security: not only whether vulnerabilities are found quickly, but how wallet firmware handles entropy, key generation, and edge cases that could alter the effective security assumptions.

As the industry digests Galaxy’s expanding attribution data and the ongoing discussion of exploit mechanics, readers should watch for whether additional theft activity continues to be classified into further waves—and, just as importantly, what technical mitigations are recommended or adopted to address the entropy or firmware conditions implicated by researchers.

Bitcoin bridge Boltz has suspended services indefinitely due to repeated attacks on its infrastructure by hackers using AI tools.

Boltz’ announced that it could no longer “responsibly re-enable Boltz swaps” while it’s “being actively targeted by what appear to be multiple resourceful groups while we race to deploy fixes.”

Indeed, the company claimed that over the past few months it had witnessed a “steady rise in automated, AI-assisted probing of our infrastructure” that resulted in several exploits. 

Every exploit has apparently been contained, but Boltz is now worried that it can’t keep up with fixing exploits as its attackers “iterate faster than a team our size can find and patch.”

Read more: Coldcard hacker’s BTC wallet flooded with on-chain messages

It said, “What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis. Do not expect swap services to resume shortly.”

The company stressed that “no user funds were ever at risk,” and that any “losses were ours alone.”

Boltz Swap Services didn’t hold user funds as a custodian. Instead, the company operated a non-custodial bridge that used hashed timelock contracts to execute atomic swaps between regular BTC, Lightning Network BTC, and Liquid Network BTC.

Funds either fully swapped or fully reverted within one block.

Boltz suspension leads to collateral damage

Boltz’s closure of swap services has had a knock-on effect on Bitcoin firms Bull Bitcoin and Aqua Wallet.

Bull Bitcoin warned that lightning payments and Liquid to Bitcoin swaps in its wallet will now “fail without explanation,” and it’s working to find a solution. 

Aqua Wallet similarly warned that these types of swaps are no longer available, and that it’s working with Boltz and attempting to find alternative means for lightning swaps. 

A major seed phrase exploit affecting the Bitcoin hardware wallet Coldcard, which has now reportedly led to the theft of over $100 million worth of BTC, is also believed to have originated from AI software. 

It wasn’t alone in rejigging its exposure to cryptocurrencies. U.S. spot bitcoin ETFs overall recorded roughly $4.89 billion of net outflows in the three months through June, according to SoSoValue data. IBIT alone lost $2.95 billion. Spot ether ETFs also suffered, with more than $715 million in outflows.

Intesa Sanpaolo, in contrast, tripled its stake in BlackRock’s iShares Staked Ethereum Trust ETF (ETHB) to 349,600 shares. The position was worth $7.10 million at quarter-end, up from $3.15 million.

Among crypto-linked equities, the bank nearly doubled its BitGo Holdings (BTGO) position to 323,000 shares, while reducing its stake in Coinbase Global (COIN) by 32%, Circle Internet (CRCL) by 10% and Robinhood Markets (HOOD) by 43%.

The filing also shows a new 5.66 million-share SpaceX (SPCX) position valued at $966.42 million, making it Intesa’s largest disclosed holding. SpaceX, which went public on June 12, holds 18,712 bitcoin worth $1.18 billion. It reduced its holdings in Tesla (TSLA) by 92%.

Intesa made its first direct bitcoin purchase in January 2025, acquiring 11 BTC for about 1 million euros ($1.2 million) as part of what CEO Carlo Messina described as an experiment.

Blockchain-based prediction markets platform Polymarket is looking to raise fresh capital at a $20 billion valuation, Bloomberg reported Tuesday, citing people familiar with the matter.

According to the person, the company closed a funding round at a $15 billion valuation in April which included a $600 million investment from the Intercontinental Exchange, the owner of the New York Stock Exchange.

In June, Polymarket told CNBC that its annualized revenue had climbed well above $1 billion even after the platform saw a decline in trading volumes in April and May which were offset by record highs during the World Cup.

Polymarket founder and CEO Shayne Coplan has long argued Polymarket should be viewed as an information platform rather than a betting site. In a March appearance, he said prediction markets let people “put your money where your mouth is” when they disagree with consensus, describing the platform as “a very useful thermometer of the world” that helps people assess the likelihood of future events. He also said his long-term vision is to expand beyond headline events into a broader “almanac for the future” covering a much wider range of markets.

Bitcoin mining company Bitdeer has signed a 16-year lease agreement valued at as much as $4.7 billion to secure artificial intelligence and high-performance computing data center capacity, underscoring how crypto miners are increasingly expanding into AI infrastructure as demand for computing power grows.

Under the agreement, Bitdeer will provide 121 megawatts of IT capacity at its Tydal, Norway, AI data center to a tenant that the company identified only as a subsidiary of Volta Infra. The facility will be configured to support Nvidia GPU-based AI workloads, though Bitdeer did not disclose the tenant’s identity or specify whether Volta is the end customer or an intermediary.

Bloomberg News reported that the Nvidia-backed Volta’s $10 billion ‌cloud contract is with ⁠Anthropic, citing people familiar with the matter.

The lease remains subject to customary closing conditions and is not yet effective, according to the company. To secure the tenant’s payment obligations, affiliates of JP Morgan and another unnamed global financial institution are expected to issue approximately $1.3 billion in letters of credit, or a bank guarantee that ensures the landlord can recover funds if the tenant fails to meet its contractual payment obligations.

Bitdeer shares jumped about 8% in early Nasdaq trading following the announcement, suggesting investors welcomed the company’s continued expansion into AI infrastructure and data centers.

Shares of Bitdeer Technologies Group (BTDR) rose sharply on Tuesday.
Source: Yahoo Finance

Bitdeer has steadily diversified beyond its core Bitcoin mining business in an effort to broaden its revenue base. Alongside its push into AI and high-performance computing infrastructure, the company has expanded its mining hardware manufacturing operations to reduce its reliance on third-party suppliers. Last month, Bitdeer announced a $36 million investment in a manufacturing facility in Nevada to support that strategy.

Related: Galaxy, MARA Holdings deepen Texas expansion with land acquisitions

Bitdeer bucks industry trend by selling all BTC holdings

Bitdeer has taken a different approach from many of its publicly traded mining peers by fully liquidating its Bitcoin treasury.

In early February, the company held roughly 943 BTC before announcing that it had reduced its holdings to zero, while maintaining that it remains committed to the Bitcoin ecosystem. According to Bitdeer executive Ross Gann, the sales were made to help fund the company’s broader expansion strategy, including acquisitions of powered land for AI and Bitcoin mining infrastructure.

By contrast, several major Bitcoin miners continue to maintain large Bitcoin treasuries. MARA Holdings, Riot Platforms, CleanSpark and Hut 8 each hold at least 10,000 BTC, according to BitcoinTreasuries.NET, with MARA’s holdings exceeding 36,000 BTC.

Magazine: Sorry everyone, Bitcoin is headed down to $43,500: Michael Terpin