Bitcoin users are revisiting a core assumption about self-custody after the disclosure of a “low-entropy” issue tied to Coldcard hardware wallet firmware. According to reporting and analysis referenced in the crypto community, publicly observed thefts linked to the flaw began around July 30, prompting investors and long-time hardware wallet holders to scrutinize how their seed phrases are generated.

While Coldcard’s devices have long been valued for offline security and user control, the episode highlights an uncomfortable truth: if the randomness used to create a wallet’s seed can be predicted or effectively reduced, attackers may brute-force private keys. The situation has also reignited debate inside the ecosystem about what it actually means to “verify” secure entropy—and how much should be outsourced to hardware versus performed by the user.

Key takeaways

• Coldcard firmware starting with version 4.0.1 (released March 2021) is described as using MicroPython’s Yasmarang PRNG instead of relying correctly on the device’s STM32 hardware RNG.
• Coinkite estimated that affected Coldcard models produced seeds with roughly 40 bits of entropy (Mk2/Mk3) or around 70 bits (Mk4/Mk5/Q), which falls short of what’s needed for a robust 12-word BIP-39 seed.
• Attackers reportedly brute-forced private keys after the issue became known, with Cointelegraph coverage cited as placing stolen value at over $100 million in BTC.
• Users who generated seed phrases using sufficient physical entropy (e.g., dice) have been argued to reduce reliance on the compromised randomness path.
• Community tools such as honeypot monitoring have been used to estimate which wallet types attackers are sweeping effectively.

What changed in Coldcard’s randomness generation

The central technical claim is that Coldcard hardware wallets contained what appeared to be functional STM32 “true random number generators” (TRNGs) designed to produce unguessable seed phrases. However, after Coldcard creator NVK initiated a firmware rewrite intended to move from a GPL-licensed free software model to a read-only model, analysts say a serious vulnerability was introduced.

Starting with firmware version 4.0.1, released in March 2021, the device reportedly switched to MicroPython’s Yasmarang PRNG rather than properly using the STM32 hardware RNG. Random number generation is described as inherently difficult for computer systems, and secure seed creation is typically expected to incorporate enough external physical unpredictability to make outputs infeasible to guess.

In the ecosystem, the Yasmarang PRNG has been widely characterized as a pre-programmed fallback. A referenced engineering analysis from Block that explains “predictable RNG fallback” and the mechanics of a “32-bit reseed” approach was linked by the article’s source material. Coinkite later disputed that characterization in an X post, challenging the conclusion that the device was simply hardwired to an obviously weak method.

Even with that dispute, the broader implication remains: when a wallet’s seed generation is not truly unpredictable, private keys may become searchable. The article’s source material notes speculation on X about whether a backdoor was deliberately placed, and it also cites a Bitcoin journalist’s view that the bug may have arisen from development practices and attempts to suppress errors through randomized changes.

Entropy levels, seed security, and why brute force mattered

Coinkite’s estimates cited in the source material are specific about the magnitude of the problem. It estimated that Mk2 and Mk3 devices generated seeds with about 40 bits of entropy, while Mk4, Mk5, and Q achieved roughly 70 bits. As the source notes, both figures are well short of the 128-bit level generally treated as sufficient for a secure 12-word seed phrase.

That shortfall matters because it reshapes the threat model. Instead of requiring attackers to brute-force astronomical keyspaces, lower effective entropy can make key discovery drastically more practical. The source material further states that after the flaw, attackers succeeded in brute-forcing private keys and stealing funds, pointing to Cointelegraph coverage that described thefts exceeding $100 million worth of BTC.

The likelihood of whether a specific wallet was found and swept is presented as depending on additional variables—such as whether extra “dice entropy” was added, or whether a BIP-39 passphrase and a non-standard derivation path were used. Those details underline a key uncertainty for readers: the exploit’s impact may not have been uniform across all users and all wallet setups.

Using physical entropy to reduce reliance on hardware

Beyond the immediate controversy around Coldcard firmware, the episode has reinforced a recurring community principle: “Don’t trust, verify.” The source material argues that users who avoided relying on opaque hardware generation for the most security-critical step—seed creation—had a better chance of preventing exposure to the low-entropy issue.

The practical point is that rolling dice provides a process users can observe and audit themselves. Verifying a TRNG’s quality, by contrast, would require detailed inspection of electronics and firmware—work most users cannot feasibly perform.

Importantly, the source material suggests that safe self-custody still does not require relinquishing the ability to cross-check. If the seed phrase is generated from physical entropy, the user’s dependence on the compromised hardware path is reduced. It also describes ways to validate whether derived artifacts match across devices—such as importing the same seed into another device to cross-check the resulting xpub and receiving addresses.

For detecting other classes of compromise, the source material also mentions checking signatures: nonce exfiltration through an airgap can be detected by comparing whether two devices generate the same signature when given an identical unsigned transaction, referencing RFC 6979 for deterministic signing behavior.

While these checks can’t replace true unpredictability at the moment entropy is created, they create additional hurdles for attackers and can help users spot irregularities in how transactions are processed and signed.

How the community is generating entropy without trusting a single device

After the exploit became public, the source material says methods and proposals for generating entropy directly from physical inputs accelerated across the community. One widely used approach described involves validating dice-to-seed conversion by cross-checking the device’s ability to correctly transform die faces into a BIP-39 seed phrase via hashing. The article states that using upward of 100 dice throws can be enough to generate entropy for a 24-word seed.

Other options include paper-based systems. The source cites a table published by Bitbox that uses a lookup method to map combinations of dice outcomes—plus a coinflip—directly to BIP-39 seed words without electronics. More advanced worksheets are also referenced, including a codex32 dice de-biasing approach that uses a van Neumann extractor so biased dice can still yield secure seed material that can be computed by hand.

For users seeking convenience, the source material points to alternatives that reduce error-proneness, such as printing and cutting BIP-39 word fragments, shuffling them, and drawing random words—methods made easier by products like Seedsticks or Entropia. It also references specialized hardware intended to verifiably distribute entropy across devices, alongside examples of community-designed physical entropy generators shared on X.

Taken together, these ideas shift the emphasis from “which hardware wallet is most trusted” to “how randomness is sourced at the moment security depends on it.” In practice, the Coldcard incident has encouraged many users to treat seed creation less like a black-box procedure and more like a process they can replicate and reason about.

Going forward, readers should watch for clearer technical consensus on exactly how the affected firmware path produced low-entropy outputs in different models, and for continued analysis tools—such as honeypot tracking mentioned in the source—to refine estimates of which wallet behaviors remain most resilient. Until then, the safest operational takeaway is straightforward: wherever possible, make seed generation as independently verifiable as the rest of your self-custody workflow.

The CFTC has warned regulated prediction markets against displaying American-style gambling odds as state authorities intensify efforts to classify sports event contracts as unlicensed betting.

CFTC warns prediction markets over odds displays

The Commodity Futures Trading Commission instructed regulated prediction market platforms not to display contracts using American-style gambling odds, according to an Aug. 7 Bloomberg report.

American odds typically show potential returns using positive and negative numbers, such as +150 or -200. Sportsbooks commonly use this format, while prediction markets usually price contracts between $0 and $1 based on the implied probability of an event.

The CFTC also reminded registered entities that event contracts remain subject to U.S. derivatives laws. Platforms must avoid “deceptive” practices when listing, advertising, or soliciting trades in these products.

The guidance suggests that federal registration does not allow prediction markets to advertise their products in a manner that makes them indistinguishable from conventional sportsbooks. It comes as the agency continues defending its authority over event contracts against state gaming regulators.

The CFTC maintains that designated contract markets fall under its exclusive jurisdiction through the Commodity Exchange Act. State officials argue that contracts tied to sporting events constitute wagers and require local gambling licenses.

State lawsuits challenge CFTC jurisdiction

New York became the latest state to escalate the dispute when Attorney General Letitia James sued Kalshi on July 31. As crypto.news reported, the state is seeking at least $36 billion in damages and penalties.

The complaint alleges that Kalshi operates an unlicensed gambling business by allowing New York residents to trade contracts on sports and other events. Kalshi has denied that characterization and argues that its status as a CFTC-regulated exchange places it outside state gambling oversight.

The dispute extends well beyond New York. Attorneys general from 44 states recently urged the CFTC to withdraw and rewrite its proposed prediction market rules. They argued that states have traditionally regulated sports betting and should retain authority over sports-related contracts.

Courts have also questioned the federal regulator’s position. A Wisconsin federal court rejected the CFTC’s request to prevent state authorities from applying gambling laws to prediction platforms.

Washington secured a preliminary injunction against Kalshi in July. The court found that federal derivatives law did not prevent the state from enforcing its gambling restrictions, according to earlier crypto.news coverage.

Kalshi seeks emergency relief in Utah

Kalshi filed an emergency motion for an injunction pending appeal after a Utah federal court ruled that the state could enforce its anti-gambling laws against prediction markets.

Gaming law expert Daniel Wallach said the company requested expedited relief because it fears Utah Attorney General Derek Brown could pursue civil or criminal charges while the appeal remains pending.

The ruling rejected Kalshi’s claim that the Commodity Exchange Act prevents Utah from regulating its sports event contracts. Kalshi intends to take the dispute to the U.S. Court of Appeals for the Tenth Circuit.

Utah residents could still access the platform immediately following the decision, but Brown indicated that the state planned to enforce its gambling laws. The state has not disclosed what form that enforcement will take.

Prediction markets face tighter compliance demands

The latest warning shows that the CFTC’s support for federal jurisdiction does not remove compliance obligations for prediction market operators.

The agency has also pursued misconduct on regulated platforms. Former U.S. Representative George Santos recently agreed to return $17,569.98 in trading gains, pay a $17,500 penalty, and accept a three-year trading ban over Kalshi contracts, as crypto.news reported.

The CFTC’s warning could require platforms to review how they display contract prices and promote sports-related products. Meanwhile, pending appeals in Utah and other states will help determine whether federal registration can shield prediction markets from local gambling laws.

The United States Senate postponed action on the Clarity Act until September, extending uncertainty across the digital asset market. The delay removed a key legislative event that market participants expected before the August recess. Meanwhile, Bitwise Chief Investment Officer Matt Hougan said weaker expectations for the bill could trigger brief market pressure before conditions improve later this year.

Senate Pushes Clarity Act Vote to September

Senate leaders confirmed that lawmakers will not consider the Clarity Act before the August recess. Instead, they scheduled the legislation for consideration after Congress returns in September. As a result, the digital asset industry faces another period without a clear federal regulatory framework.

The bill aims to establish clear oversight for digital assets across the United States. It also defines the responsibilities of the Securities and Exchange Commission and the Commodity Futures Trading Commission. Therefore, many industry participants consider the proposal an important step toward regulatory certainty.

Republican lawmakers currently hold 53 Senate seats, yet the legislation requires 60 votes to overcome a filibuster. Consequently, bipartisan support remains necessary before the bill can advance. Lawmakers also continue negotiations over ethics rules, illicit finance measures, and consumer protection requirements.

Bitwise Expects Brief Market Weakness Before Potential Recovery

Bitwise Chief Investment Officer Matt Hougan addressed the delayed legislation in a recent company memo. He said lower expectations for the Clarity Act could remove uncertainty surrounding the Senate timetable. He added that the market could experience a short period of weakness before recovering later in the year.

Hougan pointed to prediction market expectations surrounding the legislation during his assessment. He said the probability of passage during 2026 should decline sharply if lawmakers fail to approve the bill this week. According to his view, reduced expectations could eliminate a major source of short-term uncertainty.

He also stated that the crypto market could weaken briefly after expectations adjust. However, he suggested that a clearer outlook may create stronger conditions during the fall. Therefore, the immediate reaction could remain temporary if legislative uncertainty declines.

Bitcoin, Ethereum, and XRP Hold Key Levels as Regulatory Debate Continues

Bitcoin continued trading above $64,400 despite the Senate postponement and broader policy uncertainty. At the same time, Ethereum remained above $1,900, while XRP traded near $1.05. Those price levels reflected a relatively stable market despite delayed legislative action.

The Clarity Act remains one of the most significant digital asset proposals under consideration in Washington. The legislation seeks to separate regulatory responsibilities between the SEC and the CFTC. In addition, it intends to provide clearer compliance standards for digital asset businesses operating in the United States.

Negotiators continue discussing several disputed provisions before the Senate resumes its work. One proposal could require President Donald Trump to divest from certain crypto-related business interests under new ethics rules. Meanwhile, President Trump has continued supporting policies that maintain United States leadership in digital asset innovation instead of allowing China to strengthen its position in the sector.

The delayed vote leaves the regulatory timetable unresolved as lawmakers continue negotiations during the congressional recess. Although the legislation remains active, its final form still depends on bipartisan agreement. Until then, the digital asset market will continue operating without the comprehensive federal framework that many industry participants have sought for years.

This is how Tony, who will eventually become Anthony, falls for the restaurant life: The chaos of the kitchen, the unruly, often drug-addicted personalities, the power to put together meals that people can enjoy with friends, and maybe even remember long after the fact. Sessa is perfect as the swain Bourdain: He’s got that just-fallen-out-of-bed look—perhaps because he literally has just fallen out of bed, or, more accurately, a hammock—but he’s also hungry and inquisitive in a touching way. At first charged with the lowly task of dishwashing, he furtively watches his kitchen colleagues—including Leo Woodall’s Sal, who becomes both a friend and a terrible influence—as they expertly shuck oysters, or slam the lever on a heavy-duty potato slicer as if it were the arm of a slot machine, usually while talking trash about one another. Suddenly, he’s found the place where he belongs. Banderas’ Chef spots Tony’s spark of potential before he does: One of the cardinal rules he’s instituted for his employees is that they must never be even 15 minutes late. To that end, every workday morning he rouses Tony from the snoozy coziness of his hammock with a bucket of water. He doesn’t want this kid to fail, and though Tony has loving, albeit perhaps too permissive, parents (they’re played by Rich Sommer and Dagmara Dominczyk), this is just the kick in the pants he needs.    

Crypto perpetual futures trading volume on centralized cryptocurrency exchanges (CEXs) fell to $4 trillion in July, marking a 31-month low last seen in December 2023.

Binance led CEXs with $1.4 trillion in monthly perpetual futures volume, followed by OKX with $607 billion and Bybit with $300 billion, analytics platform CryptoRank said in a Friday X post.

Perpetual futures volumes briefly recovered between April and June before declining across all major venues in July.

The 31-month low in perpetual futures activity came as daily spot crypto trading volume fell 23.6% between July 1 and July 31, from $17.8 billion to $13.6 billion, according to analytics provider Coinglass.

Source: CryptoRank

Perps volume on DEXs nears one-year low

Perpetual trading volume on decentralized exchanges (DEXs) fell to $531 billion in July, the lowest level since June 2025 and a 21% decline from the $676 billion seen in June 2026, according to data aggregator DefiLlama.

Perpetuals trading volume on decentralized exchanges. Source: DefiLlama

Perps trading volume on DEXs has trended lower since the $1.36 trillion seen in October 2025.

Open interest on DEXs has also fallen to $17.9 billion in July from a peak of $19.4 billion in September 2025. Open interest measures the total value of active, unsettled contracts and can indicate whether new capital is entering or exiting the market.

Related: Hyperliquid RWA contracts grow to 32% of trading activity in Q2

Hyperliquid was the leading DEX with $199 billion in reported trading volume over the past 30 days. A growing share of Hyperliquid’s trading volume has come from tokenized real-world assets (RWAs), which accounted for 32% of Hyperliquid’s second-quarter trading activity, generating 6.6% of the protocol’s $169 million quarterly revenue. 

Tokenized assets became Hyperliquid’s largest trading category for the first time last month, with RWAs accounting for 52% of its total weekly trading volume between July 13 and July 19.

Magazine: How Bitcoin and gold reacted differently to the Iran war shock

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.