Galaxy Research raised its estimate of Bitcoin drained from addresses linked to the Coldcard firmware flaw to 1,367.05 BTC, worth about $88.6 million, on Aug. 1. 

The research unit identified 4,585 affected addresses across three suspected attack waves, replacing its earlier estimate of 1,082.65 BTC from 1,196 addresses.

The revised figure means the $70.2 million estimate reported after Galaxy’s first analysis is no longer current. Galaxy described the total as its “estimated observed size,” leaving open the possibility that further transactions could be found. The company has not proved that every address came from a vulnerable Coldcard seed.

Galaxy raises Coldcard estimate after third wave

Galaxy’s first mapped wave occurred between 1:10:20 a.m. and 1:51:26 a.m. UTC on July 30. It traced 1,082.65 BTC from 1,196 addresses across blocks 960,183 through 960,191. The transactions appeared about 30 hours before Coinkite issued its initial public advisory.

A second wave on July 31 drained 76.16 BTC from another 1,478 addresses. Galaxy later identified a third wave that removed 207.7294 BTC from 1,912 addresses. Together, the three groups brought the observed total to 1,367.05 BTC across 4,585 addresses.

The first wave used the same 30 satoshis per virtual byte fee and transactions without change outputs. Those traits helped researchers identify the related movements onchain. Galaxy warned that later attacks might use different patterns, making the complete loss harder to measure.

Three waves used different transaction patterns

Galaxy said the first two waves shared collector addresses, destination types and derivation-path behavior. The events also occurred about 27 hours apart. Those similarities suggested one operator may have conducted both sweeps, although the blockchain cannot establish the attacker’s identity.

The third wave behaved differently. Funds from each victim moved to separate pay-to-witness-script-hash destinations, while several victims were grouped into each sweep transaction. The activity also checked only the default derivation path. Galaxy said it was confident each wave represented one operator, but would not claim that one attacker controlled all three.

Therefore, descriptions of a single hacker remain an inference rather than a confirmed fact. Galaxy called the third group “what we suspect are hacks of Coldcard-generated addresses.” The wording reflects the limits of onchain attribution.

Coinkite said a series of firmware integration errors prevented the intended hardware random-number generator from contributing properly to seed creation. A MicroPython software fallback supplied predictable output after a March 2021 code change. Block’s independent technical report described the same random-number-generator path and said active exploitation was underway.

Coinkite estimated about 40 bits of effective search space for affected Mk2 and Mk3 seeds. Later Mk4, Q and Mk5 models included extra secure-element entropy, but the company estimated roughly 72 bits rather than the intended 128 bits. These figures remain technical estimates and may change as testing continues.

The affected Mk2 and Mk3 range covers firmware 4.0.1 through 4.1.9. Seeds created on Mk4 and Mk5 before standard version 5.6.0, and Q seeds created before version 1.5.0Q, are also affected. Separate fixed Edge releases are available.

Existing seeds require migration, not only updates

Coinkite released hotfixes for every affected model and said it takes “full accountability” for the bug. However, installing new firmware only corrects future seed generation. It cannot add entropy to a recovery phrase that already exists.

The official Coldcard advisory tells users to install the fixed firmware, generate a completely new seed, verify its backup and receiving address, and send a small test transaction before moving the remaining balance. Users should keep the previous backup until the migration is confirmed.

Coinkite said seeds created with at least 50 fair, independent and private dice rolls are not considered exposed by this issue alone. A strong, unique BIP-39 passphrase adds another barrier, but the company still advises migration. Short, reused or predictable passphrases may not provide adequate protection.

However, the 594.48 BTC sweep identified by AnchorWatch’s Rob Hamilton. In related coverage, a later technical review examined how the firmware build error weakened Coldcard seeds for more than five years.

Coinkite’s investigation remains open, and the company has promised a formal technical review. Galaxy may also revise the observed loss again if new address patterns emerge. Until those reviews are complete, $88.6 million is the latest public estimate, not a final confirmed total. No verified Bitcoin price reaction has been attributed to the Coldcard incident so far.

Russia will extend its regional crypto mining ban to Moscow, the Moscow Region and parts of Kursk Region from Aug. 15, 2026.

The prohibition will remain in force through Dec. 31, 2032, under Government Resolution No. 936.

Prime Minister Mikhail Mishustin signed the measure on July 25. The government published it on the official legal information portal on July 31. It amends Resolution No. 1869, the December 2024 order that established territorial mining restrictions.

Russia crypto mining ban covers mining pools

The decree prohibits digital currency mining and participation in mining pools across Moscow and the entire Moscow Region. In Kursk, it applies to the Belovsky, Bolshesoldatsky, Glushkovsky, Korenevsky, Lgovsky, Rylsky, Sudzhansky and Khomutovsky municipal districts, plus the city of Lgov.

The measure expands a regional list rather than creating a nationwide mining ban. Resolution No. 936 adds Moscow, Moscow Region and the designated Kursk territories as entries 14 through 16 in the existing restriction order.

Power capacity concerns drove the expansion

The Energy Ministry’s explanatory material warned that operating without a year-round restriction could create “risks of a shortage of power capacity” as energy-intensive mining facilities connect to regional grids. Moscow Region energy authorities had requested the ban before the government adopted it.

Regional officials estimated that mining consumes about one gigawatt within the Moscow power system. Meanwhile, data-center capacity in Moscow and the surrounding region could reach 3.6 gigawatts by 2032, equal to 17% of the system’s maximum load, according to figures reported by Interfax. The 2032 figure remains an official projection rather than measured current demand.

Kursk officials sought restrictions in eight districts and Lgov amid concerns about pressure on local electricity infrastructure. The final decree adopted the same locations included in the earlier government proposal.

Russia has widened regional restrictions since 2025

The new order extends a policy that followed Russia’s legalization of cryptocurrency mining in 2024. Authorities subsequently introduced regional restrictions to manage electricity shortages and seasonal demand.

Existing rules cover several North Caucasus republics and other territories through March 15, 2031. The government also imposed year-round restrictions across parts of Buryatia and Zabaykalsky Krai from April 1, 2026. The Russian Energy Ministry said those restrictions cover 20 areas of Buryatia and 31 areas of Zabaykalsky Krai.

As previously reported, a Russian power-industry commission supported the Moscow and Kursk proposal in May. That recommendation moved the plan toward Cabinet approval while lawmakers considered separate penalties for unregistered mining.

Russia had introduced a mining registry intended to identify unregistered operators and equipment. The system supports a broader policy that permits registered mining while targeting unauthorized facilities.

Miners face an Aug. 15 shutdown deadline

Mining businesses operating in the newly restricted areas must stop local activity by Aug. 15 or move their equipment. The deadline falls 15 days after the decree’s July 31 publication. The restriction covers pool participation as well as direct cryptocurrency mining.

The prohibition is scheduled to expire after Dec. 31, 2032, unless the government amends the order. The decree does not provide an official estimate of the mining capacity affected or the amount of equipment that must relocate.

Therefore, claims that the Moscow ban will materially alter Bitcoin’s global hash rate remain unverified. The next confirmed development will be the restriction’s implementation on Aug. 15 and any later enforcement guidance issued by Russian energy or regional authorities.

Smaller Bitcoin transfers have reached levels not seen since the collapse of cryptocurrency exchange FTX amid an ongoing suspected Coldcard hack.

Bitcoin transfers below 1 BTC climbed to their highest daily level since November 2022 on Friday, with 39,600 BTC moved, according to data shared by CryptoQuant head of research Julio Moreno on Saturday.

The figure was just 300 BTC below the 39,900 BTC transferred on Nov. 16, 2022, days after FTX filed for bankruptcy. “The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse,” Moreno said, adding that he was encouraged to see users “taking action.”

As the suspected Coldcard hack continues to unfold, the incident has become a broader test for Bitcoin self-custody, reigniting debate over whether users are better protected by controlling their own funds or relying on third-party platforms.

Incident ongoing as Galaxy tracks three attack waves

The surge in small Bitcoin transfers came as researchers continued to uncover new victims of the suspected Coldcard hack, which first surfaced in late July and appeared to remain active at the time of publication.

Galaxy Research, the research arm of crypto investment company Galaxy Digital, reported Saturday that the latest identified wave drained an additional 207.7 BTC, worth about $13.2 million. The theft brought estimated losses to 1,367 BTC ($88.6 million) across 4,585 addresses.

Bitcoin drained from Coldcard wallets. Source: Coldcard Watch

Alex Thorn, Galaxy Digital’s head of firmwide research, warned in an X post on Sunday that the attack was still ongoing and urged users to move funds from Coldcard-generated addresses immediately if they had not already done so.

Thorn said his team continued to identify new victim and attacker addresses, adding that reports from users had helped researchers and authorities track stolen funds.

Coldcard incident reignites self-custody debate

The suspected Coldcard hack has reignited debate over the risks and benefits of Bitcoin self-custody, a core principle of crypto that allows users to control their funds without relying on third parties.

Nick Neuman, CEO of Bitcoin security company Casa, pushed back against claims that “self-custody is over,” arguing that its distributed nature gave users time to react. He estimated that potentially 10 times more Bitcoin was protected through self-custody than was stolen and identified in the attack so far.

Related: SecondFi to wind down after $2.6M ADA theft linked to wallet flaw

The debate also drew responses from traditional finance supporters. Eric Balchunas, senior ETF analyst at Bloomberg, argued that Bitcoin exchange-traded funds (ETFs) provide a safer and more convenient alternative for many users, pointing to the long operating history of the ETF industry. Others pushed back, saying the Coldcard incident was a failure of one wallet provider rather than a failure of self-custody itself.

Magazine: A quantum roadmap would push Bitcoin much higher: Charles Edwards

Minnesota’s statewide crypto ATM ban took effect on Aug. 1, 2026, stopping operators from offering virtual currency kiosks after residents reported nearly $1 million in related scam losses. 

Governor Tim Walz signed Senate File 3868 on May 5 after the measure cleared the state legislature.

The law covers machines that exchange cash, bank credit or another virtual currency for crypto. It does not prevent Minnesotans from buying, selling or holding digital assets through lawful online services. The ban took effect as scheduled, with physical removal due by year-end.

Minnesota crypto ATM ban stops kiosk transactions

Under the enacted Minnesota law, businesses may no longer install, operate, maintain or make a crypto kiosk available for use anywhere in the state. Existing machines had to stop processing transactions by Aug. 1, although operators have until Dec. 31 to remove them from locations visible or accessible to the public.

The Minnesota Department of Commerce said it is working with licensed money-service businesses to secure compliance. Assistant Commissioner Sara Payne said the department can take enforcement action, including legal sanctions and civil penalties, against operators that continue offering kiosk transactions. The public and retailers may also report machines that remain operational.

The state had about 350 licensed kiosks operated by roughly eight to 10 companies when the Senate approved the measure in April. The new rule focuses first on whether a machine is available for use, not whether its cabinet remains temporarily inside a store.

Scam losses pushed lawmakers past earlier safeguards

The Minnesota Department of Commerce recorded 134 crypto kiosk scam complaints from 2023 through 2025, with reported losses approaching $1 million. In 2025 alone, the department counted 70 cases, more than $540,000 in losses and an average loss of nearly $6,800 per transaction.

Officials said many schemes involved fake family emergencies, romance scams or criminals impersonating government and law enforcement personnel. Victims were often told to withdraw cash, find a kiosk and scan a QR code controlled by the scammer.

Commerce Commissioner Grace Arnold gave residents a direct warning: “If someone is telling you to act quickly and send money through a kiosk … it’s a scam.”

Minnesota had introduced licensing, transaction limits, disclosures and other kiosk safeguards in 2024. However, state officials said scammers adapted by coaching victims through warning screens and arranging deposits to avoid existing protections.

FBI data shows broader scope than state complaints

Separate FBI data recorded 222 Minnesota complaints involving crypto kiosks in 2025, with adjusted losses of $4.07 million. Those figures are not directly comparable with the state’s 70 cases and $540,000 total because the agencies use different reporting systems and complaint scopes.

The FBI also cautioned that its loss totals may include other transaction methods used in the same scam. Nationwide, the agency received 13,460 kiosk-related complaints involving $388.98 million in adjusted losses during 2025. More than half of the complaints involved people older than 50.

Minnesota’s action forms part of a wider state crackdown. Tennessee banned crypto ATMs from July 1, while Georgia imposed transaction limits, warnings and some refund requirements. Indiana had already adopted a statewide prohibition. In related coverage, Delaware and New Jersey lawmakers advanced similar proposals.

The next binding date is Dec. 31, 2026. By then, operators must remove publicly visible or accessible machines. Kiosk-only operators must also pay customers any money or crypto still held or owed because of earlier transactions, unless another lawful access method remains available.

Customers may request payment in U.S. dollars at market value or transfer to a chosen crypto wallet. A wallet transfer must occur within 30 days of the request and be recorded on the relevant blockchain. Operators must retain proof for the Minnesota commerce commissioner.

The state has taken a different approach to regulated financial institutions.Another Minnesota law effective Aug. 1 allows banks and credit unions to provide crypto custody under risk-management, cybersecurity and notice requirements.

Commerce will now test whether operators disable every kiosk, complete removals and process required customer payouts before year-end. Residents can file complaints with the department when they find a machine that remains available for use.

Decentralized exchange spot trading rose to about 24% of centralized exchange volume in July 2026, according to The Block’s current DEX-to-CEX data series. 

The reading was described as the strongest shown in the current series and continued a broader rise in onchain market share since 2024.

The Block calculates the measure by dividing monthly DEX volume by volume on a selected group of centralized exchanges. Its dashboard includes the top 30 decentralized exchanges by volume from DefiLlama. Therefore, the figure does not mean DEXs handled 24% of combined spot trading. It means DEX activity equaled roughly 24% of the covered CEX total.

DEX spot volume ratio reaches about 24% in July

The July figure followed a faster expansion that began in 2025. The ratio remained below 10% for much of 2024 before rising as traders increasingly used permissionless markets for memecoins, newly issued assets and products unavailable on large centralized platforms.

However, the reading also came during a weaker period for centralized spot trading. Talos reported that total exchange spot volume fell 28% quarter over quarter to $2.32 trillion in the second quarter of 2026. Lower CEX activity can lift the ratio even when DEX volume does not reach an absolute record.

Current DefiLlama data shows that activity remains spread across several networks. Its Aug. 2 trailing 30-day rankings listed Solana at about $49.86 billion, BNB Chain at $31.04 billion, Ethereum at $28.84 billion and Base at $22.38 billion in spot DEX volume. Robinhood Chain added another $14.48 billion over the same rolling period.

New chains and wider token access supported onchain trading

Robinhood Chain was one of July’s clearest new sources of DEX activity. Uniswap Labs announced that Uniswap v2, v3, v4 and UniswapX went live on the network on July 2, one day after its public mainnet launch. The deployment supported crypto assets and Robinhood Stock Tokens through Uniswap’s web app, wallet and API.

CoinDesk Data later estimated that Robinhood Chain averaged about $690 million in daily DEX and aggregator volume over a seven-day period. Activity peaked at $943.6 million on July 11, while Uniswap accounted for about 99.5% of the network’s seven-day DEX volume.

The stock tokens were available in more than 120 countries but were not offered to U.S. users. Early trading also included memecoins rather than being limited to tokenized equities and other real-world assets.

As crypto.news reported, Robinhood Chain drove a sharp increase in Uniswap activity and passed $1 billion in cumulative swap volume during its first ten days. However, the role of speculative tokens makes sustained activity more important than launch-week totals.

Other ecosystems entered July with established onchain liquidity. Solana DEX volume exceeded $800 billion during the first part of 2025, while Jupiter remained a major routing layer for trades.

The “record” description needs a methodology caveat

The claim that July produced the “highest level since tracking began in 2019” requires qualification. The Block’s current chart supports the reported July reading, but older reports from the same publisher described higher figures under earlier versions of its data.

In June 2025, The Block reported that DEXs reached 25% of CEX spot volume during May. One month later, it reported a 29% ratio for June. Both historical figures are above July 2026’s roughly 24% reading.

The difference may reflect historical data revisions, changes in the exchanges counted or adjustments to volume filtering. However, the public description on the current dashboard does not explain why its historical readings differ from the publisher’s earlier articles.

A separate CoinGecko study used a different group of exchanges. It placed DEX spot share at 24.5% in June 2025 before the measure returned to about 13%–14% by January 2026. CoinGecko linked the earlier peak partly to Binance Alpha 2.0 routing trades through PancakeSwap.

CoinGecko’s top-20 exchange coverage and The Block’s current top-30-DEX methodology are not directly interchangeable. July can therefore be described safely as the highest reading in the current cited series. Calling it an uncontested market-wide record would go beyond the available methodology disclosures.

What comes next for the DEX-to-CEX ratio

The August reading will show whether the ratio can remain near one-quarter of covered CEX volume after July’s new-chain activity settles. Traders will also watch whether Robinhood Chain retains its early volume and whether Solana, BNB Chain, Ethereum and Base maintain their current pace.

Absolute volume will matter alongside market share. A rising ratio caused mainly by falling CEX activity would describe a different market structure from one driven by growing DEX liquidity, more users and deeper trading pools. Changes to protocol coverage or the exchanges included in the calculation could also revise historical readings.

No verified token-price move can be attributed solely to July’s ratio. The data shows where spot trades occurred, not why individual assets moved. The next completed monthly datasets should provide a clearer test of whether July marked a durable change or a temporary peak connected to new products and network launches.

South Korea’s five major won-based crypto exchanges recorded 560.3 billion won, about $367 million, in net stablecoin outflows to overseas platforms in June 2026.

The figure extended the country’s uninterrupted outflow run to 18 months.The figures came from Financial Supervisory Service data submitted to People Power Party lawmaker Lee Jong-wook and reported by Yonhap News on Aug. 2. Upbit, Bithumb, Coinone, Korbit and Gopax sent 2.7625 trillion won in stablecoins abroad during June. They received 2.2022 trillion won from overseas exchanges.

South Korean stablecoin outflows reach 560.3 billion won

The latest monthly total continued an uninterrupted net-outflow streak that began in January 2025, when the available data series started. Every month since then, stablecoin withdrawals to foreign exchanges have exceeded deposits returning to the five Korean platforms.

June’s net outflow rose from 477.1 billion won in May but remained below January’s 1.1429 trillion won. The monthly figures show persistent outward movement despite substantial changes in the amounts transferred.

The gap also remained large during the second quarter. Between April and June, net stablecoin outflows reached 1.6872 trillion won. During the same period, Korean retail investors recorded 1.6185 trillion won in net sales of overseas stocks, according to Korea Securities Depository figures cited by Yonhap.

In June alone, overseas stock purchases exceeded sales by $472.54 million, or about 722 billion won using the month’s average exchange rate. Stablecoin net outflows therefore equaled 77.6% of Korean investors’ net overseas stock purchases. However, the comparison does not prove that both flows involved the same investors or strategies.

Overseas derivatives appear to drive stablecoin demand

The report said the transferred stablecoins are “believed to be used mainly” for products unavailable on domestic exchanges. These include crypto and equity derivatives, tokenized real-world assets, decentralized finance services and staking products.

Some overseas platforms offer futures and other leveraged products linked to cryptocurrencies and major Korean stocks, including Samsung Electronics, SK Hynix and Hyundai Motor. However, the FSS figures track transfers between exchanges rather than each wallet’s final activity. The proposed connection to specific products remains an estimate, not a transaction-by-transaction finding.

The overseas shift comes as domestic trading activity has weakened. Crypto.news reported that trading volume across the five major won exchanges fell 54.6% year over year during the first half of 2026. Lower local activity provides context, although the available data does not establish it as the cause of the overseas transfers.

Investor protection pressure meets delayed legislation

Lee called for faster safeguards, saying investors were “being left defenseless against high-risk derivatives on foreign exchanges.” He asked the government to review its investor protection and management framework as more funds move offshore.

South Korea is already working on broader digital asset rules. At a March 4 Virtual Asset Committee meeting, the Financial Services Commission discussed exchange internal controls, security standards, strict compensation duties and possible rules for stablecoin issuers. The commission said it planned further consultations before legislation moved forward.

However, the details remain unsettled. In January, the FSC cautioned that major provisions covering stablecoin issuers and ownership structures had not been finalized.

More recently, as crypto.news reported, the regulator told lawmakers it intended to prepare a consolidated Digital Asset Basic Act covering stablecoins, exchanges, disclosures and operational controls.

The next monthly exchange data will show whether July extended the outflow streak to 19 months. Regulators may also face pressure to distinguish ordinary cross-border transfers from flows connected to leveraged derivatives, DeFi and other higher-risk services.

For now, the June figures document movements between Korean and overseas exchanges. They do not identify individual users, destination platforms or final investments. Any policy response will depend on further regulatory reviews and progress on the Digital Asset Basic Act.