Everything under one login

Round-the-clock trading is one part of the plans exchanges have for traditional assets. Coinbase and Binance want customers to trade crypto, stocks and other products through one account, a model both have described as an “everything exchange” or financial super app.

Coinbase is preparing to offer U.K. customers equities and derivatives alongside crypto after securing investment-services authorization from the Financial Conduct Authority under rules based on the Markets in Financial Instruments Directive, or MiFID.

The authorization allows Coinbase to offer traditional shares to retail customers and crypto, equity and commodity perps to eligible institutional and advanced traders, the company said.

“Perpetual futures are a core focus of what Coinbase is trying to bring to market,” said Keith Grose, U.K. CEO at Coinbase, in an interview with CoinDesk. “We’re really focused on being the ‘everything exchange.’”

Grose said the longer-term plan is to bring spot crypto, perpetual futures, traditional equities, and eventually tokenized versions of other assets into one place. That could allow customers to use positions across different markets as collateral or borrow against their equities.

Using stocks as collateral

Binance is testing another part of the model by allowing some high-net-worth clients to use tokenized stock positions as collateral for other trades.

“We recognize you could have Nvidia or SpaceX stock, a tokenized version,” Jan said. “You could actually have a tokenized stock put on our exchange, and we’ll use that as collateral for you to trade something else. It could be a crypto derivative.”

Trump Media-linked wallets transferred 2,628 Bitcoin, valued at about $165 million, to Crypto.com on Aug. 2, according to on-chain analysts Lookonchain.

The movement reportedly reduced the wallets’ remaining balance to about 4,261 BTC.Lookonchain described the movement as another sale and estimated that Trump Media had disposed of 7,281 BTC over seven months. However, neither Trump Media nor an SEC filing had confirmed the latest coins were sold as of Aug. 2. An exchange deposit can precede a sale, custody change, collateral arrangement or another internal transaction.

Advertisement

Trump Media transfer is not a confirmed sale

Lookonchain said the company originally acquired 11,542 BTC for about $1.37 billion, averaging $118,522 per coin. Its post stated, “It looks like Trump Media sold another 2,628 BTC,” wording that reflects uncertainty about the final transaction.

EmberCN separately traced the 2,628 BTC to Crypto.com and estimated that the linked wallets had transferred out about 7,281 BTC. The Arkham entity page identified two recent movements totaling roughly 2,628 BTC, including transfers of about 2,429 BTC and 198.9 BTC.

Source: Akham

Remaining Bitcoin nearly matches pledged collateral

Trump Media’s latest quarterly filing provides the strongest company-confirmed baseline. The company reported 9,542.16 BTC at March 31, with a cost basis of $1.131 billion and a fair value of $647.1 million. It recorded no change in the number of coins during the first quarter.

The SEC filing also said 4,260.73 BTC served as collateral for convertible notes and could not be withdrawn or distributed unless indenture requirements were met. The restrictions are scheduled to end no later than May 29, 2028.

Advertisement

The reported post-transfer balance of about 4,261 BTC almost exactly matches that pledged amount. This suggests the tracked wallets may now mainly contain restricted collateral, but the on-chain labels do not prove the accounting or legal status of each coin.

The $555M loss remains an outside estimate

Lookonchain calculated that the 7,281 BTC left the linked wallets at an average price of $74,855, generating about $545 million. It then estimated Trump Media’s combined realized and unrealized Bitcoin loss at approximately $555 million.

Those figures are not company-confirmed. The calculation assumes exchange transfers became sales near the observed market prices. It also combines estimated losses on transferred coins with the paper loss on the remaining balance. Trump Media’s March filing confirmed a lower fair value, but said the company had not realized material digital-asset losses at that reporting date.

Trump Media transferred 2,650 BTC worth about $205 million to Crypto.com on May 22. The coins remained in an exchange-linked wallet when that report was published, showing why a transfer should not automatically be reported as a completed sale.

Advertisement

Truth API launch adds separate regulatory scrutiny

The Bitcoin movement followed Trump Media’s Aug. 1 launch date for Truth API, a paid service providing institutional customers with low-latency access to influential Truth Social posts. The company said the product delivers posts in milliseconds and could create a recurring revenue stream. Its revenue expectations remain forward-looking claims.

U.S. Senators Adam Schiff and Elizabeth Warren asked the SEC to investigate whether the service could violate federal securities laws. Their letter raised concerns that paying firms could receive market-moving presidential posts faster than ordinary users. The request is not an SEC finding, and the agency had not publicly announced an enforcement action.

Crypto.news reported that Trump Media posted a $405.9 million first-quarter net loss, partly reflecting unrealized markdowns across Bitcoin, Cronos and securities.

The company’s next quarterly filing should clarify whether the May and August transfers were sales, custody movements or transactions linked to hedging and financing arrangements. No verified Bitcoin or DJT price movement can be attributed solely to the Aug. 2 transfer.

Advertisement

Bitcoin Improvement Proposal 110 can no longer reach its 55% voluntary miner threshold during the current difficulty period, according to blockchain signaling data and an Aug. 1 analysis from Strategy Executive Chairman Michael Saylor. 

Strategy’s official website identifies Saylor as the company’s executive chairman. At block 960,561, Saylor counted 24 signaling blocks among 946, equal to 2.54%. He said every signal came from miners using DATUM while sharing rewards through OCEAN, with none identified outside that system. By 11:13 UTC on Aug. 2, the public BIP-110 monitor had advanced to block 960,723 and counted 28 signals among 1,108 blocks, or 2.53%. Only 908 blocks remained.

BIP-110 cannot reach voluntary lock-in

The proposal needs 1,109 signaling blocks within one 2,016-block difficulty period to lock in voluntarily. Even if every remaining block in the current period signals, the total could reach only 936. Saylor therefore said the threshold was “mathematically unreachable” and argued that the observed count was “not miner consensus.”

The latest monitor supports that arithmetic. However, it does not independently establish Saylor’s attribution of every signaling miner. His pool claim applied to the 24 blocks examined at block 960,561. The monitor confirms that the overall rate remained almost unchanged after four additional signals appeared.

BIP-110 would restrict Bitcoin transaction data

BIP-110, formally called the Reduced Data Temporary Softfork, proposes seven temporary consensus restrictions. These include limiting most new output scripts to 34 bytes, capping OP_RETURN outputs at 83 bytes, restricting certain data pushes to 256 bytes and temporarily limiting several Taproot features. Outputs created before activation would remain exempt.

Supporters say the one-year rules would reduce arbitrary data storage and keep Bitcoin focused on monetary activity. Critics, including Saylor and Blockstream co-founder Adam Back, argue that consensus rules should not determine which currently valid transaction structures deserve block space. As previously reported, Saylor said fee markets and individual node policies offer a safer response to disputed data use.

Saylor questions OCEAN and DATUM’s role

Saylor also alleged that OCEAN made BIP-110 signaling the default on an existing endpoint. He called the initiative a “vertically integrated marketing campaign for Knots and OCEAN/DATUM.” That description represents his interpretation rather than a finding by an independent technical body.

The official BIP-110 installation guide directs users toward Bitcoin Knots and includes instructions for pointing rented hashpower at a DATUM node. OCEAN’s DATUM documentation says miners create block templates through their local nodes, while the pool coordinates reward splits instead of constructing mining work. Those documents confirm the technical relationship, but they do not independently establish Saylor’s claim about promotional intent.

Mandatory signaling becomes the next test

The current voluntary period ends at block 961,631. From block 961,632 through 963,647, software enforcing BIP-110 is designed to reject every block that does not signal bit 4. The proposal would then lock in at block 963,648 and activate at block 965,664, when its transaction restrictions would begin for 52,416 blocks.

Saylor warned that any 100% signaling reading during the mandatory window would reflect the software rule rather than a fresh vote of support. Foundry USA Pool has separately asked its mining customers to vote on whether the pool should signal, with its voting window scheduled to close near block 961,632. No verified result was publicly available by Aug. 2.

The next decisive evidence will come from major mining pools, exchanges, wallets and node operators before the mandatory period starts. Low voluntary signaling does not automatically cancel BIP-110 because its deployment includes mandatory signaling. However, enforcing nodes could follow a minority chain if most hashpower continues mining non-signaling blocks. Saylor and Back warned that enforcing the proposal without broad agreement could divide the network.

Bitcoin has seen a spike in very small transfers—moves of less than 1 BTC—that match the intensity last observed around the collapse of FTX. The renewed activity comes as researchers continue to track a suspected Coldcard wallet-related hack, underscoring how quickly users are reacting when self-custody tools appear compromised.

According to CryptoQuant head of research Julio Moreno, Friday recorded the highest daily level of sub-1 BTC transfers since November 2022, with 39,600 BTC moved. The total was just 300 BTC below 39,900 BTC transferred on Nov. 16, 2022, shortly after FTX filed for bankruptcy. Moreno framed the comparison as a sign of urgency and said users appear to be “taking action.”

Key takeaways

• Daily Bitcoin transfers below 1 BTC hit their highest level since November 2022, totaling 39,600 BTC, per CryptoQuant’s Julio Moreno.
• Galaxy Research says the suspected Coldcard incident caused estimated losses of 1,367 BTC across 4,585 addresses, after identifying a further 207.7 BTC taken in an additional wave.
• Galaxy’s Alex Thorn warned that the attack was still ongoing and urged affected users to move funds immediately from Coldcard-generated addresses.
• The incident is reigniting debate over whether self-custody is safer than relying on third-party platforms, with executives arguing the impact differs across user approaches.

Small-transfer surge echoes the post-FTX era

While large market moves often capture headlines, the current data point focuses on behavior at the granularity of everyday wallet operations: sub-1 BTC transfers. Moreno’s analysis suggests the market is seeing a level of small withdrawals not observed since the period following FTX’s bankruptcy filing.

The comparison matters because it points to reflexive user behavior—moving funds in smaller increments—rather than a single, coordinated “whale” action. In the wake of FTX, exchange-related uncertainty drove users toward faster, more defensive moves. Here, the catalyst is different: ongoing concerns tied to Coldcard-generated addresses.

Moreno’s observation that these transfers had not occurred at similar daily intensity since the FTX collapse suggests that the Coldcard incident may be triggering a comparable sense of immediate risk. That doesn’t prove equivalence in scale or cause, but it does show that user reaction can look similar even when the underlying event is distinct.

Galaxy Research details additional theft wave

Galaxy Research, part of Galaxy Digital, reported Saturday that it had identified another attack wave tied to the suspected Coldcard hack. In that wave, an additional 207.7 BTC was drained—valued at roughly $13.2 million at the time Galaxy cited.

Including the newly identified activity, Galaxy estimated total losses of 1,367 BTC, affecting 4,585 addresses. Galaxy’s reporting suggests the incident is not a single moment of exploitation, but an ongoing process where both victims and attacker infrastructure continue to emerge as investigators refine their tracking.

Galaxy also points readers to a Coldcard-focused tracking resource, “Coldcard Watch,” as part of the broader transparency around wallet activity connected to the suspected incident.

“Still ongoing” warnings push users toward immediate withdrawal

Alex Thorn, Galaxy Digital’s head of firmwide research, said in an X post on Sunday that the attack remained active. Thorn urged users to move funds from Coldcard-generated addresses immediately if they had not already done so.

Thorn added that his team continues to identify both new victim addresses and attacker addresses. He also noted that reports from users have helped investigators and authorities track stolen funds, reinforcing a practical implication for readers: in incidents where on-chain patterns are evolving, user-provided information can accelerate investigative work.

The warning is also a reminder that self-custody isn’t only about holding assets—it’s about operational readiness. When wallet-generated addresses are implicated, the “time to react” becomes part of the security model, whether users follow best practices or not.

Self-custody debate returns as commentators argue “failure” vs “risk control”

The suspected Coldcard hack has again pulled the conversation toward the long-running fault line in crypto security: self-custody versus third-party custody. Self-custody is a foundational principle in Bitcoin, emphasizing user control without dependence on intermediaries. Yet security incidents involving consumer-grade tools can complicate the narrative and raise fresh questions about usability and safety.

Nick Neuman, CEO of Bitcoin security company Casa, pushed back against claims that “self-custody is over.” He argued that because self-custody is distributed, users have time to respond as threats are identified. Neuman also estimated that potentially 10 times more Bitcoin was protected through self-custody than was stolen and identified so far in the attack.

That position reframes the debate from whether an incident can occur at all to how the system responds once the risk becomes visible. In Neuman’s view, the existence of ongoing victims does not negate the defensive advantage that self-custody can provide—especially when users monitor, verify, and act on warnings.

Others took the issue in a different direction. Eric Balchunas, a senior ETF analyst at Bloomberg, argued via X that Bitcoin exchange-traded funds may offer a safer and more convenient alternative for many users, pointing to the longer operating history of ETFs.

In contrast, critics of that argument say the Coldcard episode reflects a failure of a specific wallet provider or implementation rather than a fundamental breakdown of self-custody itself. The tension here is important for readers to recognize: “self-custody” is not a single technology—it’s a set of practices and tools—so incidents can be interpreted as either systemic or localized depending on what readers believe broke down.

What to watch next

With Galaxy saying the attack is still unfolding and continuing to identify new victim and attacker addresses, the next key signal will be whether transfer patterns and wallet-specific indicators stabilize as users move funds. For investors and builders, the bigger question is how quickly the broader community can validate affected addresses and coordinate response—because in cases like this, speed is part of the security outcome.

“Seems people really moved their Bitcoin out of extreme caution after the coldcard hack,” Moreno said.

Small Bitcoin transactions tell a similar story. According to CryptoQuant, the combined volume of all transfers smaller than 1 BTC reached 39,600 BTC on Friday, just shy of the 39,900 BTC moved on November 16, 2022, the day after FTX filed for bankruptcy.

“The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse,” Moreno said, adding that he liked to see people “taking action.”

Blockchain sleuth Timechainindex made a similar observation, noting that total net inflows to exchanges totaled 11,163 BTC on July 31, most of which flowed into major exchanges and firms like Binance, River, Kraken, and OKX.

“These are plebs who are scared,” the handle said on X, explaining the nature of the BTC inflow.

The total number of BTC held in wallets tied to centralized exchanges has increased to 2.715 million from 2.703837 million before the Coldcard exploit.

Reverse of FTX

Following FTX’s failure, the dominant risk was exchange insolvency and withdrawal freezes. Holders responded by moving bitcoin into self-custody, reducing exchange balances.

The current episode centers on self-custody risk associated with a single hardware wallet. The vulnerability has prompted some holders to temporarily shift smaller balances onto exchanges.

BNB Chain said on Aug. 1 that it was pursuing legal action against a former employee who allegedly retained unauthorized access to a seed phrase and later used the associated wallet address with a new memecoin. 

The network said it was cooperating with authorities but did not identify the individual, jurisdiction, agency or court.

The wallet was created for a company video tutorial showing how to generate a token, according to BNB Chain’s statement. The organization said the former employee later generated a new private key from the retained seed phrase. It denied creating, authorizing, promoting or participating in the new token.

BNB Chain distances itself from ASTEROID

BNB Chain described the address’s later use as independent activity and said the token was not affiliated with or endorsed by the ecosystem. Its announcement did not provide a complaint, case number, named regulator or details about where the planned legal action would be brought.

Changpeng “CZ” Zhao reposted the statement and called the former employee “basically a scammer,” while telling users to “Stay SAFU.” His description is an allegation, not a court finding. BNB Chain did not disclose whether it is seeking asset recovery, damages or criminal charges.

Four wallets allegedly controlled nearly 80% of supply

On-chain analytics account Lookonchain linked the launch to a token called Asteroid Shiba, or ASTEROID. It alleged that four newly created wallets spent about $10,000 to acquire 796.7 million tokens, equal to 79.67% of the stated one billion-token supply.

Lookonchain said the wallets later sold 718.8 million ASTEROID for 1,103 BNB, valued at about $638,000, producing an estimated $628,000 profit. It published the four addresses for review on BscScan. However, blockchain records show wallet activity, not the legal identity controlling it. The employee attribution therefore remains an allegation supported by BNB Chain’s statement and Lookonchain’s analysis.

A seed can generate the private keys used within a deterministic wallet. Removing one private key from a device does not invalidate a retained copy of the underlying seed, which can be used to derive wallet keys again. The case raises questions about how tutorial wallets and recovery phrases were handled when employees left.

BNB Chain has not disclosed when the employee departed, how long the seed remained accessible or when it discovered the retained access. It also has not said whether other tutorial wallets are under review.

Crypto.news reported in 2025 that Binance suspended an employee following an investigation into alleged token front-running involving knowledge from a previous BNB Chain role. The latest statement does not say whether the incidents involve the same person.

Separately, as crypto.news reported, investigators have used fresh wallet clusters and concentrated ownership to examine suspected memecoin manipulation. Such patterns can establish connections between addresses, but identity claims may still require exchange records or other off-chain evidence.

Legal action and wallet tracing come next

BNB Chain said it is working with relevant authorities, but its statement did not name an agency that had opened an investigation. A formal complaint or enforcement notice would clarify the legal claims, venue and requested remedies. Until then, the company statement and on-chain analysis remain the main public records.

The wallets and any destinations receiving the 1,103 BNB may provide a trail for investigators. Recovery would depend on whether funds reach identifiable exchange accounts or services able to respond to lawful requests. BNB Chain has not announced a freeze, recovery or repayment.

No token-price reaction is included because multiple assets use the ASTEROID name and BNB Chain did not publish a contract address. Using market data for another token could misstate the event. The next verified development would be a company update, regulator notice or public court filing.