Crypto World
What are RWA perpetuals? Stock and commodity perps
Crypto exchanges now let you trade Tesla, gold, oil, and even pre-IPO companies like SpaceX and OpenAI as perpetual futures, around the clock, with leverage, without owning a single share. This guide explains how RWA perpetuals work, how a contract tracks an asset the blockchain cannot see, what happens when the stock market closes and the perp does not, and the real risks behind the most ambitious expansion perps have ever attempted.
Summary
- RWA perps bring crypto-style perpetual futures to off-chain assets like stocks, commodities, currencies, and private companies.
- These contracts provide price exposure only, not ownership, dividends, votes, or any claim on the underlying asset.
- The oracle is the core risk layer because it decides what off-chain price the contract tracks and what price can liquidate traders.
- Closed-market gaps make stock and commodity perps structurally different from crypto perps that trade against live spot markets 24/7.
- RWA perps are best understood as trading and hedging instruments, not long-term substitutes for owning stocks or tokenized shares.
The most traded instrument in crypto has started eating the rest of finance. Perpetual futures, the leveraged, never-expiring contracts that dominate crypto volume, are no longer limited to Bitcoin and Ethereum: on a growing list of venues you can now open a leveraged position on Tesla stock at 3 a.m. on a Sunday, short gold from a self-custodied wallet, or trade contracts tracking companies like SpaceX, OpenAI, and Anthropic that have never listed on any stock exchange at all. Coinbase’s rollout of pre-IPO perpetuals on exactly those names made headlines this month, and decentralized venues have quietly listed perps on US equities, indices, foreign exchange, and commodities for over a year.
These instruments are called RWA perpetuals, perps on real-world assets, and they represent something truly new: synthetic, around-the-clock, globally accessible exposure to assets that live entirely outside crypto, delivered through contracts that never touch the underlying. No shares are bought, no gold is vaulted, no barrel of oil changes hands. The entire construction rests on a price feed and a payment mechanism, which is either an elegant triumph of financial engineering or a stack of risks wearing a stock ticker, depending on which part of it you are looking at.
This guide explains RWA perps from first principles: what they are and how they differ from ordinary crypto perps and from tokenized stocks, the oracle machinery that lets a blockchain track an off-chain price, the strange problems that arise when a 24/7 contract tracks a market that closes on weekends, the pre-IPO frontier where perps track companies with no public price at all, the legal battle over what these contracts even are, and the honest risk list anyone should read before trading equity exposure inside a crypto venue.
Perps in one paragraph, and what changes with RWAs
A perpetual future is a derivative contract that lets a trader take a leveraged long or short position on an asset’s price and hold it indefinitely, because unlike a traditional future it never expires. Its price is tethered to the real asset’s price by the funding rate, a recurring payment between longs and shorts that nudges the contract back toward the underlying whenever it drifts: trade above the reference price and longs pay shorts, encouraging selling; trade below and shorts pay longs. Margin collateralizes the position and liquidation closes it if losses approach the margin posted. If any of that machinery is unfamiliar, the full plain-English guide to perps, funding, and liquidations is the place to start, because everything below assumes it.
Now change one word. A Bitcoin perp tracks an asset that trades on the same rails, around the clock, with deep on-chain and exchange price sources. An RWA perp tracks an asset that trades somewhere else entirely: a stock on Nasdaq, gold in London, oil in futures pits, a currency in the interbank market. The contract mechanics are identical, the same funding rate, the same margin, the same liquidation engine, but the reference price now comes from outside crypto, through an oracle, from a market with its own opening hours, holidays, halts, and corporate events. Every distinctive property of RWA perps, good and bad, flows from that single change. The trader gets exposure to Apple without a brokerage account, without owning shares, without market-hours restrictions, and without the venue holding any Apple at all; the trade-off is that the entire product is only as good as the price feed and the venue’s handling of the moments when the real market is dark.
It is worth separating RWA perps cleanly from their tokenized cousins, because the two are constantly conflated. A tokenized stock is a claim: somewhere, an issuer holds real shares and mints tokens representing them, with custody, redemption, and dividend questions attached. An RWA perp is not a claim on anything; it is a bet settled in stablecoins whose size happens to be indexed to a stock’s price. You cannot redeem a perp for a share, you receive no dividends, and you own nothing except a margin position. The perp’s advantage is precisely that it needs no custody chain, no share purchases, and no issuer, which is why perps on real-world assets scaled faster than tokenized versions of the same assets; its limitation is that it delivers only price exposure, nothing else a share provides.
The oracle problem: teaching a blockchain the price of Tesla
A blockchain cannot see Nasdaq. Every RWA perp therefore depends on an oracle, infrastructure that fetches off-chain prices and delivers them on-chain, and the oracle design is the single most important line in any RWA perp’s documentation, because it determines what price you are liquidated against.
Serious implementations layer defenses. Prices are pulled from multiple independent sources, exchange feeds, institutional data providers, aggregators, and combined into an index price so no single source can be spoofed. The contract then computes a mark price, typically a smoothed or median-filtered version of the index, and it is the mark price, not the last trade on the venue itself, that drives liquidations, so a momentary wick on the perp’s own order book cannot cascade positions. Funding is computed from the gap between the perp’s trading price and the index. All of this mirrors crypto-perp best practice; the RWA twist is that equity and commodity data is licensed, paywalled, and published on the real market’s schedule, so oracles for stocks tend to involve professional data vendors and update rules for what to publish when the source market is closed.
The failure modes are exactly what you would guess. A stale feed liquidates traders against yesterday’s price; a manipulated thin source poisons the index; a decimal error in one vendor’s print, without median filtering, becomes a mass liquidation event. These are not hypotheticals in DeFi’s history, oracle failures are among its most reliably recurring disasters, and the diligence question for any RWA perp venue is boringly specific: how many sources, what aggregation, what staleness rules, and what happened the last time one input misbehaved.
When the market sleeps and the perp does not
Here is the genuinely novel problem RWA perps introduced, one crypto perps never had: the underlying market closes. Nasdaq trades six and a half hours a day, five days a week; the perp trades every hour of every day. For roughly two-thirds of the perp’s life, there is no live reference price at all.
What happens in the gap is price discovery in reverse. During market hours, the perp follows the stock. Overnight and on weekends, the perp becomes the only live market for that exposure, and it drifts on crypto-native flows, news, and speculation, anchored only by traders’ expectations of where the stock will open. Then comes Monday’s open, and the stock either validates the weekend perp price or gaps away from it, at which point funding and arbitrage violently reconcile the two. Traders who study these venues have observed that weekend equity-perp prices function as a real-time forecast of Monday’s open, which is fascinating for researchers and dangerous for the overleveraged: a position that survives the whole weekend can be liquidated in the first minute of the cash session when the reference price jumps to reality.
Corporate actions add a second layer of housekeeping crypto never needed. Stocks split, pay dividends, get halted, and get delisted. A 10-for-1 split must be handled by adjusting the contract or the index, or every position would instantly show a 90% move; dividends create predictable price drops the perp must account for, typically through funding adjustments, since perp holders receive no dividend; a trading halt in the underlying leaves the oracle publishing nothing while the perp keeps trading. Every serious RWA-perp venue has written rules for each event, and the difference between venues is largely the quality of those rules, which nobody reads until the day they matter.
Where RWA perps trade, and how the peg holds in practice
The venue landscape splits along the same centralized-versus-decentralized line as the rest of crypto, with the decentralized side, unusually, having led. On-chain perp exchanges pioneered equity and forex perps because listing a new market there requires an oracle feed and a risk parameter file, not a licensing negotiation: Hyperliquid, the dominant on-chain perp venue with roughly 70% of decentralized open interest, lists perps across crypto, US equities, indices, foreign exchange, and commodities, and peers like dYdX and GMX cover overlapping ground. The centralized side arrived with 2026’s regulatory thaw, Coinbase’s CFTC-supervised perp products and pre-IPO contracts being the landmark, and carries the opposite trade-offs: eligibility gating and custody of your margin, in exchange for regulated recourse and deeper fiat integration. The decentralized share of total perp open interest has climbed to roughly 13.5% from under 4% a year earlier, and RWA listings are a visible driver, because the assets people most want to trade at 3 a.m. are precisely the ones whose official markets are closed.
It is worth dwelling on how the peg actually holds for an RWA perp, because the mechanism is subtler than for crypto perps. With a Bitcoin perp, arbitrageurs enforce the peg directly: if the perp trades rich, they short it and buy spot Bitcoin, a riskless-ish basis trade available around the clock. With a stock perp, the spot leg is only available during market hours, so during the trading day the peg is enforced by the same basis arbitrage, brokerage account on one side, perp on the other, and it holds tightly. Overnight, the arbitrage is unavailable, and the only tether is the funding rate pushing against crowd positioning plus traders’ willingness to fade a drift they expect the open to punish. The result, visible in the data, is a peg that breathes: tight during cash sessions, loose and expectation-driven outside them, snapping taut at each open. Traders who internalize that rhythm stop being surprised by it; funding on equity perps also inherits the rhythm, often resetting sharply around opens as the reconciliation happens.
One further mechanical note: margin and settlement on RWA perps are almost universally in stablecoins, which means a trader’s collateral is exposed to stablecoin risk on top of position risk, and profits on a Tesla short arrive as USDC, not as anything resembling a brokerage balance. The entire experience is crypto-native from margin to settlement; only the price is borrowed from the outside world.
The frontier: perps on companies with no price
The strangest members of the family are the pre-IPO perpetuals, contracts tracking private companies, SpaceX, OpenAI, Anthropic, that have no exchange-listed price to reference at all. Here the oracle question becomes almost philosophical: what does the contract track? In practice, venues construct reference prices from private-market data, secondary-share transaction reports, disclosed funding rounds, and administrator judgment, published as an index that updates far less frequently and far less verifiably than any stock feed. The funding mechanism then tethers the perp to that constructed number.
The appeal is obvious and real: exposure to the most coveted private companies on earth has historically been reserved for venture funds and accredited insiders, and a perp democratizes at least the price bet. The caveats deserve equal billing. The reference price is an estimate with wide error bars, not a market print; liquidity in these contracts is thin relative to major perps; the gap between a private valuation and an eventual IPO price can be enormous in either direction; and a trader is ultimately taking positions against a number a small set of parties assembles. It is the frontier, with everything that word implies, and its emergence within regulated American venues in 2026 says as much about the regulatory moment as about the product.
What the law says a perp is
That regulatory moment is its own story, because RWA perps sit precisely on the fault line American law is redrawing. Perpetual futures spent a decade as an offshore product, and 2026 is the year they came onshore: the CFTC approved US-regulated perpetual contracts, Coinbase secured routes to offer perp-style products to eligible American customers, and equity and pre-IPO perps followed. Immediately, the definitional fight began, most visibly in litigation between CME and the CFTC over what legally distinguishes a perpetual from the dated futures the incumbent exchanges have licensed for decades. The answer matters commercially, an instrument classified one way slots into existing licensing regimes and another way does not, and it matters for RWA perps most of all, because a perp on a stock brushes against securities law in ways a perp on Bitcoin does not. The broader classification architecture being decided in Congress, mapped in this publication’s guide to the pending market-structure law, will determine which agency’s rules these products ultimately live under, and traders should treat the current arrangements as provisional. Meanwhile the traditional-finance side is converging from the other direction, with the DTCC piloting tokenized versions of the very equities these perps synthesize, a pincer movement whose endpoint, real assets and synthetic exposure sharing on-chain rails, is visible even if its timeline is not.
A brief sizing note grounds all of this. Perpetual futures as a class did roughly $61 trillion of volume in 2025 with daily totals routinely above $100 billion, several multiples of spot; RWA contracts are a young single-digit share of that machine, growing from a base near zero two years ago. The scale of the host explains the stakes: even a modest share of perp flow migrating to equity and commodity tickers represents volume that rivals mid-sized national stock exchanges, arriving on rails no securities regulator designed.
Who actually uses RWA perps
The user base sorts into recognizable types, and knowing them clarifies what the product is for. The largest group is access-constrained traders: people in jurisdictions without cheap brokerage access to US equities, for whom a perp on an index or a mega-cap is the first practical route to that exposure at all, leverage aside. The second is the crypto-native hedger: a fund or treasury holding volatile crypto that wants to offset macro exposure, short an index against a token portfolio, hedge dollar strength through forex perps, without opening brokerage relationships and moving capital across the fiat border. The third is the weekend and event trader, using the perp’s always-open market to position around news that breaks when exchanges are closed, earnings leaks, geopolitical shocks, Sunday-night macro, accepting gap risk in exchange for being early. The fourth is the basis and funding trader, harvesting the structural spreads between the perp, the underlying, and the calendar of opens and closes, the professionals for whom the peg’s breathing rhythm is not a hazard but the product itself.
What the list conspicuously lacks is the buy-and-hold investor, and that is the honest boundary of the instrument. A perp position pays funding indefinitely, carries liquidation risk permanently, and confers no ownership; holding one for months as a stock substitute is almost always dominated by simply owning the stock or its tokenized form. RWA perps are a trading and hedging instrument that happens to wear equity tickers, not an investment product, and most of the grief in the category comes from users who mistook one for the other.
The honest risk list
Everything above condenses into a short list anyone should hold against the marketing.
First, you own nothing. An RWA perp delivers price exposure, not shares, dividends, votes, or any claim; in a venue insolvency you are an unsecured creditor of a margin balance. Second, the oracle is the product; a perp on Tesla is really a perp on someone’s Tesla price feed, and its integrity ceiling is the feed’s. Third, the closed-market gap is a structural hazard: weekend positions carry reconciliation risk at every open, and leverage that feels safe on Saturday can be fatal at 9:30 on Monday. Fourth, all the ordinary perp dangers apply at full strength, funding costs that erode crowded positions, liquidation mechanics that work exactly as brutally here as everywhere else, and thin order books where large orders suffer meaningful execution costs. Fifth, the legal ground is actively shifting, and products available today may be restructured, restricted, or geofenced tomorrow.
Against those risks stands what RWA perps genuinely deliver: the first globally accessible, always-open, self-custodial route to price exposure on the world’s most important assets, with shorting and leverage included, no brokerage gatekeeping, and settlement in stablecoins. That is not a small thing, and it explains why volume has arrived faster than infrastructure maturity. The sensible posture is the one perps have always demanded, respect the leverage, know your liquidation price, read the contract specifications, and add the RWA-specific habits: check the oracle design, check the corporate-actions policy, and never carry a weekend position sized for a market that cannot gap.
The larger meaning of the category is worth one closing paragraph. RWA perps are the first instrument through which crypto’s market structure, rather than its assets, went global: what is being exported is not a coin but a way of trading, continuous, self-custodial, leverage-native, and settled in stablecoins, applied to the underlyings the rest of the world already cares about. Whether that export ends with crypto venues capturing equity flow, or with traditional exchanges adopting perpetual mechanics and around-the-clock sessions to repatriate it, and the incumbents’ own moves toward continuous clearing suggest the second path is live, the direction of convergence is set. The trader’s edge, for now, lies in understanding both worlds at once: the perp machinery crypto built, and the market-hours, corporate-actions, oracle-fed reality of the assets it has annexed.
Disclaimer: This article is for educational purposes only and does not constitute investment advice. Perpetual futures are high-risk leveraged instruments and you can lose your entire margin. Product availability and regulation vary by jurisdiction and are changing rapidly as of July 8, 2026. Always do your own research.
Frequently asked questions
What is an RWA perpetual in simple terms?
An RWA perpetual is a crypto-style perpetual futures contract whose price tracks a real-world asset, a stock, a commodity, a currency, or even a private company, instead of a cryptocurrency. It lets you take a leveraged long or short position on that asset’s price, around the clock, without owning it, with the contract kept in line by funding payments against an oracle-delivered reference price.
How is an RWA perp different from a tokenized stock?
A tokenized stock is a token backed by real shares held somewhere by an issuer, a claim you can in principle redeem. An RWA perp is backed by nothing; it is a margin bet whose payoff is indexed to the asset’s price. Perps offer easier leverage, shorting, and no custody chain; tokenized stocks offer actual ownership economics like dividends. They solve different problems and carry different risks.
Do I receive dividends from a stock perp?
No. Perp holders own no shares and receive no dividends, votes, or corporate rights. Venues typically account for dividends through index or funding adjustments so that the predictable price drop on the ex-dividend date does not unfairly transfer money between longs and shorts, but no dividend is ever paid to you.
What happens to my stock perp when the market is closed?
The perp keeps trading. With no live reference price, it floats on traders’ expectations of where the stock will reopen, effectively becoming a forecast market. When the real market opens, the reference price jumps to reality and funding and arbitrage pull the perp into line, which can be violent if news broke during the closure. Overleveraged weekend positions are the classic casualty.
How can there be a perp on a private company like SpaceX?
The venue constructs a reference price from private-market data such as secondary transactions and funding rounds, and the perp’s funding mechanism tethers the contract to that constructed index. It provides otherwise unavailable exposure, with the major caveat that the reference price is an estimate rather than a market print, updated less often and less verifiably than any stock feed.
Are RWA perps legal in the United States?
The landscape shifted in 2026 as the CFTC approved US-regulated perpetual contracts and major venues brought perp-style products onshore, including equity and pre-IPO contracts for eligible customers. Classification disputes are active, including litigation over how perps differ from dated futures, and pending market-structure legislation will shape the final rules, so availability depends on venue, product, and jurisdiction and should be verified rather than assumed.
What is the biggest risk specific to RWA perps?
The oracle and the closed-market gap. Your position is marked and liquidated against a constructed reference price, so feed quality is everything, and when the underlying market is closed the perp can drift far from where the asset will actually reopen. Both risks come on top of the standard perp dangers of leverage, funding costs, and liquidation.
Can I get liquidated while the stock market is closed?
Yes. The perp trades and marks positions continuously, so a weekend move in the perp’s mark price can liquidate you before the underlying market ever opens. Equally, a position can survive the weekend and be liquidated instantly at the open when the reference price gaps. Sizing for the gap, not for the calm, is the core discipline.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
The flaw allowing the exploit traces to a March 2021 firmware build that routed seed generation to a predictable software randomizer instead of the chip’s hardware one, leaving the resulting keys reproducible offline by anyone who works out the range. Coldcard manufacturer Coinkite released emergency firmware for every affected model and told users who had generated a seed on the flawed software to move funds to a wallet address made with a fresh one.
Thorn said he had no direct victim report and published his findings on pattern matching alone, choosing speed over confirmation to warn people while the transactions were still unconfirmed.
If it holds, however, the running total across four waves had reached about 1,816 bitcoin, near $114 million, from more than 5,200 addresses since July 30.
Thorn advised users to check funds, move anything off an affected device and bid the fee up.
The pattern covered blocks 960,778 to 960,792, with 218 transactions hitting 462 victim addresses at a rate of about 14 sweeps per block against 0.3 in a pre-incident control window, roughly 45 times normal.
Each of the spent coins that arrived after the Coldcard firmware boundary, and the destinations were fresh addresses with no prior history, one per victim rather than the shared collectors that made the first two waves easy to map.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
Learn how to choose the best crypto payment gateway for businesses by comparing settlement, compliance, integrations, automation, and fees in 2026.
Companies serving international customers, digital-first audiences, or markets with limited card and bank transfer coverage may use crypto payments to fill the gap. A crypto payment gateway allows a business to accept crypto payments without building blockchain infrastructure internally. The provider can generate addresses, monitor confirmations, convert assets, screen transactions, and route settlements. The key question in 2026 is which provider can support the required assets, jurisdictions, settlement model, compliance process, and volume.
What defines the best crypto payment gateway for businesses?
The best crypto payment gateway for businesses depends on how the payment flow is expected to work.
Supported cryptocurrencies determine which assets customers can use, while blockchain coverage determines the available networks. The same stablecoin may operate on several blockchains with different fees and confirmation times.
The next question is what happens after payment. Some businesses retain crypto, while others convert it into stablecoins or fiat. Settlement options and automatic conversion should therefore be reviewed together. Auto-conversion can reduce volatility exposure and manual exchange work, while fiat settlement can simplify accounting and treasury management. However, availability may depend on the provider, jurisdiction, banking partners, and compliance checks.
Businesses must also decide how the gateway will connect with existing systems through an API, hosted checkout, or payment links. An API provides greater control over checkout logic and transaction handling, while hosted checkout reduces development work. Payment links support invoices and direct sales that do not require a conventional online store. Webhooks complement these methods by sending updates when a transaction is confirmed, underpaid, expired, or refunded.
Security and compliance determine whether the gateway fits internal policies. Relevant controls include KYB onboarding, AML screening, access permissions, withdrawal allowlists, transaction monitoring, and audit records. Transaction histories, exports, and reconciliation reports also reduce manual interpretation of blockchain records.
Finally, businesses need to assess reliability and total cost. Uptime and support affect payment continuity, while a headline fee may exclude blockchain charges, conversion fees, payouts, or fiat withdrawals. Providers should therefore be compared across the complete payment and settlement flow.
Comparison of leading crypto payment gateways
| Provider | Best suited for | Supported crypto | API | Fiat settlement | Auto-conversion |
| PassimPay | International digital businesses requiring multi-chain payments, automation, and several collection or payout methods | 74+ | Yes | Yes | Yes |
| CoinGate | Merchants seeking an established checkout ecosystem, major assets, e-commerce plugins, and scheduled settlement | 10+ core assets | Yes | EUR, GBP, and USD | Yes |
| NOWPayments | Projects prioritizing broad asset coverage, flexible integrations, subscriptions, or mass payouts | 350+ | Yes | Available through fiat processing and withdrawal tools | Yes |
| CryptoProcessing by CoinsPaid | Larger organizations requiring managed payment infrastructure, permanent deposit addresses, exchanges, and batch payouts | 20+ | Yes | Crypto-to-fiat exchange and bank withdrawal | Yes |
The table reflects publicly available product information. Exact availability can vary by jurisdiction, asset, network, account type, and onboarding outcome.
PassimPay overview
PassimPay combines payment acceptance, fund management, conversion, and payout tools in one crypto payment solution. The platform supports more than 74 cryptocurrencies across over 18 blockchains and is available in 122 countries.
Businesses can integrate through a Payment API or use Hosted Checkout when a ready-made interface is more suitable. Payment Links support remote billing, while Static Deposit Wallets provide reusable addresses for account-based deposits. Webhooks connect transaction events with merchant systems.
Beyond incoming payments, Mass Payouts and Batch Transactions support transfers to multiple recipients. Auto Conversion can move received assets into another supported currency, while Fiat Settlement provides an off-ramp for companies that do not want to retain all revenue in crypto. The Merchant Portal includes Transaction History and Reports for tracking and reconciliation.
PassimPay also provides AML Screening, checkout customization, and payment monitoring. It has more than 530 merchants, over 750,000 monthly transactions, more than $4 billion processed, and 99.99% uptime. Fees start at 0.5%, although the final cost depends on the services and transaction flow used.
This feature set suits SaaS, gaming, AI, hosting, e-commerce, and other digital services that need multi-market payments, user deposits, automated updates, conversion, or recurring payouts.
When different providers may fit different business needs
CoinGate may fit companies that value an established merchant ecosystem, e-commerce integrations, core cryptocurrency support, and settlement in major fiat currencies. Its standard plan lists a 1% processing fee and weekly automatic settlement.
NOWPayments may suit projects that prioritize asset breadth. It supports more than 350 cryptocurrencies, API-based payments, subscriptions, payment buttons, custody options, mass payouts, and auto-conversion. Its published service fee is 0.5% for single-currency payments and 1% when conversion is required.
CryptoProcessing by CoinsPaid may fit enterprise-oriented operations that need permanent deposit addresses, payment links, internal exchanges, mass payouts, e-commerce plugins, and crypto-to-fiat withdrawal. Its documentation lists support for more than 20 cryptocurrencies.
PassimPay may fit companies that need multi-chain coverage together with hosted payments, static wallets, automated conversion, fiat settlement, reporting, and payout functions. The final decision depends on the assets, networks, countries, controls, and settlement routes required by the business model.
Conclusion
Selecting the best crypto payment gateway for businesses requires more than comparing supported coins. Companies need to assess integration depth, blockchain coverage, settlement currencies, compliance controls, reporting, uptime, support, and total processing costs.
CoinGate, NOWPayments, CryptoProcessing by CoinsPaid, and PassimPay address different operational priorities. PassimPay stands among the more functionally complete options in this group for international digital businesses requiring multi-chain acceptance, automated fund management, and both collection and payout tools. Still, the appropriate provider is the one that matches the company’s payment flow, risk policy, technical resources, and settlement requirements.
Disclosure: This content is provided by a third party. Neither crypto.news nor the author of this article endorses any product mentioned on this page. Users should conduct their own research before taking any action related to the company.
The Coldcard exploit is not a hack in the way most people understand the word. Nobody broke into anything. Nobody phished anyone. Nobody stole a seed phrase from a sticky note. The devices generated weak private keys for five years, and an attacker figured out how to guess them.
Summary
- Four coordinated attack waves have drained an estimated 1,816 BTC (approximately $118 million) from Coldcard hardware wallets since July 30, with Galaxy Research tracking 5,294 affected addresses and warning that every vulnerable device will eventually be emptied.
- The exploit stems from a firmware build error present since March 2021 that reduced seed entropy from 128 bits to approximately 40 bits on Mk3 devices and 72 bits on Mk4/Mk5/Q models, making private keys guessable through brute force.
- Unlike the FTX collapse, which drove bitcoin off exchanges into self-custody, the Coldcard crisis is producing the opposite flow: users are moving bitcoin back to regulated exchanges and institutional custodians they previously abandoned.
- The net transfer of bitcoin from self-custody wallets to exchange addresses has been positive every day since July 31 according to on-chain flow data, reversing a two-year trend that began after FTX.
- Treasury companies that hold bitcoin through institutional custody, including Strategy and prospective entrants like Evernorth, benefit from a narrative shift that frames self-custody as a risk rather than a solution.
That distinction matters because it strikes at the foundation of the self-custody argument. The pitch for hardware wallets has always been simple: your keys, your coins, no counterparty risk. Coldcard was the gold standard of that philosophy. Air-gapped, open-source, bitcoin-only, endorsed by security researchers and institutional custodians as the most trusted device in the ecosystem.
If the most trusted hardware wallet can ship a five-year entropy bug without detection, the question is no longer whether Coldcard failed. The question is whether any hardware wallet can be trusted as the sole custodial layer for significant bitcoin holdings. And the market is answering that question with its feet.
The exploit in four waves
The first wave hit at 2:14 a.m. UTC on July 30. A single entity swept 594 BTC from approximately 500 wallets in 25 minutes. The second wave followed on August 1, draining 284.4 BTC from 2,889 addresses. The third wave hit later that day with 207.73 BTC across a separate address cluster. The fourth wave arrived on August 3, with Galaxy Research’s Alex Thorn identifying 448.7 BTC moving from 709 suspected victim addresses.
The combined estimate stands at approximately 1,816 BTC across 5,294 addresses. Galaxy measures 13.8 sweeps per block during active waves, roughly 45 times the baseline rate. Thorn described the pattern as “LIKELY Coldcard victims” based on unspent output characteristics and transaction behavior. The wording is precise because the attribution comes from blockchain analysis, not device records or law enforcement confirmation.
Coinkite, the Toronto-based manufacturer, traced the problem to a March 2021 firmware change. A preprocessor guard was supposed to select the hardware random-number generator during seed creation. The guard checked whether a configuration setting was defined, not whether its value was correct. The build system selected a deterministic MicroPython fallback instead. The firmware compiled without warnings. Seeds appeared normal. Addresses accepted deposits. Nothing indicated the entropy was catastrophically weak.
On Mk3 devices, the effective search space dropped to approximately 40 bits. A 128-bit seed has more possible combinations than atoms in the observable universe. A 40-bit seed has roughly one trillion combinations. That is within reach of commodity hardware. The Mk4, Mk5, and Q models include additional secure elements that mix their own entropy, producing seeds with approximately 72 bits. Better than 40, but still far below the 128-bit target.
The critical detail: updating the firmware does not repair an existing seed. Every Coldcard owner who generated a seed on affected firmware must create a new seed on patched hardware and migrate their funds. The key itself must be replaced.
The flow reversal: from exchanges to self-custody and back
After FTX collapsed in November 2022, the bitcoin community experienced its most dramatic shift in custodial philosophy. The phrase “not your keys, not your coins” became operational advice rather than a slogan. On-chain data showed a sustained, multi-month transfer of bitcoin from exchange addresses to self-custody wallets. The trend persisted for nearly two years.
The Coldcard exploit has reversed that flow. Net transfers from self-custody wallets to exchange addresses have been positive every day since July 31. The magnitude is not comparable to the post-FTX exodus, which involved hundreds of thousands of BTC over months. The current flow is smaller and more concentrated among users who specifically held Coldcard devices. But the direction of the flow is what matters for the narrative.
The users moving bitcoin to exchanges are not panicking retail investors. Many are technically sophisticated holders who chose Coldcard specifically because it was the most security-conscious option. They are making a rational calculation: the counterparty risk of an exchange is now quantifiable and insured, while the self-custody risk of a hardware wallet with a five-year entropy bug is neither.
That calculation is the narrative shift. Self-custody was supposed to eliminate counterparty risk entirely. The Coldcard exploit demonstrates that self-custody introduces its own category of risk: supply-chain risk, firmware risk, entropy risk, and the risk that the device you trust with your private keys is not doing what its manufacturer claims.
Who benefits: the treasury company model
The companies that hold bitcoin through institutional custody benefit directly from the narrative shift. Strategy, the largest corporate holder with over 550,000 BTC as of its latest disclosure, uses institutional custodians including Coinbase Custody and Fidelity Digital Assets. These custodians use multi-signature arrangements, hardware security modules, and geographic distribution that do not depend on any single device’s entropy quality.
The treasury company thesis is built on the argument that holding bitcoin through a publicly traded company is safer than holding it yourself, more liquid than holding it in a hardware wallet, and more capital-efficient because the company can borrow against its holdings. The Coldcard exploit strengthens the first claim in a way that no marketing campaign could.
Evernorth, the XRP treasury company preparing to list, faces a similar dynamic. Prospective investors who might have preferred self-custody of XRP now have a concrete example of what can go wrong with hardware wallet security. The listing calculus shifts when self-custody carries visible, quantifiable risk.
The broader pattern extends to every institutional custody provider. Coinbase Custody, BitGo, Fireblocks, and Anchorage reported inquiries surging after the first Coldcard wave. The product these companies sell is the elimination of exactly the risk that Coldcard exposed: the risk that a hardware implementation error, invisible for years, can make your private keys guessable.
The insurance gap and what it reveals
The Coldcard exploit has exposed an insurance gap that the industry has not addressed. Regulated exchanges and custodians carry insurance against theft, operational failure, and in some cases, hot-wallet compromise. The coverage limits vary, but the principle is established: if an exchange loses your bitcoin through its own failure, there is a claims process.
Self-custody has no equivalent. If a hardware wallet generates a weak key and an attacker drains the funds, the user has no insurance claim. Coinkite is a private company in Toronto. No product liability framework for hardware wallet entropy failures exists. The affected users can sue, but collecting meaningful damages from a hardware startup is a different proposition from filing a claim against an insured custodian.
The insurance gap is not a new observation, but the Coldcard exploit makes it concrete. A user who lost 10 BTC from a Coldcard has no recovery mechanism. A user who lost 10 BTC from Coinbase Custody would have a claim against the custodian’s insurance. The risk-adjusted comparison now favors institutional custody for any holding above the threshold where insurance matters.
The AI dimension and what it means for future exploits
Coinkite said the attacker used AI to discover the firmware flaw, and that Coinkite’s own AI audit of the same code weeks earlier found nothing. If that assessment is correct, it introduces a new variable into the self-custody risk model.
Hardware wallet security has historically rested on the assumption that open-source code is safer because more eyes can review it. The Coldcard firmware was public for five years. Thousands of developers could have inspected it. Nobody found the entropy bug. An AI model did.
The implication is that the advantage in firmware analysis has shifted from defenders to attackers. If AI can find subtle build-system errors that human reviewers miss, then every open-source hardware wallet is potentially vulnerable to the same methodology. The attacker does not need to find a new type of bug. They need to find a new instance of the same type of bug in a different codebase.
Block, Trezor, and Ledger have confirmed their products are unaffected by the specific Coldcard vulnerability. But “unaffected by this specific bug” is not the same as “provably secure against AI-assisted firmware analysis.” The assurance gap is structural, and the Coldcard exploit is the first public demonstration of it.
The self-custody argument is not dead, but it is wounded
The self-custody philosophy will survive the Coldcard exploit. Multi-signature arrangements that do not depend on any single device, hardware wallets from manufacturers with different codebases, and cold storage practices that incorporate dice rolls for entropy remain valid approaches. Coinkite itself noted that seeds created with at least 50 fair dice rolls are not considered exposed by this RNG issue.
What the exploit has damaged is the simplest version of the self-custody argument: buy a hardware wallet, generate a seed, store it safely, and never worry about counterparty risk again. That version assumed the hardware wallet worked as advertised. For five years, Coldcard did not.
The result is a more nuanced custody landscape. Self-custody for small amounts remains practical. Self-custody for significant holdings now requires either multi-signature setups, multiple hardware vendors, external entropy sources, or regular security audits that most individual holders cannot perform. For holders who cannot or will not take those steps, institutional custody has become the lower-risk option. And that is exactly the argument the treasury companies have been making all along.
What to watch
- Exchange inflow data. If the net transfer from self-custody to exchanges continues beyond the initial Coldcard panic, it signals a durable shift in custody preferences rather than a temporary reaction.
- Coinkite’s liability exposure. Any class-action filing against Coinkite will establish precedent for hardware wallet manufacturer liability. Watch for suits in US and Canadian courts.
- Institutional custodian onboarding numbers. Coinbase Custody, BitGo, and Fireblocks quarterly reports will show whether the Coldcard exploit translated into sustained new business.
- Strategy and Evernorth share price behavior. If treasury company stocks outperform bitcoin in August, the market is pricing the custody-narrative shift into equities.
- New firmware audit disclosures. If other hardware wallet manufacturers commission independent AI-assisted audits and publish results, it signals the industry is taking the supply-chain risk seriously.
Frequently asked questions
How much bitcoin has been stolen from Coldcard wallets?
Galaxy Research estimates approximately 1,816 BTC across four coordinated attack waves affecting 5,294 addresses since July 30. The figure is based on blockchain analysis and has not been confirmed by Coinkite or law enforcement.
Is the Coldcard exploit still ongoing?
Yes. Galaxy identified the fourth wave on August 3 and warned that vulnerable seeds will continue to be drained until affected users migrate to new wallets with fresh seeds on patched firmware.
Does updating Coldcard firmware fix the problem?
No. The firmware update fixes seed generation going forward, but it does not repair seeds already created on vulnerable firmware. Users must generate entirely new seeds and transfer their funds.
Are other hardware wallets affected?
Block, Trezor, and Ledger have confirmed their products are not affected by this specific vulnerability. However, the exploit demonstrates that firmware-level entropy bugs can persist undetected for years in any open-source codebase.
Why are people moving bitcoin to exchanges instead of other hardware wallets?
Regulated exchanges and custodians offer insurance, multi-signature security, and professional monitoring that individual hardware wallets do not. The Coldcard exploit made self-custody risk visible and quantifiable, changing the risk comparison.
Do treasury companies like Strategy use hardware wallets?
Strategy and other institutional holders use professional custodians like Coinbase Custody and Fidelity Digital Assets, which employ multi-signature arrangements and hardware security modules rather than single consumer hardware wallets.
Can affected users recover stolen bitcoin?
Recovery is extremely unlikely. The attacker controls the private keys. Bitcoin transactions are irreversible. Users with unconfirmed transactions may attempt Replace-by-Fee to redirect funds, but this window is narrow and not guaranteed.
Is self-custody still safe?
Self-custody remains viable with proper practices: multi-signature setups across multiple hardware vendors, external entropy from dice rolls, and regular security audits. Single-device, single-signature self-custody for significant holdings now carries documented risk.
Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or legal advice. Loss estimates are based on third-party blockchain analysis and have not been confirmed by the manufacturer or law enforcement. Published August 3, 2026.
Bitcoin slipped below $63,000 on Monday, Aug. 3, even as falling oil prices and stronger U.S. stock futures created a more favorable backdrop for risk assets.
Summary
- Bitcoin fell below $63,000 while oil and Treasury yields declined on renewed Iran diplomacy hopes.
- Coldcard attack estimates now exceed 1,815 BTC across more than 5,000 suspected victim addresses overall.
- Spot Bitcoin ETFs lost $61.53 million last week, ending three consecutive weeks of net inflows.
- Strategy added Bitcoin’s 200 week average as prices hovered only modestly above the indicator Monday.
- A Senate delay left the CLARITY Act without scheduled floor action before the August recess.
BTC traded near $62,556, down 1.38% over 24 hours and 4.35% over seven days. It had reached a Sunday high near $63,650 before sellers regained control. Ether fell about 1.8% to $1,841, while XRP and Solana also declined.
The weakness came as investors assessed renewed U.S. talks with Iran, another suspected Coldcard attack wave, fresh spot Bitcoin ETF outflows and the absence of the CLARITY Act from Monday’s Senate schedule.
Bitcoin price fails to follow the broader relief trade
President Donald Trump canceled a planned military strike on Iran and said negotiations would seek to address Iran’s nuclear program and reopen the Strait of Hormuz. Brent crude fell to about $83.28 per barrel, while West Texas Intermediate dropped to $79.47.
Nasdaq futures rose about 0.8%, while S&P 500 futures gained 0.6%. Treasury prices also strengthened as lower oil reduced some of the inflation concerns created by disrupted energy supplies.
Bitcoin did not follow that move. The divergence does not prove that one crypto event caused the decline. However, it shows that lower oil and stronger equity futures were not enough to overcome the pressures already affecting digital assets.
The relative weakness is consistent with a possible rotation of speculative capital toward technology stocks. Price action alone cannot confirm that movement, but renewed activity in equities can reduce demand for crypto when traders have several competing sources of volatility.
Coldcard losses keep security fears in focus
Galaxy Research head Alex Thorn identified what he described as a “LIKELY” fourth organized wave affecting Coldcard generated addresses. His updated estimate covered 709 potential victim addresses and 448.7 BTC. Activity reached 13.8 sweeps per Bitcoin block, about 45 times the rate measured during an earlier control period.
Galaxy had previously mapped three suspected waves involving 1,367.05 BTC across 4,585 addresses. Adding the latest estimate produces a possible total of 1,815.75 BTC across 5,294 addresses, assuming the groups contain no overlap.
That total remains an onchain estimate. Coinkite, law enforcement agencies and individual wallet owners have not independently confirmed every address as a victim. Galaxy has also not established whether one attacker controlled all four waves.
The incident concerns seed generation in affected Coldcard firmware rather than a failure in Bitcoin’s network or transaction cryptography. Coinkite said some devices created seeds with less randomness than intended, allowing attackers to search a smaller range of possible keys.
Coinkite has released corrected firmware for each affected model. However, installing an update does not repair an existing vulnerable seed. Users must generate a new seed with corrected firmware and transfer their funds. The company said its investigation remains ongoing.
As crypto.news previously reported, Thorn also identified similar transactions waiting in the mempool. Some users may be able to replace an unconfirmed attacker transaction with a higher fee transfer, although success is “not guaranteed.”
ETF outflows and the CLARITY delay add pressure
U.S. spot Bitcoin ETFs recorded about $61.5 million in net outflows from July 27 through July 31, based on SoSoValue data. The result ended three consecutive weeks of net inflows.
The final session caused most of the weekly reversal. Funds lost a combined $265.4 million on July 31. BlackRock’s IBIT recorded $122.7 million in withdrawals, while Fidelity’s FBTC lost $54.8 million and Grayscale’s GBTC posted $52.6 million in outflows.
The flows do not show whether investors expect further price declines. They do show that regulated fund demand weakened as Bitcoin moved closer to long term support.
Political uncertainty added another concern. Monday’s official Senate schedule included a vote on a spending measure but no action on the Digital Asset Market Clarity Act. The chamber’s published cloture records also showed no petition for the legislation.
As crypto.news reported, leaders would ordinarily need to file cloture by Wednesday, Aug. 5, to hold a possible Friday vote on proceeding to the bill. Such a vote would not constitute final passage.
The absence of scheduled action cannot be identified as the direct cause of Bitcoin’s decline. Still, it removes a possible near term policy catalyst while traders await a clearer Senate timetable.
Bitcoin price now faces a $60,000 support test
The supplied daily chart shows Bitcoin struggling below the $63,000 to $65,000 range. Momentum has weakened, with the relative strength index at 42.65 and below its moving average of 50.40.
The MACD histogram has also turned negative. A sustained move below $60,000 would weaken the current structure, while a recovery above $65,000 to $66,000 would provide stronger evidence that buyers have regained control.
Strategy founder Michael Saylor said the company had begun tracking Bitcoin’s 200 week moving average and its premium to that level. He said Bitcoin had remained above the average 92% of the time since the indicator became available. The percentage reflects Strategy’s calculation rather than an independent market study.
The next checkpoints are Coldcard’s technical review, Monday’s ETF flows and any Senate filing before Wednesday. Until those pressures ease, lower oil prices and stronger stock futures may remain insufficient to produce a lasting Bitcoin rebound.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
Nasdaq-listed crypto treasury company ZeroStack has raised serious questions about its financial runway, warning in a recent SEC filing that “substantial doubt” exists about whether it can keep operating for the next year. The assessment marks a sharp reversal from its view just a quarter earlier, highlighting how dependent the company’s plan is on staking income and the liquidity of its Zero Gravity (0G) token.
In a Form 10-Q filed with the U.S. Securities and Exchange Commission on Friday, ZeroStack reported $2.6 million in cash and negative working capital of $600,000 as of June 30, along with an accumulated deficit of $339.1 million. The filing also detailed a major unrealized drag from its token treasury: an $82.5 million fair value loss on digital assets and a net loss of $61.3 million for the first half of 2026.
Key takeaways
- ZeroStack now says there is substantial doubt it can continue operating over the next year, reversing its earlier “sufficient” outlook in a prior filing.
- As of June 30, the company held 75.1 million 0G tokens, valued at $15.2 million versus an aggregate cost of $163.3 million (about 91% below recorded cost).
- The company relies on staking rewards and sales of 0G tokens to fund operations, making its cash position sensitive to token price and trading liquidity.
- ZeroStack reported $3.8 million in staking revenue in the first half of 2026, but it also recorded significant losses and could not conclude that its planned funding steps fully remove going-concern risk.
SEC filing flags going-concern risk
ZeroStack’s latest filing is notable not just for its headline loss figures, but for the governance and risk signal it sends to investors. Management stated that it could not conclude its plans would be enough to eliminate doubts about whether the company can continue as a going concern over the next year.
The company’s balance sheet underscores the pressure behind that conclusion. With $2.6 million in cash and negative working capital of $600,000 at June 30, ZeroStack’s near-term flexibility appears limited. It also reported an accumulated deficit of $339.1 million, reflecting losses that have compounded over time.
Beyond liquidity, the filing shows the company is carrying a large unrealized impairment in its digital asset treasury. ZeroStack disclosed an $82.5 million fair value loss on digital assets during the period, alongside a net loss of $61.3 million for the first half of 2026.
A treasury strategy tied to 0G’s market
ZeroStack’s operating model depends heavily on 0G token performance and the token’s market depth. The company reported that it holds 75.1 million 0G tokens with an aggregate cost of $163.3 million and a fair value of $15.2 million as of June 30. Put differently, the holdings were valued about 91% below their recorded costs.
That gap matters for both accounting and funding. If the company intends to finance operations through token sales—especially during periods of weak liquidity—its ability to raise cash could be constrained even if balances appear large on paper. The company explicitly linked its funding capacity to both the 0G price and trading liquidity, according to the filing.
ZeroStack’s management also described reliance on staking rewards and token sales. In practice, staking income can provide periodic cash flow, but it may not be sufficient in periods when token markets are illiquid or when valuations fall further.
Staking revenue helps—yet the runway question remains
During the first half of 2026, ZeroStack reported $3.8 million in staking revenue. After validator commissions, the company said it earned about 6.6 million 0G tokens from staking activity.
To support expenses, ZeroStack sold nearly 4.9 million 0G tokens for $2.4 million over the same period. The filing indicates that these cash inflows—staking-related and sale-related—are central to its ability to pay forecast operating costs.
ZeroStack also said that, if needed, it could sell some of its treasury holdings. However, management’s conclusion did not fully reassure the markets: it said it could not determine that those actions would be enough to address going-concern doubts.
The tension here is straightforward. When a company’s main treasury assets have experienced steep valuation declines, the theoretical ability to raise cash by selling holdings can become less effective in the real world—particularly if market pricing and liquidity do not support the volume and proceeds management may be counting on.
Backtracking from earlier filings
Perhaps the most consequential element of the news is the reversal in ZeroStack’s assessment. In its first-quarter Form 10-Q filing, the company stated that its cash and staking rewards would be sufficient to meet its working capital requirements and obligations for at least another year.
In the most recent filing, it no longer reaches that conclusion and instead flags substantial doubt about continued operations over the next year. The shift suggests that circumstances changed—or that management’s confidence in the sustainability of its funding plan weakened as results and valuations evolved.
ZeroStack’s corporate background also provides context for how the company arrived at this point. The filing notes that the company was previously Flora Growth, a cannabis and CBD products firm. On Sept. 19, Flora announced $401 million in funding for a 0G treasury strategy, including $35 million in cash and equivalent commitments and more than $366 million in in-kind digital assets. The company later rebranded as ZeroStack and retained its Nasdaq listing.
Those details underline why investors are likely to focus on token treasury outcomes: the strategy is fundamentally designed to monetize staking and manage liquidity through sales. When 0G’s fair value diverges sharply from recorded cost, the difference can translate into both accounting losses and real constraints on financing flexibility.
What readers should watch next is whether ZeroStack provides further clarity on how it plans to balance staking, token sales, and liquidity needs—particularly given its much narrower margin for error after the “substantial doubt” disclosure. Investors will also likely track changes in 0G trading conditions, since the company’s own filings tie its funding outlook directly to token price and market liquidity.
Ripple has expanded its digital capital markets strategy. The company announced today investments in Zilo and Lucuido – two firms that are focused on developing infrastructure for tokenized funds and institutional asset trading.
The move builds on existing partnerships with both firms. Ripple did not disclose the size of either investment.
Speaking on the matter was Nigel Khakoo, SVP, Trading and Markets at Ripple, who said:
“… ZILO and Licuido provide core capabilities that are essential to further scaling this shift: regulated digital transfer agency infrastructure and liquidity for issuance and collateral mobility. This is just the beginning of the journey, and we see a substantial opportunity to bring huge efficiencies to the investment sector over the next decade.”
ZILO provides transfer agency and fund administration technology. Its systems give asset managers and custodians regulated digital records for tokenized share classes. Licuido, on the other hand, operates an FCA-regulated platform that supports the issuance, distribution, trading, and use of traditional assets as digital collateral.
Ripple plans to integrate these capabilities with its infrastructure on the XRP Ledger. The company wants institutions to issue tokenized assets, hold them in custody, move them between investors, and use them as collateral without relying on legacy systems.
Naturally, RLUSD will serve as the regulated cash component for delivery-versus-payment transactions. This structure is designed to allow the asset and payment sides of a trade to settle together on XRPL.
The investments also support Ripple’s recent push to build a broader institutional platform around tokenization, payments, stablecoins, and trading. Last month, the firm launched Ripple Mint and made an investment in compliance provider Notabene. This strengthens the infrastructure that’s available to institutions using RLUSD.
It’s also noteworthy that the company has worked with Aviva Investors, Franklin Templeton, and DBS on tokenized fund and collateral projects. Ripple said that ZILO and Licuido will help turn those individual partnerships into infrastructure that asset managers can use at scale.
The post Important Ripple (XRP) Announcement, New Investments: August 3 appeared first on CryptoPotato.
The crypto exchange stopped accepting new registrations from Japan residents and will begin progressively restricting existing accounts on Nov. 1.
ZeroStack has warned its cash position may not support operations for another year.
Summary
- ZeroStack has warned that substantial doubt exists about its ability to continue operating over the next year after reversing its earlier liquidity outlook.
- The company reported $2.6 million in cash while its 75.1 million 0G token treasury was valued about 91% below its acquisition cost as of June 30.
- ZeroStack said staking rewards and token sales remain its main funding sources, but management could not conclude those plans would remove the going concern risk.
- The latest filing comes months after CEO Daniel Reis Faria said regulatory uncertainty continued to keep larger institutional investors on the sidelines.
According to a Form 10-Q filed with the U.S. Securities and Exchange Commission on Friday, Nasdaq-listed crypto treasury company ZeroStack said substantial doubt exists about its ability to continue as a going concern over the next 12 months, reversing the conclusion it reached in its previous quarterly filings.
As of June 30, the company reported $2.6 million in cash, negative working capital of $600,000, and an accumulated deficit of $339.1 million. During the first half of 2026, it recorded an $82.5 million fair value loss on digital assets and a net loss of $61.3 million, according to the filing.
Management said existing cash, proceeds from staking rewards, and possible sales of treasury assets are expected to support operating costs. Even so, the company concluded it could not determine that those measures would remove the substantial doubt surrounding its ability to continue operating for the next year.
ZeroStack’s 0G treasury has lost most of its recorded value
The filing showed ZeroStack held 75.1 million Zero Gravity (0G) tokens with an aggregate acquisition cost of $163.3 million. Their fair value had fallen to $15.2 million by June 30, leaving the treasury valued about 91% below its recorded cost.
The company said its operating model depends largely on staking rewards and periodic token sales, making its access to cash dependent on both the market price and trading liquidity of the 0G token.
For the first six months of the year, ZeroStack generated $3.8 million in staking revenue after earning about 6.6 million 0G tokens following validator commissions. Over the same period, it sold nearly 4.9 million tokens for $2.4 million to cover operating expenses.
Although management said additional treasury sales remain available if needed, the filing stated that those plans were not sufficient to conclude that the going concern uncertainty had been resolved.
Filing reverses the company’s earlier liquidity outlook
The latest assessment differs from the position ZeroStack presented just three months earlier.
In its first-quarter filing, the company said available cash together with expected staking rewards would be enough to meet working capital needs and other obligations for at least the following 12 months. The latest report withdraws that conclusion after a sharp decline in the value of its digital asset holdings.
ZeroStack adopted its current treasury strategy after operating for years as cannabis and CBD products company Flora Growth.
On Sept. 19, the company announced a $401 million financing package to establish a treasury focused on the Zero Gravity ecosystem. The package included $35 million in cash and cash-equivalent commitments alongside more than $366 million in in-kind digital asset contributions. Flora Growth later rebranded as ZeroStack while retaining its Nasdaq listing.
ZeroStack CEO previously pointed to regulation as another institutional hurdle
The company’s financial disclosure comes months after ZeroStack Chief Executive Officer Daniel Reis-Faria discussed another challenge facing digital asset companies: regulatory uncertainty.
Speaking to crypto.news in May, Reis-Faria said progress on U.S. stablecoin legislation had reduced one source of uncertainty for investors but had not yet convinced larger institutions to increase participation.
His comments followed a bipartisan agreement between Senators Thom Tillis and Angela Alsobrooks on stablecoin provisions in the CLARITY Act that prohibited interest-like payments resembling bank deposits while allowing activity-based rewards tied to payments and platform use.
At the time, Reis-Faria said the remaining concern was not the legislation itself but uncertainty over how regulators would implement it. Under the proposal, the SEC, CFTC and Treasury would jointly develop implementing rules within one year after the legislation became law.
JPMorgan had previously described passage of the CLARITY Act by midyear as a positive catalyst for digital asset markets, while Blockchain Association CEO Summer Mersinger said resolving the stablecoin yield debate moved comprehensive market structure legislation closer to becoming law.
Standard Chartered also estimated that allowing unrestricted stablecoin yields could redirect as much as $500 billion in bank deposits by 2028, providing context for the banking industry’s resistance during negotiations.
Company now faces both market and funding pressure
The SEC filing indicates that ZeroStack’s operating cash generation remains closely tied to the performance of the 0G ecosystem through staking income and token sales.
With the market value of its treasury declining substantially from its acquisition cost, management said future liquidity will continue to depend on available cash, staking rewards, token prices, and market liquidity.
Despite outlining those funding options, the company concluded that substantial doubt about its ability to continue as a going concern remains in place for the coming year.
Galaxy Research head Alex Thorn warned early Monday that a fourth coordinated attack wave is likely targeting Coldcard users.
The random number generator (RNG) exploit has been linked to 1,367.05 Bitcoin (BTC) from 4,585 addresses across three confirmed waves. A verified fourth wave would push totals higher.
Coldcard Exploit Deepens as Suspected Fourth Wave Sweeps Over 380 Bitcoin
Thorn identified 218 transactions between blocks 960,778 and 960,792, moving over 380 BTC from 462 suspected victim addresses to 210 fresh destinations. Sweeps ran at 13.8 per block, roughly 45 times the pre-incident rate of 0.3.
The transactions matched the pattern of vulnerable Coldcard addresses, with some funds already swept to second-hop wallets.
“These are LIKELY Coldcard victims — they match the shape of coldcard vulnerable utxos and the elevated transaction pattern gives me high confidence they are another wave of attacks,” Thorn said.
The executive added that similar transactions remain pending in the mempool with replace-by-fee (RBF) enabled. RBF lets the sender replace an unconfirmed Bitcoin transaction with a higher-fee version. In some cases, this allows a victim to outbid an attacker’s competing transaction before either is confirmed.
Per Onchain Lens, confirmed losses stand at $88.6 million. Earlier waves drained individual holders in minutes, including one Canadian victim who lost $1.6 million.
Follow us on X to get the latest news as it happens
Coldcard Destroys Remaining Vulnerable Inventory
Meanwhile, Coldcard said Sunday it halted shipments and destroyed all remaining devices carrying the flawed firmware. Satscard, Opendime, and Tapsigner are unaffected.
The patched firmware protects only newly generated seeds. Users must create a fresh seed and migrate funds. The company also told victims to keep affected devices as its legal team coordinates with law enforcement.
“We’ve also been in direct contact with the wider hardware wallet and self-custody community, including other builders, researchers, and people who’ve thought hard about this kind of failure. All have graciously offered whatever resources they could spare. We are still engaged in this outreach and are committing to work with the broader industry going forward,” the team said.
The incident has already drawn warnings from CZ about hardware wallet risk. Whether wave 4 gains confirmation, and whether pending fee races rescue funds, may decide the final toll.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
The post Coldcard Bitcoin Exploit Enters Fourth Wave With 462 New Suspected Victims appeared first on BeInCrypto.
Bitcoin started the week just below $63,000, with Friday’s U.S. jobs report the biggest macro event likely to determine whether the July rebound continues, though developments in Iran may take on greater significance in the coming days.
A muted rise in U.S. hiring could be the best outcome for risk assets like crypto. Such a rise would ease fears of an economic slowdown, but wouldn’t push the Federal Reserve closer to raising interest rates.
IG market analyst Tony Sycamore said a gain of around 88,000 jobs with unemployment unchanged at 4.2% would strike that balance in a “Goldlocks-type print.”
The U.S. government’s borrowing plans are another macro focus. JPMorgan strategist Jay Barry said the Treasury is likely to keep its regular debt sales unchanged, which would avoid adding pressure to interest rates. Larger-than-expected sales could raise borrowing costs for households and companies and weigh on crypto.
Traders will also watch earnings from Circle, Galaxy, Block and six bitcoin miners. BIP-110, a proposal to temporarily limit non-financial data stored on the Bitcoin blockchain, is expected to enter its required miner-signaling period.
99% Of XRP & XLM Holders Have No Idea What’s Coming
Ram-raiders caught stealing huge whisky haul after smashing Ford Transit into Co-Op
Hockey World Cup 2026: Full schedule, India squads, venues, live streaming | FIH Men’s Hockey World Cup 2023
-
Business5 days agoWhy Trees Belong on the Risk Register
-
Fashion3 days agoWeekend Open Thread: Wit & Wisdom
-
Politics3 days agoMeta enters AI-training agreement with far-right ‘propaganda rag’ Newsmax
-
Entertainment6 days ago‘Stargate’ Creator’s New Sci-Fi Series Returns for Season 3 Tomorrow
-
Politics7 days agoLuke Littler dismantles Gerwyn Price to retain title in Blackpool
-
Crypto World2 days agoMicroStrategy Post-Earnings CLARITY Act Push Could Add New Catalyst for Its Stock
-
Politics6 days agoThe Part of the Electric Transition Nobody Wants to Discuss
-
Business5 days agoMajor shareholder moves on Canyon
-
Crypto World2 days agoXRP Ledger v3.3.0 brings five institutional features
-
News Videos4 days agoBitcoin Enters the 3rd Stage of the Bear Market
-
Crypto World5 days agoKraken Enables Retail Access to Jersey Mike’s IPO via Tokenized Shares
-
Tech6 days agoNew macOS Sequoia & Sonoma security updates for older Macs
-
Politics4 days agoLuke Littler’s dominance sparks GOAT debate
-
News Videos6 days agoClaude: Build Financial Dashboards in Minutes (2026)
-
Business5 days agoJohnson & Johnson agrees to $5.5B settlement over talc cancer claims
-
Sports3 days agoSeema Kaliramna Wins Discus Throw Bronze, Takes India’s CWG Medals Tally To 17
-
Crypto World24 hours agoCrypto PAC spending tops $2M in Michigan House race
-
Business3 days agoTrump Announces Hamas Disarmament Agreement as Iran Strikes Kuwait Air Base and US Attacks Pause Overnight
-
Tech5 days agoGemini can now summarize the messiest comment threads in Google Docs
-
Tech1 day agoESET tracks rise in malicious AI skills and adaptable malware
You must be logged in to post a comment Login