Connect with us

Crypto World

what Claude Mythos 5 changes

Published

on

Oil at $115, Iran war hits BTC

The AI model its own maker says can find and exploit software flaws better than almost any human is back online. It arrives in the middle of crypto’s worst year for hacks. Here is what actually changes, and what the panic gets wrong.

Summary

  • On July 1, 2026, Anthropic restored global access to Claude Fable 5 after the U.S. lifted export controls, while the less-restricted Mythos 5 returned only to a set of vetted U.S. organizations through a program called Glasswing.
  • Anthropic markets Mythos-class models as able to find and exploit software vulnerabilities more effectively than any other model and than all but the most skilled human experts, and says the models surfaced more than 10,000 high-severity flaws in important software.
  • The alarm in crypto is that cheap, fast, AI-driven vulnerability discovery turns unaudited protocols and small forks into easy targets, in a year when hacks have already drained more than $840 million.
  • The skeptical view, shared by some security experts and by Anthropic’s own review, is that the models mostly accelerate known attack types, social engineering, exposed keys, and misconfigurations, instead of inventing new ones, and that weaker models can do much of the same work.
  • The same capability that helps attackers also helps defenders, through faster audits and patching, which is why the near-term risk is real while the long-run balance is contested.

The model built to find software flaws is back, and it landed in the worst possible year for the industry with the most to lose. On July 1, 2026, Anthropic restored access to Claude Fable 5 worldwide after the U.S. Department of Commerce lifted the export controls that had forced the model offline in June, while its more powerful sibling, Mythos 5, returned only to a set of vetted organizations. The timing is what makes it a crypto story. Anthropic describes Mythos-class models as able to find and exploit vulnerabilities better than nearly any human, and crypto is in the middle of a record run of hacks, with billions in assets sitting inside publicly visible code that an AI can read at machine speed.

This piece separates what these models actually change from what the panic gets wrong, and it does so without treating a single headline as the whole picture. The central question is not whether AI makes crypto security riskier; it does. The harder question is where the added risk actually sits, whether it is in smart contracts themselves, bridges, human operations, signing flows, or the speed at which attackers can now move from disclosure to exploit. The answer is less cinematic than the fear, but more useful for anyone holding funds or building protocols.

Advertisement

What came back, and what did not

The distinction between the two models is the first thing to get right, because they are not equally available. Fable 5 is the public, safeguarded member of the Mythos class, released in June 2026 and priced at roughly twice the cost of Anthropic’s prior flagship. It returned to global users on July 1 across Anthropic’s platforms. Mythos 5 is the less-restricted version that carries the full cyber capability, and it did not return to the public.

Anthropic restored Mythos 5 only to a set of vetted U.S. organizations that operate and defend critical infrastructure, through an opt-in program called Glasswing, following government approval in late June. So the model most crypto observers worry about is not the one now sitting behind a consumer subscription. The distinction matters because public access changes the risk surface very differently from vetted critical-infrastructure access. A powerful model in the hands of security teams is not the same thing as a powerful model available to every attacker with a credit card.

The episode that pulled both offline is worth understanding, because it colors the risk debate. In June, researchers at Amazon showed a jailbreak that got Fable 5 to identify software vulnerabilities and write exploit code, and the U.S. government responded with an emergency export-control order that Anthropic complied with by disabling the models entirely, since it could not restrict access by nationality in real time. The controls were lifted at the end of June, and access returned in the first days of July, with Fable 5 global and Mythos 5 limited. Anthropic’s own account of the incident cuts against the loudest fears: its review, conducted with the government, found that the reported technique did not reveal a uniquely Mythos-level capability, and that several weaker models could reproduce the same vulnerabilities.

The company argued the capability had been oversold, and it deployed a new safety classifier it says blocks the specific technique in more than 99% of cases, routing risky cybersecurity prompts to a weaker model in fewer than 5% of sessions. That is the company’s framing, and it matters, but it is not the whole story either. The point for crypto is narrower: even if public access is constrained, the capability exists, it is improving, and weaker models already reproduce parts of it. That means the security problem cannot be solved by focusing on one model alone.

What Mythos-class models can actually do

The capabilities that alarmed the security world are real and documented, not hypothetical. Under its restricted program, Mythos-class models reportedly surfaced more than 10,000 high and critical-severity vulnerabilities in systemically important software, and found critical flaws across more than 1,000 open-source projects, including widely used components such as the Linux kernel and a popular media library. In one cited case, the model generated a working proof-of-concept exploit for a complex issue in under 31 minutes. Cloudflare reported that an earlier Mythos preview chained bugs into working exploits across more than 50 of its code repositories before refusing to produce a live demonstration.

The capability that most changes the math for defenders is speed. Anthropic has warned that the window between a vulnerability being disclosed and being exploited is collapsing, in some cases from days to hours. Its researchers concluded that a single operator with this class of model could turn a month of software patches into working exploits in a single afternoon, for a cost measured in a few thousand dollars. Security practitioners have started describing the shift as moving from an era of N-days, where attackers had weeks or months after a disclosure, to something closer to N-hours.

When a patch ships, it also reveals the flaw it fixes, and a model that can read the patch, understand the bug, and build an exploit in hours compresses the defender’s response window dramatically. None of this is the same as inventing a new class of attack. It is acceleration and scale. The model reads public code, compares versions, summarizes audits, and reasons about weaknesses faster and cheaper than a human team, which lowers the cost and expertise needed to do work that skilled attackers already do.

That distinction, acceleration rather than invention, is the fault line the entire debate runs along. For crypto teams, the practical implication is brutal: slow patching, stale dependencies, and unaudited forks become more dangerous when attackers can automate the boring parts of vulnerability discovery. The frontier model does not need to be magical to change the economics. It only needs to make the existing attack pipeline cheaper and faster.

Advertisement

Why crypto is uniquely exposed

Crypto sits in the blast radius for reasons specific to how it works. Smart contracts are public by design: the code that controls billions of dollars is visible on-chain for anyone, including an AI, to read and analyze. Bridges, the infrastructure that moves assets between blockchains, concentrate the collateral of many chains into a single set of contracts and message-verification systems, which makes them the highest-value targets in the space. An attacker who can scan code at machine speed has an unusually rich, unusually open field in crypto compared with closed corporate systems.

The backdrop is a genuinely bad year. Crypto has lost more than $840 million to hacks in 2026, with some tallies putting the figure past $940 million across more than 120 incidents, and April alone set a record near $600 million. The two largest losses tell the story of where the damage comes from. Kelp DAO lost roughly $292 million when attackers forged a cross-chain message on its bridge, exploiting a setup that let a single compromised node approve fraudulent withdrawals.

Drift Protocol lost about $285 million not to a code bug but to a six-month social engineering operation that ended in compromised administrative keys. Bridges have accounted for the largest share of losses, and North Korean groups have been linked to a large portion of the total. That pattern is the key context for the AI debate, because it shows where crypto actually bleeds. The biggest 2026 losses came less from novel smart-contract bugs than from human error and operational failure: social engineering, exposed keys, flawed signing flows, and misconfigured infrastructure.

Advertisement

Any assessment of what a Mythos-class model changes has to start from that reality, not from the image of an AI writing an exotic new exploit from scratch. The crypto risk surface is not only code. It is bridges, multisigs, admin keys, custody practices, signing devices, deployment scripts, and teams that still operate under startup-style security despite controlling institutional-scale money. AI makes that whole surface easier to search.

The alarm case

The bearish read is straightforward and has serious voices behind it. Simon Dedic, a well-known crypto investor, warned that a public Mythos-class model could sharply lower the cost and expertise needed to find exploitable flaws in smart contracts, and that unaudited protocols would become, in his words, sitting ducks. The argument is about barriers. Finding a subtle vulnerability in a contract used to require rare skill and considerable time.

If a model compresses that to hours and pennies, the population of people capable of attacking a weak protocol expands enormously, and the long tail of small projects, forks, and unaudited contracts becomes far more exposed. The numbers give the argument weight. Analysts have linked part of 2026’s elevated hacking losses to the growing use of advanced AI in identifying vulnerabilities, and the trend line points toward more automated, faster reconnaissance. In this view, even if the very best human attackers gain little, the marginal attacker gains a great deal, and crypto has no shortage of marginal attackers or of weak targets for them to point a capable model at.

Advertisement

The alarm is less about the top of the skill curve and more about how many more people can now operate near it. That is why small DeFi forks, rushed launches, and unaudited protocols are the obvious danger zone. A well-resourced protocol with continuous audits and strong operational controls may use AI defensively. A copy-paste fork with weak key management may simply become easier to attack.

The skeptics’ case

The counterargument is equally serious, and it comes from builders and from Anthropic itself. Michael Egorov, the founder of a major decentralized exchange, argued that smart contracts typically contain only a few thousand lines of code and are already well understood by human auditors and existing AI tools, so a more capable model changes less about direct contract exploits than the panic suggests. In his view, operational security failures and supply-chain attacks are the larger risk, and those are not primarily a smart-contract-analysis problem. That view fits the loss data, where administrative compromises and bridge failures dominate the largest incidents.

Anthropic’s post-incident review reinforces the skeptical case from an unexpected direction. The company found that the jailbreak technique that triggered the export controls did not reveal a uniquely Mythos-level capability, and that weaker models, its own and others, could reproduce the same vulnerability findings. If a capability is broadly available across many models rather than locked inside one frontier system, then restricting or releasing that single system changes less than it appears to. The skeptics do not claim the models are harmless; they claim the marginal danger of any one release is smaller than the headlines imply, because the underlying capability is diffuse and because the hardest part of most real attacks is not finding the flaw.

That is an important distinction for crypto readers. The risk is not “Claude Mythos appears, therefore every DeFi protocol is suddenly doomed.” The risk is that AI-assisted security analysis is becoming normal across many models, countries, and toolchains, which means attackers and defenders alike will have faster vulnerability discovery available. In that world, the question shifts from whether one model should be online to whether crypto teams can patch and harden faster than adversaries can scan and exploit.

Advertisement

The part everyone agrees on

Between the alarm and the skepticism sits a consensus, and it is the most useful part of the debate. Security experts broadly agree that advanced AI will not invent fundamentally new categories of crypto hack, but will dramatically speed up the attacks that already dominate the loss tables: social engineering, exposed keys, and flawed signing flows. A model does not need to hand over a finished exploit to change the economics of an attack. It can read public repositories, compare old and new versions of software, summarize audit reports, and draft convincing messages designed to catch the small operational mistakes humans make.

As one analysis put it, these exploits remain rooted in social engineering and human error; AI did not create that reality, it made it visible and accelerated it to machine speed. That reframing points straight at the 2026 loss data. The Drift and Kelp attacks, the two largest of the year, were an operational compromise and a bridge-verification failure, not clever new contract bugs. A model that accelerates reconnaissance, scans for the weakest key path or the sloppiest signing flow, and helps craft the human-facing part of an attack makes exactly those failure modes cheaper and faster to exploit.

The practical implication is that the defense that matters most is not writing unbreakable contracts, but hardening the human and operational layer where the money actually leaks. That means keys, signing steps, privileged accounts, dependencies, cross-chain message verification, and incident response. It also means treating every public disclosure and every patch as a race. In an N-hour world, yesterday’s slow security process becomes tomorrow’s exploit window.

Advertisement

The defensive flip side

The same capability that worries defenders can also serve them, which is why the long-run balance is genuinely contested. A model that finds vulnerabilities faster than humans is, pointed the other way, an audit tool that finds them before attackers do. Anthropic has argued that AI will eventually favor defenders in cybersecurity, while conceding that the transition will be turbulent, and it restored the restricted Mythos 5 specifically to organizations that defend critical infrastructure through its security program. That is the defensive version of Glasswing: put the best tools in the hands of teams whose job is to patch before adversaries exploit.

One incident has become the reference point for both sides. In early June 2026, a critical vulnerability in a privacy coin’s shielded pool was discovered using Anthropic’s Opus 4.8, a model a generation below the Mythos class. The flaw, if exploited, could have allowed unlimited minting of the token, and it had eluded expert cryptographers for roughly four years. The token dropped more than 35% on the disclosure.

The lesson cuts both ways: a weaker model catching a four-year-old flaw shows how much AI can strengthen defense, and also how much latent, undiscovered risk sits in code that a stronger model could surface, for good or ill. Faster discovery is a defensive gift when a friendly party finds the bug first and a catastrophe when an attacker does. Which side wins any given race depends on who is scanning, how fast teams can patch, and whether defenders adopt the tools as aggressively as attackers will.

What crypto users and teams can actually do

The useful response to all of this is not panic but hardening, and most of it is advice that held before any model returned. For individual users, the recurring guidance from security researchers is concrete: revoke unused token approvals, since every outstanding approval grants a contract permission to move your funds, and tools exist to review and cancel them. Move significant holdings into self-custody and cold storage, so that the keys controlling real money sit somewhere a compromised laptop cannot reach, and treat any unaudited protocol as a higher risk than it looked a year ago. When approving a transaction, use a device with a trusted screen that shows what is actually being signed, because if AI accelerates the scouting phase, the final signing step becomes the moment that matters most.

Advertisement

For teams and protocols, the priorities follow from where the losses come from. Rapid patch management matters more in an N-hour world, because the window between a disclosure and a working exploit is shrinking, so shipping and applying fixes quickly is now a security control in itself. Continuous auditing beats one-time audits, and using AI-driven analysis on your own code before attackers do is increasingly a baseline instead of an edge. Above all, harden the operational layer: secure key management, tighten signing flows, limit privileged access, and scrutinize dependencies and cross-chain message verification, because that is where the year’s biggest breaches actually happened.

Over-reliance on any single external model carries its own risk, so teams are stress-testing multiple tools instead of betting on one. The same caution applies to exchanges and custodians, where exchange security is not just a proof-of-reserves page but a question of controls, custody, liabilities, and operational discipline. For protocols experimenting with AI agents in crypto, the lesson is even sharper: automation expands what software can do, but also expands what must be secured. The more autonomy a system has, the more dangerous weak permissions and signing flows become.

The honest conclusion is that the return of these models changes the tempo of an existing problem more than it introduces a new one. Crypto was already losing record sums to human error, operational failure, and bridge design long before Fable 5 came back online. Capable AI makes the reconnaissance faster, the attacks cheaper, and the response window shorter, which is a real near-term headwind for a chronically insecure industry. It also puts a powerful audit tool in defenders’ hands, which is the reason the long-run outcome is a race instead of a verdict.

The protocols and users who treat the moment as a prompt to fix the operational basics will be the ones best placed whichever way that race runs. The ones still relying on one-time audits, permissive approvals, weak admin keys, and slow patch cycles are the obvious targets. AI did not create those weaknesses. It just made them easier to find.

Advertisement

Frequently asked questions

What is Claude Mythos 5?

Claude Mythos 5 is a frontier AI model from Anthropic that the company describes as its most capable for cybersecurity, marketed as able to find and exploit software vulnerabilities more effectively than any other model and than all but the most skilled human experts. It is the less-restricted version of the Mythos class. Its safeguarded public sibling is called Fable 5. Mythos 5 is available only to vetted organizations, not the general public.

Why did the models go offline and come back?

In June 2026, researchers showed a jailbreak that got Fable 5 to identify vulnerabilities and write exploit code, and the U.S. government issued an emergency export-control order. Anthropic disabled both models globally because it could not restrict access by nationality in real time. The controls were lifted at the end of June, and access returned in early July, with Fable 5 restored globally and Mythos 5 limited to vetted U.S. organizations. The important distinction is that the public model and the restricted cyber model did not come back under the same access rules.

Can these AI models really hack crypto protocols?

They can accelerate the work attackers already do rather than invent new attacks. Mythos-class models reportedly found more than 10,000 high-severity flaws in important software and can build a proof-of-concept exploit in under an hour. In crypto, the larger effect is speeding up reconnaissance and the human-facing parts of attacks, since the biggest 2026 losses came from social engineering, exposed keys, and operational failures instead of novel contract bugs. That makes unaudited protocols, weak bridge setups, and poor key management especially exposed.

How much has crypto lost to hacks in 2026?

Crypto has lost more than $840 million to hacks in 2026, with some tallies exceeding $940 million across more than 120 incidents, and April alone set a record near $600 million. The two largest losses were Kelp DAO at about $292 million from a bridge message forgery and Drift Protocol at about $285 million from a social engineering operation that compromised administrative keys. Those examples matter because they show where the real losses are coming from: not only code flaws, but operational and verification failures. AI makes those weak points easier to find and exploit faster.

Advertisement

Does AI make crypto hacks fundamentally worse?

The consensus among many security experts is that AI accelerates and scales existing attack types instead of creating new ones. It lowers the cost and expertise needed to find flaws, which most exposes unaudited protocols and small projects. Skeptics, including some builders and Anthropic’s own review, argue the marginal danger of any single model is smaller than headlines suggest, since weaker models can do similar work and the hardest part of most attacks is not finding the flaw. The risk is therefore less about one model suddenly changing everything and more about AI-assisted hacking becoming broadly available.

Can AI also help defend crypto?

Yes, and that is the contested part of the debate. The same ability to find vulnerabilities fast makes AI a powerful audit tool when defenders use it first. In one case, a weaker model discovered a four-year-old critical flaw in a privacy coin’s shielded pool before it was exploited. Anthropic argues AI will eventually favor defenders, while admitting the transition will be turbulent, so the outcome depends on who adopts the tools faster.

What should crypto holders do to protect themselves?

Security researchers recommend revoking unused token approvals, moving significant holdings into self-custody and cold storage where keys sit offline, and treating unaudited protocols as higher risk. When signing transactions, use a device with a trusted screen that shows exactly what is being approved. These steps address the human and operational failures that account for most real losses, which AI mainly accelerates instead of replacing. The goal is to reduce the number of places where an attacker can turn a mistake into a transfer.

Is Mythos 5 available to the public now?

No. After the export controls were lifted, Anthropic restored the safeguarded Fable 5 to global users, but the less-restricted Mythos 5 returned only to a set of vetted U.S. organizations that defend critical infrastructure, through an opt-in program. The company says it will work to expand access over time, but the model with the full cyber capability is not behind a consumer subscription. Public users may have access to stronger AI tools than before, but not to the same unrestricted Mythos 5 setup described in the security program.

Advertisement

Disclaimer: This article is for information and educational purposes only and does not constitute financial, investment, legal, or security advice. It describes an evolving situation involving AI capabilities and cybersecurity risk, and details may change. Nothing here is a recommendation to buy, sell, or use any specific model, asset, or service. Always do your own research and consult qualified professionals for security decisions. Information is accurate as of July 2, 2026, and may change.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Ethereum Price Analysis: ETH’s Double Rejection at $2K Spells More Trouble Ahead

Published

on

After several failed attempts to extend its recovery, Ethereum is beginning to show signs of exhaustion beneath the major100-day MA. The latest rejection from this zone has weakened short-term momentum and increases the probability of a broader pullback if key support levels fail to hold.

Ethereum Price Analysis: The Daily Chart

On the daily timeframe, ETH’s outlook is gradually shifting toward a bearish bias after multiple failed attempts to reclaim the 100-day moving average. The repeated rejection from this dynamic resistance around $1.95K, combined with the emergence of bearish daily candles, suggests buyers are losing momentum.

Meanwhile, Ethereum continues to struggle with the descending channel, with the upper boundary represented by the white trendline serving as the most critical support.

If sellers manage to push the price back inside this channel, it would confirm a bearish continuation and likely trigger a deeper decline toward the $1.56K to $1.64K demand zone. On the upside, bulls must first reclaim the $1.88K to $1.91K resistance area before attempting another move toward the 100-day MA near $1.95K.

Advertisement

ETH/USDT 4-Hour Chart

The 4-hour chart has turned more bearish after Ethereum broke below its ascending trendline, signaling that buyers have lost short-term control. This breakdown shifts the focus toward lower support levels unless bulls can quickly reclaim the broken structure.

The first support now lies within the $1.85K to $1.87K demand zone, where price is currently attempting to stabilize. Losing this area would likely accelerate the decline toward the next major demand zone between $1.75K and $1.79K.

On the other hand, the $1.88K to $1.91K supply zone has become the primary threshold for buyers. A successful reclaim of this region would invalidate the immediate bearish scenario and could allow Ethereum to challenge the descending resistance and the 100-day moving average once again.

Sentiment Analysis

The Coinbase Premium Index remains in negative territory, indicating that Ethereum continues to trade at a discount on Coinbase relative to other major exchanges. This persistent negative premium suggests buying pressure from U.S.-based institutional participants remains relatively weak despite the recent recovery.

Advertisement

Historically, sustained positive readings have accompanied stronger bullish phases, whereas prolonged negative values often reflect cautious institutional sentiment. Until the premium returns to positive territory and remains there consistently, the current rebound may struggle to develop into a sustained uptrend, leaving Ethereum vulnerable to additional downside pressure if technical support levels begin to fail.

The post Ethereum Price Analysis: ETH’s Double Rejection at $2K Spells More Trouble Ahead appeared first on CryptoPotato.

Source link

Advertisement
Continue Reading

Crypto World

XRP Price Analysis: Is a Drop Below $1 Inevitable as Sellers Stay in Control?

Published

on

Ripple’s XRP remains under steady selling pressure as the latest rebound attempts continue to lose momentum. The recent price action suggests sellers are maintaining control, while buyers are once again being forced to defend a critical support area.

Ripple Price Analysis: The Daily Chart

The daily chart shows little improvement compared to the previous analysis. The asset continues to trade beneath the descending resistance trendline while remaining well below the major moving averages, preserving the broader bearish market structure.

The latest candles indicate that sellers remain in control after another failed recovery attempt, pushing the price back toward the key demand zone around $1.01 to $1.04. This support has repeatedly prevented a deeper decline over the past several weeks, making it the most important level to monitor.

As long as XRP remains below the descending trendline and the main resistance between $1.24 and $1.29, the broader outlook favors continued weakness. A decisive breakdown below the $1.01 to $1.04 support zone would likely accelerate the decline toward the next major support around $0.89.

Advertisement

XRP/USDT 4-Hour Chart

On the 4-hour timeframe, rather than recovering from support, XRP has continued to print lower highs and lower lows while remaining capped by the descending resistance trendline.

The recent rejection near $1.09 was followed by another decline toward the $1.01 to $1.04 demand zone, showing that buyers have yet to regain control. This area remains the last significant short-term defense for the bulls.

If this support fails, the bearish momentum is likely to intensify and extend the decline toward lower levels. Conversely, buyers would first need to reclaim the descending trendline before any meaningful recovery toward the $1.24 to $1.29 resistance zone could be considered. Until then, rallies are likely to face selling pressure and remain corrective in nature.

The post XRP Price Analysis: Is a Drop Below $1 Inevitable as Sellers Stay in Control? appeared first on CryptoPotato.

Advertisement

Source link

Continue Reading

Crypto World

Bitcoin Price Analysis: Will the Next Liquidity Sweep Push BTC Below $60K?

Published

on

Bitcoin continues to trade without a decisive directional bias as both buyers and sellers defend key technical levels. Until one side forces a confirmed breakout, the current environment is likely to remain dominated by range-bound price action and short-term liquidity grabs.

Bitcoin Price Analysis: The Daily Chart

The daily chart suggests Bitcoin is still locked in a prolonged consolidation phase between the major support around $57.8K to $60.2K and the primary resistance at $66.2K to $66.8K. Despite several attempts by both buyers and sellers, neither side has managed to establish a sustained trend beyond these boundaries.

This type of market structure typically favors liquidity sweeps and stop hunts around local highs and lows before a genuine directional move develops. As long as the asset remains trapped between these two zones, traders should expect continued choppy price action rather than a sustained trend.

A confirmed breakout above the $66.2K to $66.8K resistance could trigger another leg toward the higher resistance around $72K to $74K. Conversely, losing the $57.8K to $60.2K demand zone would invalidate the current consolidation and expose Bitcoin to a deeper correction.

Advertisement

BTC/USDT 4-Hour Chart

On the 4-hour timeframe, Bitcoin is trading inside an even tighter range within the broader daily consolidation. Buyers continue defending the support region at $61.8K to $62.2K, while sellers repeatedly cap rallies below the resistance around $64.9K to $65.6K.

Holding above the buyers’ defense could allow another recovery attempt toward the upper boundary of this range. However, the recent sequence of lower highs indicates that sellers still hold a slight advantage, making a breakdown below the $61.8K to $62.2K support zone the more likely scenario if buying momentum continues to weaken. Such a move could accelerate selling pressure toward the lower boundary of the broader daily range.

Sentiment Analysis

The two-week liquidation heatmap shows a notable concentration of liquidity just beneath Bitcoin’s recent lows. This suggests futures market participants have been actively defending that area, with buyers stepping in to absorb selling pressure whenever the price approaches the lower liquidity cluster.

At the same time, a substantial pool of liquidity remains above the market around the $66K to $67K region, indicating that both sides still have attractive liquidation targets. As long as Bitcoin remains inside its broader consolidation, the price is likely to continue oscillating between these liquidity zones before a decisive breakout determines the next major trend.

Advertisement

The post Bitcoin Price Analysis: Will the Next Liquidity Sweep Push BTC Below $60K? appeared first on CryptoPotato.

Source link

Continue Reading

Crypto World

$1.6 Million Drained in a Blink: User Recounts His Dramatic Coldcard Wallet Hack

Published

on

$1.6 Million Drained in a Blink: User Recounts His Dramatic Coldcard Wallet Hack

A Canadian entrepreneur lost more than $1.6 million in Bitcoin (BTC) from a Coldcard hardware wallet in under seven minutes, part of a wave that may total 1,367.05 BTC.

The case exposes an uncomfortable truth about self-custody: doing everything right may not be enough.

How One Holder Lost 18 BTC in Seven Minutes

Cold storage means keeping private keys on a device that never touches the internet. Jonathan Goodman followed that principle carefully, storing his Coldcard in a safety deposit box.

His 18.25 BTC sat in wallets secured across multiple safes. He never shared his seed phrase and kept every device isolated from online exposure.

Advertisement

None of it mattered on July 29, 2026. Between 9:36 and 9:43 that evening, every wallet he controlled was emptied.

Follow us on X to get the latest news as it happens.

Goodman first heard about a broader problem while at his cottage.

Advertisement

Assuming it would not affect him, he checked the balances in the Wasabi wallet software and found a series of red withdrawal transactions.

The vulnerability traces back to 2021. A flaw in the code that generates seed phrases left certain devices exposed, and attackers allegedly used artificial intelligence to brute-force the affected seed phrases.

He is filing reports with the police and the Ontario Securities Commission. Recovery hopes remain slim, though he wrote that the hardest part was having done everything right.

The scale extends far beyond one victim. Galaxy Research identified three suspected attack waves targeting addresses generated by Coldcard devices.

Advertisement

Those waves involved 4,585 source addresses and drained 1,367.05 BTC, worth roughly $88.6 million at the time of reporting.

Galaxy Research estimated the observed size of the Coldcard hack is now 1,367.05 BTC across 4,585 addresses. Source: X/@glxyresearch

What Galaxy Research Found in the Attack Data

Galaxy Research head Alex Thorn indicates that the attacks appear to be ongoing. He urged users who have not moved funds from potentially vulnerable setups to act immediately.

The first two waves showed similar transaction patterns and may share a common operator, though that remains unconfirmed. The third differed significantly, suggesting either updated tools or a separate actor exploiting the same key space.

The stolen Bitcoin remains in attacker-controlled addresses, with no further movement. Drained holdings had sat dormant for an average of 3.18 years, suggesting most victims were long-term holders rather than institutions.

Galaxy stressed an important caveat. Its findings rely solely on on-chain data and have not definitively confirmed insufficient randomness in the generation of the affected addresses.

Advertisement

“…this is a blow to bitcoin self-custody and we need to do better as a community: with security, with education, and with being realistic about complexity, expectations, and recommendations we make to friends, family, and the public…,” Alex Thorn said.

Analyst Shanaka Anslem Perera highlighted a deeper irony in Coldcard’s own documentation. The manual describes its default seed-generation method as the one it trusts most, while labeling it as low risk to users.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights.

Alternatives exist within the same device. Users can combine hardware output with dice rolls, or rely on dice alone, which the manual says removes all trust in the hardware. Most users likely followed the default path. That is precisely the method Galaxy Research now links to the losses.

Advertisement

The conceptual tension runs deeper. Reproducibility, prized for verifying firmware, becomes a liability in secret generation, since both weak and strong seeds produce valid 24-word phrases that appear identical.

Devices marketed under a “Don’t Trust, Verify” ethos can still harbor entropy flaws, leaving no visible trace. Affected users should assess their setups and migrate funds where necessary.

The post $1.6 Million Drained in a Blink: User Recounts His Dramatic Coldcard Wallet Hack appeared first on BeInCrypto.

Advertisement

Source link

Continue Reading

Crypto World

Iran Denies Trump’s Hormuz Deal, Oil Jumps but Bitcoin Watches

Published

on

WTI Crude Oil and Bitcoin Price Performance. Source: TradingView

Iran has denied President Donald Trump’s claim that a deal exists to reopen the Strait of Hormuz, the world’s busiest oil route. Oil jumped on the denial.

Bitcoin (BTC) barely moved. That gap says a lot about what crypto traders now choose to ignore.

WTI Crude Oil and Bitcoin Price Performance. Source: TradingView
WTI Crude Oil and Bitcoin Price Performance. Source: TradingView

Trump Says a Hormuz Deal Exists. Iran Says It Does Not

Trump posted on Truth Social early Sunday. He said he had canceled a planned strike on Iran.

He wrote that Iran and its neighbors asked him to hold off. The reason, he said, was that “the perimeters of a deal has been agreed to.”

That deal would open the Strait of Hormuz right away. It would also end Iran’s nuclear threat.

Iran answered within hours. Fars News Agency quoted a source close to the nuclear talks.

“There is no agreement regarding the reopening of the Strait of Hormuz, and the news published about it is false,” Fars News Agency, via CGTN.

Follow us on X to get the latest news as it happens

Iran’s acting defense minister, Seyyed Majid Ibn Al-Reza, called Trump’s words psychological warfare. Fars International called Trump’s terms a wish list.

Advertisement

None of this is new. An earlier pause in strikes in late July also went nowhere.

Talks did happen, though. Qatari mediators met Iran’s foreign minister, Abbas Araghchi, and US envoy Steve Witkoff on Saturday. Saudi Crown Prince Mohammed bin Salman urged Trump to cool things down.

Why Oil Jumped and Bitcoin Did Not

Start with the map. The Strait of Hormuz is a narrow sea lane between Iran and Oman.

Advertisement

About 20 million barrels of oil passed through it every day in 2024, EIA data shows. That is roughly a fifth of the oil the world uses.

Oil Traffic In the Strait of Hormuz. Source: EIA
Oil Traffic In the Strait of Hormuz. Source: EIA

Here is the problem. Only about 2.6 million barrels a day can go around it, through pipelines in Saudi Arabia and the UAE.

The rest has nowhere else to go. That is why one denial can move a market this big.

WTI crude, the US benchmark, closed at $84.67 on Friday. It then rose about 2.4% to trade near $86.79.

Oil Price Performance. Source: TradingView
Oil Price Performance. Source: TradingView

The denial also puts an official forecast in doubt. On July 7, the EIA cut its Brent crude forecast for this quarter by $27 a barrel, to $74. It cited the June US-Iran deal and busier traffic through the strait.

That June deal has since fallen apart. Analysts tracking Hormuz reopening timelines now expect the route to stay restricted into 2027.

Advertisement

Bitcoin did almost nothing. It added 0.08% in 24 hours and sat near $63,063.

Bitcoin Price Performance. Source: BeInCrypto
Bitcoin Price Performance. Source: BeInCrypto

It also trades about 50% below its record of $126,080, set on October 6, 2025. The muted Bitcoin price reaction suggests traders now ignore headlines that change nothing on the water.

What Happens Next

Oil matters to crypto for one reason. It feeds inflation.

June proved the link. US energy prices fell 5.7% that month, the steepest drop since April 2020.

The BLS said energy did most of the work. Headline prices fell 0.4% over the month. Annual inflation cooled to 3.5% from 4.2%.

Advertisement

Energy is still expensive over a full year, however. Gasoline is up 26.7%.

So a lasting jump in oil would undo that progress. That makes Federal Reserve rate cuts harder to justify. Rate cuts are what assets like Bitcoin want.

The next check comes August 12, when the BLS publishes July inflation.

Until ships can sail through Hormuz freely, oil keeps its war premium. Bitcoin keeps waiting.

Advertisement

The post Iran Denies Trump’s Hormuz Deal, Oil Jumps but Bitcoin Watches appeared first on BeInCrypto.

Source link

Advertisement
Continue Reading

Crypto World

South Koreans are Sending Stablecoins to Foreign Exchanges at Record Rate

Published

on

Panic Hits Japan and South Korea Markets: Can Crypto Become the Big Winner?

South Koreans sent $367 million more in stablecoins out of the country than they brought back in June. It was the 18th month in a row that money left.

The Financial Supervisory Service (FSS) handed those numbers to lawmaker Lee Jong-wook. The streak started in January 2025. Traders are chasing something they cannot get at home.

Why South Korea’s Stablecoin Outflows Keep Widening

Five exchanges handle almost all local crypto trading. They are Upbit, Bithumb, Coinone, Korbit, and Gopax.

In June, they sent roughly $1.8 billion in stablecoins to foreign platforms. About $1.44 billion came back. The gap was $367 million.

Advertisement

Local media reported that across the whole second quarter, close to $1.1 billion left.

Follow us on X to get the latest news as it happens

The size is what caught the attention of lawmakers. Koreans bought about $470 million of foreign shares in June, according to the Korea Securities Depository. The stablecoin outflow matched 77.6% of that figure.

Advertisement

A year earlier, the ratio sat near 20%. Crypto money now leaves the country almost as fast as stock money.

The trend held even as the local market shrank. Seoul confirmed a 22% crypto tax for 2027, and domestic trading volume fell nearly 55% in the first half.

One caveat belongs here. The FSS counts only the five licensed exchanges, so coins sent to private wallets first never show up.

What Foreign Exchanges Offer That Seoul Cannot

Korean platforms mostly offer plain spot trading. That is the whole problem.

Advertisement

Foreign venues offer far more.

  • Crypto derivatives with heavy leverage
  • Dollar-based real world assets (RWAs)
  • Decentralized Finance (DeFi) protocols
  • Staking rewards

Some also list Samsung Electronics, SK Hynix, and Hyundai Motor as tradable contracts. Leverage on those can run into the tens of times. A stablecoin transfer is the cheapest way in.

The same hunger shows up in regulated markets. Koreans put a net $1.28 billion into foreign leveraged exchange-traded funds (ETFs) in June. That was more than triple the May total.

Seoul did try to compete. Korea listed its first single-stock leverage ETFs on May 27. Less than a month later, FSS Governor Lee Chan-jin publicly criticized them.

A bigger fix is on the way. Four agencies published a plan on July 19 to legalize won-backed stablecoins. A separate bill would treat crypto as national wealth.

Advertisement

The Leverage Unwind Sitting Behind the Numbers

The regulator’s worry proved well founded. Fourteen leveraged ETFs track Samsung and SK Hynix. Their assets shrank from about $10.7 billion at the end of June to $6.3 billion by July 13.

Margin loans fell too. Korean brokerages held roughly $21.8 billion on July 30, down about $4.4 billion since June 24.

The Kobeissi Letter says $67 billion has drained from margin accounts across Korea, China, and Taiwan. BeInCrypto could not confirm that total.

The KOSPI lost 22.19% in July, its worst month since 1997. Then it jumped 17.91% on July 31, a record single day.

Economist Steve Hanke blames global fatigue with AI hype. That rebound, led by a 29.95% gain in SK Hynix, cuts against the idea. Asia’s unwinding AI trade has swung just as hard in Tokyo.

The stablecoin figures tell a steadier story. Korean money is not hiding. It is relocating, much as it did when Korean investors cashed out late last year.

Advertisement

Lee sits on the National Assembly’s finance committee for the People Power Party. He wants the government to act.

“As the ‘coin move’ from domestic to overseas spreads, funds are flowing abroad, and investors are being defenseless against high-risk derivatives on foreign exchanges,” local media reported, citing Lee.

Seoul can close the exits or widen the menu at home. That choice decides what month 19 looks like.

The post South Koreans are Sending Stablecoins to Foreign Exchanges at Record Rate appeared first on BeInCrypto.

Advertisement

Source link

Continue Reading

Crypto World

Crypto meets Wall Street using perps

Published

on

Crypto meets Wall Street using perps

Everything under one login

Round-the-clock trading is one part of the plans exchanges have for traditional assets. Coinbase and Binance want customers to trade crypto, stocks and other products through one account, a model both have described as an “everything exchange” or financial super app.

Coinbase is preparing to offer U.K. customers equities and derivatives alongside crypto after securing investment-services authorization from the Financial Conduct Authority under rules based on the Markets in Financial Instruments Directive, or MiFID.

The authorization allows Coinbase to offer traditional shares to retail customers and crypto, equity and commodity perps to eligible institutional and advanced traders, the company said.

“Perpetual futures are a core focus of what Coinbase is trying to bring to market,” said Keith Grose, U.K. CEO at Coinbase, in an interview with CoinDesk. “We’re really focused on being the ‘everything exchange.’”

Advertisement

Grose said the longer-term plan is to bring spot crypto, perpetual futures, traditional equities, and eventually tokenized versions of other assets into one place. That could allow customers to use positions across different markets as collateral or borrow against their equities.

Using stocks as collateral

Binance is testing another part of the model by allowing some high-net-worth clients to use tokenized stock positions as collateral for other trades.

“We recognize you could have Nvidia or SpaceX stock, a tokenized version,” Jan said. “You could actually have a tokenized stock put on our exchange, and we’ll use that as collateral for you to trade something else. It could be a crypto derivative.”

Source link

Advertisement
Continue Reading

Crypto World

Trump Media transfers 2,628 BTC as holdings shrink

Published

on

Trump Media transfers 2,628 BTC as holdings shrink - 2

Trump Media-linked wallets transferred 2,628 Bitcoin, valued at about $165 million, to Crypto.com on Aug. 2, according to on-chain analysts Lookonchain.

Summary

  • 2,628 BTC moved to Crypto.com, but no company filing has confirmed an outright sale yet.
  • Trump Media reported 9,542.16 BTC in March, including 4,260.73 BTC pledged as secured convertible-note collateral.
  • Lookonchain estimates realized and unrealized Bitcoin losses at $555 million after seven months of transfers.

The movement reportedly reduced the wallets’ remaining balance to about 4,261 BTC.Lookonchain described the movement as another sale and estimated that Trump Media had disposed of 7,281 BTC over seven months. However, neither Trump Media nor an SEC filing had confirmed the latest coins were sold as of Aug. 2. An exchange deposit can precede a sale, custody change, collateral arrangement or another internal transaction.

Advertisement

Trump Media transfer is not a confirmed sale

Lookonchain said the company originally acquired 11,542 BTC for about $1.37 billion, averaging $118,522 per coin. Its post stated, “It looks like Trump Media sold another 2,628 BTC,” wording that reflects uncertainty about the final transaction.

EmberCN separately traced the 2,628 BTC to Crypto.com and estimated that the linked wallets had transferred out about 7,281 BTC. The Arkham entity page identified two recent movements totaling roughly 2,628 BTC, including transfers of about 2,429 BTC and 198.9 BTC.

Trump Media transfers 2,628 BTC as holdings shrink - 2

Source: Akham

Remaining Bitcoin nearly matches pledged collateral

Trump Media’s latest quarterly filing provides the strongest company-confirmed baseline. The company reported 9,542.16 BTC at March 31, with a cost basis of $1.131 billion and a fair value of $647.1 million. It recorded no change in the number of coins during the first quarter.

The SEC filing also said 4,260.73 BTC served as collateral for convertible notes and could not be withdrawn or distributed unless indenture requirements were met. The restrictions are scheduled to end no later than May 29, 2028.

Advertisement

The reported post-transfer balance of about 4,261 BTC almost exactly matches that pledged amount. This suggests the tracked wallets may now mainly contain restricted collateral, but the on-chain labels do not prove the accounting or legal status of each coin.

The $555M loss remains an outside estimate

Lookonchain calculated that the 7,281 BTC left the linked wallets at an average price of $74,855, generating about $545 million. It then estimated Trump Media’s combined realized and unrealized Bitcoin loss at approximately $555 million.

Those figures are not company-confirmed. The calculation assumes exchange transfers became sales near the observed market prices. It also combines estimated losses on transferred coins with the paper loss on the remaining balance. Trump Media’s March filing confirmed a lower fair value, but said the company had not realized material digital-asset losses at that reporting date.

Trump Media transferred 2,650 BTC worth about $205 million to Crypto.com on May 22. The coins remained in an exchange-linked wallet when that report was published, showing why a transfer should not automatically be reported as a completed sale.

Advertisement

Truth API launch adds separate regulatory scrutiny

The Bitcoin movement followed Trump Media’s Aug. 1 launch date for Truth API, a paid service providing institutional customers with low-latency access to influential Truth Social posts. The company said the product delivers posts in milliseconds and could create a recurring revenue stream. Its revenue expectations remain forward-looking claims.

U.S. Senators Adam Schiff and Elizabeth Warren asked the SEC to investigate whether the service could violate federal securities laws. Their letter raised concerns that paying firms could receive market-moving presidential posts faster than ordinary users. The request is not an SEC finding, and the agency had not publicly announced an enforcement action.

Crypto.news reported that Trump Media posted a $405.9 million first-quarter net loss, partly reflecting unrealized markdowns across Bitcoin, Cronos and securities.

The company’s next quarterly filing should clarify whether the May and August transfers were sales, custody movements or transactions linked to hedging and financing arrangements. No verified Bitcoin or DJT price movement can be attributed solely to the Aug. 2 transfer.

Advertisement

Source link

Continue Reading

Crypto World

Michael Saylor says BIP-110 lacks miner consensus

Published

on

what it means for BTC

Bitcoin Improvement Proposal 110 can no longer reach its 55% voluntary miner threshold during the current difficulty period, according to blockchain signaling data and an Aug. 1 analysis from Strategy Executive Chairman Michael Saylor. 

Summary

  • 28 signaling blocks appeared among 1,108, leaving BIP-110 at 2.53% support as of Aug. 2.
  • Saylor said all 24 initial signals came from DATUM miners sharing rewards through OCEAN’s system.
  • Mandatory signaling starts at block 961,632, when enforcing nodes reject every non-signaling block as invalid.

Strategy’s official website identifies Saylor as the company’s executive chairman. At block 960,561, Saylor counted 24 signaling blocks among 946, equal to 2.54%. He said every signal came from miners using DATUM while sharing rewards through OCEAN, with none identified outside that system. By 11:13 UTC on Aug. 2, the public BIP-110 monitor had advanced to block 960,723 and counted 28 signals among 1,108 blocks, or 2.53%. Only 908 blocks remained.

BIP-110 cannot reach voluntary lock-in

The proposal needs 1,109 signaling blocks within one 2,016-block difficulty period to lock in voluntarily. Even if every remaining block in the current period signals, the total could reach only 936. Saylor therefore said the threshold was “mathematically unreachable” and argued that the observed count was “not miner consensus.”

The latest monitor supports that arithmetic. However, it does not independently establish Saylor’s attribution of every signaling miner. His pool claim applied to the 24 blocks examined at block 960,561. The monitor confirms that the overall rate remained almost unchanged after four additional signals appeared.

BIP-110 would restrict Bitcoin transaction data

BIP-110, formally called the Reduced Data Temporary Softfork, proposes seven temporary consensus restrictions. These include limiting most new output scripts to 34 bytes, capping OP_RETURN outputs at 83 bytes, restricting certain data pushes to 256 bytes and temporarily limiting several Taproot features. Outputs created before activation would remain exempt.

Advertisement

Supporters say the one-year rules would reduce arbitrary data storage and keep Bitcoin focused on monetary activity. Critics, including Saylor and Blockstream co-founder Adam Back, argue that consensus rules should not determine which currently valid transaction structures deserve block space. As previously reported, Saylor said fee markets and individual node policies offer a safer response to disputed data use.

Saylor questions OCEAN and DATUM’s role

Saylor also alleged that OCEAN made BIP-110 signaling the default on an existing endpoint. He called the initiative a “vertically integrated marketing campaign for Knots and OCEAN/DATUM.” That description represents his interpretation rather than a finding by an independent technical body.

The official BIP-110 installation guide directs users toward Bitcoin Knots and includes instructions for pointing rented hashpower at a DATUM node. OCEAN’s DATUM documentation says miners create block templates through their local nodes, while the pool coordinates reward splits instead of constructing mining work. Those documents confirm the technical relationship, but they do not independently establish Saylor’s claim about promotional intent.

Mandatory signaling becomes the next test

The current voluntary period ends at block 961,631. From block 961,632 through 963,647, software enforcing BIP-110 is designed to reject every block that does not signal bit 4. The proposal would then lock in at block 963,648 and activate at block 965,664, when its transaction restrictions would begin for 52,416 blocks.

Advertisement

Saylor warned that any 100% signaling reading during the mandatory window would reflect the software rule rather than a fresh vote of support. Foundry USA Pool has separately asked its mining customers to vote on whether the pool should signal, with its voting window scheduled to close near block 961,632. No verified result was publicly available by Aug. 2.

The next decisive evidence will come from major mining pools, exchanges, wallets and node operators before the mandatory period starts. Low voluntary signaling does not automatically cancel BIP-110 because its deployment includes mandatory signaling. However, enforcing nodes could follow a minority chain if most hashpower continues mining non-signaling blocks. Saylor and Back warned that enforcing the proposal without broad agreement could divide the network.

Source link

Advertisement
Continue Reading

Crypto World

Coldcard Hack Fallout Widens as Bitcoin Losses Hit $88.6M

Published

on

Crypto Breaking News

Bitcoin has seen a spike in very small transfers—moves of less than 1 BTC—that match the intensity last observed around the collapse of FTX. The renewed activity comes as researchers continue to track a suspected Coldcard wallet-related hack, underscoring how quickly users are reacting when self-custody tools appear compromised.

According to CryptoQuant head of research Julio Moreno, Friday recorded the highest daily level of sub-1 BTC transfers since November 2022, with 39,600 BTC moved. The total was just 300 BTC below 39,900 BTC transferred on Nov. 16, 2022, shortly after FTX filed for bankruptcy. Moreno framed the comparison as a sign of urgency and said users appear to be “taking action.”

Key takeaways

  • Daily Bitcoin transfers below 1 BTC hit their highest level since November 2022, totaling 39,600 BTC, per CryptoQuant’s Julio Moreno.
  • Galaxy Research says the suspected Coldcard incident caused estimated losses of 1,367 BTC across 4,585 addresses, after identifying a further 207.7 BTC taken in an additional wave.
  • Galaxy’s Alex Thorn warned that the attack was still ongoing and urged affected users to move funds immediately from Coldcard-generated addresses.
  • The incident is reigniting debate over whether self-custody is safer than relying on third-party platforms, with executives arguing the impact differs across user approaches.

Small-transfer surge echoes the post-FTX era

While large market moves often capture headlines, the current data point focuses on behavior at the granularity of everyday wallet operations: sub-1 BTC transfers. Moreno’s analysis suggests the market is seeing a level of small withdrawals not observed since the period following FTX’s bankruptcy filing.

The comparison matters because it points to reflexive user behavior—moving funds in smaller increments—rather than a single, coordinated “whale” action. In the wake of FTX, exchange-related uncertainty drove users toward faster, more defensive moves. Here, the catalyst is different: ongoing concerns tied to Coldcard-generated addresses.

Moreno’s observation that these transfers had not occurred at similar daily intensity since the FTX collapse suggests that the Coldcard incident may be triggering a comparable sense of immediate risk. That doesn’t prove equivalence in scale or cause, but it does show that user reaction can look similar even when the underlying event is distinct.

Advertisement

Galaxy Research details additional theft wave

Galaxy Research, part of Galaxy Digital, reported Saturday that it had identified another attack wave tied to the suspected Coldcard hack. In that wave, an additional 207.7 BTC was drained—valued at roughly $13.2 million at the time Galaxy cited.

Including the newly identified activity, Galaxy estimated total losses of 1,367 BTC, affecting 4,585 addresses. Galaxy’s reporting suggests the incident is not a single moment of exploitation, but an ongoing process where both victims and attacker infrastructure continue to emerge as investigators refine their tracking.

Galaxy also points readers to a Coldcard-focused tracking resource, “Coldcard Watch,” as part of the broader transparency around wallet activity connected to the suspected incident.

“Still ongoing” warnings push users toward immediate withdrawal

Alex Thorn, Galaxy Digital’s head of firmwide research, said in an X post on Sunday that the attack remained active. Thorn urged users to move funds from Coldcard-generated addresses immediately if they had not already done so.

Advertisement

Thorn added that his team continues to identify both new victim addresses and attacker addresses. He also noted that reports from users have helped investigators and authorities track stolen funds, reinforcing a practical implication for readers: in incidents where on-chain patterns are evolving, user-provided information can accelerate investigative work.

The warning is also a reminder that self-custody isn’t only about holding assets—it’s about operational readiness. When wallet-generated addresses are implicated, the “time to react” becomes part of the security model, whether users follow best practices or not.

Self-custody debate returns as commentators argue “failure” vs “risk control”

The suspected Coldcard hack has again pulled the conversation toward the long-running fault line in crypto security: self-custody versus third-party custody. Self-custody is a foundational principle in Bitcoin, emphasizing user control without dependence on intermediaries. Yet security incidents involving consumer-grade tools can complicate the narrative and raise fresh questions about usability and safety.

Nick Neuman, CEO of Bitcoin security company Casa, pushed back against claims that “self-custody is over.” He argued that because self-custody is distributed, users have time to respond as threats are identified. Neuman also estimated that potentially 10 times more Bitcoin was protected through self-custody than was stolen and identified so far in the attack.

Advertisement

That position reframes the debate from whether an incident can occur at all to how the system responds once the risk becomes visible. In Neuman’s view, the existence of ongoing victims does not negate the defensive advantage that self-custody can provide—especially when users monitor, verify, and act on warnings.

Others took the issue in a different direction. Eric Balchunas, a senior ETF analyst at Bloomberg, argued via X that Bitcoin exchange-traded funds may offer a safer and more convenient alternative for many users, pointing to the longer operating history of ETFs.

In contrast, critics of that argument say the Coldcard episode reflects a failure of a specific wallet provider or implementation rather than a fundamental breakdown of self-custody itself. The tension here is important for readers to recognize: “self-custody” is not a single technology—it’s a set of practices and tools—so incidents can be interpreted as either systemic or localized depending on what readers believe broke down.

What to watch next

With Galaxy saying the attack is still unfolding and continuing to identify new victim and attacker addresses, the next key signal will be whether transfer patterns and wallet-specific indicators stabilize as users move funds. For investors and builders, the bigger question is how quickly the broader community can validate affected addresses and coordinate response—because in cases like this, speed is part of the security outcome.

Advertisement

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Source link

Advertisement
Continue Reading

Trending

Copyright © 2025