Bitcoin’s on-chain “capitulation” phase has stretched to its longest stretch since the aftermath of the FTX collapse, according to Glassnode. In a Monday update, the firm pointed to its composite cycle-tracking framework showing that a large share of Bitcoin price-related indicators has remained in its most defensive, low-conviction stage through 2026.

The key nuance is that, while conditions resemble late-cycle stress, Glassnode’s heatmap readings have not yet fully matched the deepest “floor” signatures that appeared during earlier bear-market bottoms. At the same time, Glassnode’s latest Market Pulse report suggested that on-chain activity has strengthened—an important counterpoint for investors weighing whether capitulation is finally giving way to stabilization.

Key takeaways

• Glassnode’s “Bitcoin Cycle Position Heatmap” shows 45 tracked BTC price metrics have been in the longest capitulation phase since late 2022’s FTX fallout.
• Rafael Schultze-Kraft said the current period sits in its coldest stretch since FTX, but still not at the unanimous deep-blue level that historically marked cycle floors.
• The heatmap uses a basket of 45 indicators, heavily incorporating investor profitability across short-term (STH) and long-term (LTH) holders.
• Glassnode reported stronger network engagement, including daily active addresses and entity-adjusted transfer volumes moving above upper statistical bands.

Heatmap extends capitulation longer than past cycles

Glassnode’s “Bitcoin Cycle Position Heatmap,” created by the platform co-founder Rafael Schultze-Kraft, aggregates data from 45 different Bitcoin price and market-health indicators. In the heatmap, blue shading is associated with capitulation conditions, while red is used to highlight the euphoria typical of late-cycle momentum toward peaks.

The tool flipped from a more euphoric configuration after November 2021 into a majority-blue dominance throughout 2022. That shift coincided with the collapse of FTX, which occurred in late 2022 and aligned with analysts pointing to Bitcoin’s bear-market bottom around $15,600, according to earlier coverage referenced from Cointelegraph.

Schultze-Kraft’s latest read of the heatmap emphasizes both duration and depth. He said the current stage is “its coldest stretch since FTX” and is late in the bear market cycle, but remains “not yet the unanimous deep blue” that had historically indicated a more definitive floor.

For traders and long-term investors, this matters because cycle-position models are often less about predicting a specific day and more about gauging whether market behavior is approaching the “reset” phase that follows widespread distribution and forced risk reduction.

Why profitability and holder behavior shape the signal

Beyond conventional price gauges like market cap, the heatmap places significant weight on the profitability of Bitcoin’s investor base. It divides participants into short-term holders (STH) and long-term holders (LTH), reflecting that these cohorts typically react differently during sell-offs and recoveries.

Schultze-Kraft also highlighted an additional complication: some indicators change character as the composition of the investor base ages. One example is dormancy, measured by how many days a unit of BTC spent idle before being moved on-chain. Because dormancy tends to increase as the chain ages, the dormancy signal can differ between cycles—meaning the same threshold may not “mean” the same thing across different bear markets.

That kind of calibration is crucial when interpreting heatmap results. A long capitulation stretch can be read two ways: either distribution is still ongoing, or the market has moved into a prolonged sideways grind where participants are not capitulating in the most extreme fashion yet. Glassnode’s framing—that the readings are colder than prior periods but not at maximum floor conditions—leans toward the second interpretation.

Network activity improves even as capitulation persists

While the cycle heatmap focuses on sentiment and cycle-stage indicators, Glassnode’s Monday Market Pulse report pointed to strengthening on-chain behavior. The firm reported that daily active addresses and entity-adjusted transfer volumes moved above their upper statistical bands, a change it characterized as a “notable increase” in network engagement and economic throughput.

That improvement matters because it suggests a degree of market function is returning even if the broader cycle signal still shows capitulation characteristics. In other words, activity may be shifting from panic-driven flows toward more sustained utilization, which can be an early ingredient of stabilization.

Glassnode also noted that stabilization of capital outflows persisted despite investor reaction to a separate security event: a low-entropy bug exploit in Coldcard hardware wallets. The implication is that even if some participants reacted defensively to the news, the broader on-chain throughput did not collapse further.

Supporting this, CryptoQuant data cited by Cointelegraph compared a rise in on-chain transfers of 1 BTC or less with the pattern seen after the FTX implosion. Specifically, it noted that on July 31 the daily tally reached 39,600 BTC, compared with 39,900 BTC on Nov. 16, 2022. The comparison underlines how transaction behavior can echo prior stress periods, even when the macro timeline differs.

What to watch next as the signal matures

Glassnode’s heatmap suggests Bitcoin is in the coldest stretch since FTX, but not yet in the “unanimous” conditions that previously aligned with a more decisive bottom. Investors should watch whether the heatmap continues deeper into its most extreme blue regime while on-chain activity remains elevated—especially daily activity and transfer volumes—as those combinations would strengthen the case that capitulation is transitioning into a more durable stabilization phase.

Coldcard has disclosed an entropy-generation flaw that affected multiple versions of its hardware wallets, prompting firmware updates and a fund-migration warning for users. The issue, first raised by Coinkite on July 31, has since been linked by Galaxy Digital researchers to thefts exceeding 1,596 BTC—reported as at least $100 million—via coordinated attacks.

The incident is a reminder that even long-established hardware wallets can fail at the most foundational step of self-custody: producing the randomness used to generate private keys. It has also reignited a broader debate in the industry over how wallets prove to users—technically and practically—that their entropy sources remain secure in production.

Key takeaways

• Coldcard attributed the problem to a specific fallback path in seed generation that could produce weak entropy on-device firmware, affecting certain firmware versions.
• Galaxy Digital researchers say attackers exploited the weakness to steal more than 1,596 BTC through multiple coordinated attacks.
• Coinkite states that devices where users generated their own entropy (for example via manual dice rolls) were not affected by the specific fallback path.
• Ledger, Trezor, and Foundation emphasize different trust models—secure hardware, layered randomness, and open-source transparency—but all agree entropy generation must not silently degrade.
• Security leaders argue that certification and testing should extend beyond components, requiring assurance that production firmware actually uses the intended randomness source.

Entropy flaws hit the core of Bitcoin key generation

Unlike bugs that directly break encryption or exploit Bitcoin’s consensus rules, the Coldcard vulnerability is rooted in something more subtle: randomness. Bitcoin wallets typically start by generating a seed phrase from random data; from that seed, private keys are derived. “Entropy” describes how unpredictable that randomness is.

If the randomness is weakened—or becomes predictable enough—attackers may narrow the set of possible keys, increasing the odds of reproducing private keys tied to affected wallet setups. In other words, the security failure is not merely about having “less randomness,” but about allowing determinism or partial predictability into a process designed to be unguessable.

Coinkite initially warned users that wallets created on affected firmware should be treated as at risk and that funds should be migrated to newly generated wallets. As researchers assessed the underlying cause over subsequent days, attention turned to how such an issue could persist for years without being detected.

How the issue may have entered production—and what’s confirmed

Core Lightning developer Dustin Dettmer suggested that the flaw may have originated from firmware changes in 2021. His theory centers on an intended interface with a hardware random number generator that was potentially disabled, causing wallet creation to fall back to a weaker pseudo-random number generator used by MicroPython.

Coinkite has not confirmed that exact chain of events, but it did describe the nature of the problem: “Certain firmware versions had a fallback path in seed generation that could produce weak entropy when generated on the device firmware itself.”

Coinkite also stated that manual-entropy setups—where users generated their own entropy via dice rolls or similar approaches—were not impacted by that specific fallback path. That distinction matters because it frames the incident not as a total break of the device, but as a conditional failure mode tied to how the seed was generated.

Experts note that RNG vulnerabilities are notoriously hard to detect. As stated by Ledger product security leader Vincent Bouzon, weak randomness can still pass output tests—meaning values may look random statistically even when the generator is compromised.

Different wallet architectures, different ways to earn trust

Hardware wallet makers generally agree on the principle that secure entropy generation is non-negotiable. Where they differ is in implementation and the methods used to establish confidence that the wallet is really using a strong randomness source.

Ledger’s model relies on dedicated security hardware. Bouzon said Ledger generates seeds using a true random number generator embedded in a certified Secure Element, with the entropy source certified under the AIS-31 PTG.2 standard and the Secure Element undergoing Common Criteria certification. He argued the Coldcard incident reflects a failure in one implementation rather than a verdict on secure self-custody, emphasizing that the architecture must prevent silent downgrade to an untrusted software-based source.

Trezor takes a layered approach. Its chief technical officer Tomáš Sušánka said Trezor combines randomness produced inside the device with randomness provided by the host computer, rather than depending on a single entropy input. He also pointed to entropy checks that are intended to confirm the device contributed unpredictable randomness during wallet creation. “The takeaway for the whole industry is that randomness cannot depend on a single source or a single line of code being correct,” Sušánka said.

Foundation’s Passport similarly uses multiple entropy sources and pairs that with transparency. Zach Herbert, Foundation’s CEO, said Passport combines randomness generated by separate hardware components before creating a wallet. He also highlighted that Passport firmware is published as free and open-source software with reproducible builds, enabling independent verification that what runs on the device matches the published code.

Certification gaps and the push for stronger assurance

The Coldcard event has underscored tension between what certifications and component testing can guarantee—and what users ultimately need to trust: that production firmware uses the intended entropy mechanism correctly under real conditions.

Security and infrastructure leaders argue that many existing validation schemes focus on individual parts, not the full behavior of the complete system in operation. Nick Percoco, chief security officer at Kraken (and formerly CSO at Uptake), called the entropy failure a “wake-up call” for the hardware wallet industry. He argued that certification often verifies components, but not whether production firmware actually invokes them correctly.

Percoco proposed an industry-specific assurance standard that would include independent validation of entropy sources, checks that firmware calls the intended hardware random number generator, and certification tied to specific hardware and firmware versions.

The debate also extends to how openness and security culture influence outcomes. Herbert argued that inviting external researchers and maintaining open-source practices are part of building resilient products, not just a matter of code transparency or auditing. The larger point from multiple stakeholders is that redundancy, verification, and accountability must span the full chain from hardware entropy to final seed generation.

What Bitcoin users should do after Coldcard’s warning

For Coldcard holders, the immediate action is straightforward: follow Coinkite’s migration guidance if the wallet was created using affected firmware versions. The purpose is to move funds to wallets generated with safe, newly created seeds.

More broadly, the episode reinforces a principle emphasized by custody-focused experts: designs that rely on a single device, single vendor, or single institution being correct can leave users exposed when that assumption fails. Michael Tanguma, head of product at Onramp Bitcoin, said the trust model for self-custody depends on vendors getting multiple layers right, while emphasizing that “architectural” mitigations—such as multisig setups with independently generated entropy—are the approaches that scale to real-world risk.

In short, Coldcard’s entropy issue appears to reflect a vulnerability in a particular implementation pathway rather than a claim that all hardware wallets are broken. Yet it demonstrates why randomness generation—the part most users never see—remains one of the hardest to verify and one of the most important to get right.

As Coinkite prepares a fuller technical postmortem “soon,” and as the industry responds to calls for stronger end-to-end assurance, the next thing readers should watch is whether wallet makers tighten their verification methods around entropy usage in production firmware—not just around isolated components.

Ondo Finance has appointed former Blockchain.com executive Adam Schlisman as chief financial officer as the tokenized-assets firm expands its finance operations amid growing adoption of onchain capital markets, the company said in a press release on Wednesday.

Schlisman joins from global macro hedge fund Monashee Investment Management, where he served as CFO.

Before that, he was chief financial officer at Blockchain.com, overseeing finance, treasury and risk during a period of rapid growth. Earlier in his career, he spent nearly a decade at Graham Capital Management in portfolio management and risk roles.

Founded in 2021 by former Goldman Sachs executives, Ondo is one of the largest tokenized real-world asset platforms, offering blockchain-based U.S. Treasuries and stocks with more than $3.5 billion across its products.

Tokenization has emerged as one of crypto’s fastest-growing sectors as Wall Street firms race to bring traditional financial assets onto blockchain rails. Banks, asset managers and crypto-native firms are increasingly issuing tokenized versions of Treasuries, money market funds, private credit and equities, betting the technology can reduce settlement times, improve market access and unlock round-the-clock trading.

Crypto is in a tough spot right now, and the effects of a down market are being felt across the industry. In February of this year, Nomura tightened risk limits at Laser Digital after crypto losses dragged down quarterly profit. This was read by the market as a retreat, but Nomura indicated it would be staying in crypto, just with a more conservative approach.

To this end, Laser Digital’s investment and partnership with ZigChain delivers a comprehensive risk framework and governance across a pipeline of institutional onchain vault products, according to a statement.

Rafay Gadit said the private credit market in the Middle East faces a two-sided problem.

“Firstly, those who need money cannot raise it from the normal banks, and those who have money don’t know those opportunities exist,” he said. “And even if they know, it’s only approachable through very large funds that have extremely high fees and barriers to entry. We are democratizing that.”

Dr. Jez Mohideen, Co-founder and CEO, Laser Digital, said his firm has been watching the private credit category, and while the opportunity in onchain finance is real, execution risk has been consistently underestimated.

“ZIG Markets brings regional depth and an origination track record, and as an investor and partner, our role is to apply the same higher standards of institutional risk frameworks we use across our broader offerings,” Mohideen said. “The shared vision remains to make the next generation of asset management products accessible to those moving serious institutional capital.”

Binance-linked entities have filed a lawsuit in Hong Kong alleging that RedotPay, a Hong Kong-based cryptocurrency payments firm, diverted more than 470,000 users away from the Binance Card through activities they say were outside a commercial agreement. The plaintiffs are seeking nearly $473 million in damages.

The case, detailed in a Hong Kong court filing obtained by Bloomberg, is part of a broader push by Binance-affiliated companies to enforce terms tied to their card offering. Bloomberg reported the litigation may also intersect with RedotPay’s plans as it weighs a potential initial public offering.

Key takeaways

• Binance-affiliated plaintiffs say RedotPay enabled users to load RedotPay payment cards using Binance Pay outside the scope of their agreement.
• The complaint alleges diversion of more than 470,000 users from Binance Card and seeks about $472.8 million in damages.
• RedotPay says the lawsuit will not affect operations and plans to contest the claims.
• A related legal action is also underway in Singapore, where a hearing has been scheduled for Friday.

Hong Kong lawsuit targets alleged diversion of Binance Card users

According to Bloomberg’s report, Binance Holdings affiliates Nest Trading, DistributedTechnologies and Chaintecs Consulting Singapore filed the petition against RedotPay co-founders Gao Zhangpeng, Chan Wa Choi and Yao Chao. The filing centers on alleged breach of a commercial agreement governing RedotPay’s relationship with Binance Card.

The plaintiffs’ core allegation is that RedotPay permitted users to fund RedotPay stablecoin payment cards with Binance Pay in ways they claim were not authorized under the parties’ contract. In their lawsuit, Binance-affiliated entities argue this conduct resulted in substantial customer movement away from Binance Card and toward RedotPay’s own offering.

Damages claim hinges on lifetime customer value

The lawsuit seeks nearly $473 million. In Bloomberg’s account of the filing, the damages calculation is tied to Binance’s estimated lifetime customer value of $925 per user multiplied by the alleged user diversion figure of more than 470,000.

That approach suggests the plaintiffs are not merely pursuing damages for discrete transactions, but for the expected long-term value of a customer base they say was taken from their card product. For investors and market participants tracking crypto payments, the case signals how vigorously major counterparties are now quantifying commercial harm in custody- and payments-adjacent relationships.

Parallel litigation in Singapore adds pressure

Bloomberg further reports that Chaintecs filed a related lawsuit in Singapore. A hearing is scheduled for Friday, according to the court’s published hearing list.

Multiple jurisdictions can matter in crypto-related disputes because different courts may have varying views on contract interpretation, evidence standards, and the enforceability of certain remedies. For parties involved in cross-border payment ecosystems, the existence of parallel proceedings also raises the likelihood that the dispute will stay in the public spotlight longer than a single-country filing.

RedotPay pushes back, says operations will continue

In a statement posted on its website, RedotPay said the legal proceedings would not affect its operations and that it intends to contest the allegations. The company also indicated it would refrain from further comment while the matter is before the court.

“We are confident in our legal position, and are vigorously defending all claims. As the matter is currently before the court, RedotPay will not be commenting further on the allegations, the ongoing proceedings, or matters that will be addressed through the judicial process,” RedotPay said in its published response.

Binance did not provide operational commentary but, according to a spokesperson speaking to Cointelegraph, it would pursue legal options where necessary. The spokesperson said, “While Binance does not comment on ongoing litigation, where necessary we will use courts and other forums to pursue what is right.”

Why this dispute matters for card and payments users

This lawsuit is not just a contractual fight; it highlights the growing importance of compliance and channel controls in crypto card ecosystems. Allegations involving how users load funds—particularly through payment rails like Binance Pay—can directly affect user access, onboarding flows, and which provider ultimately captures transaction-driven value.

Even if the underlying contract is eventually interpreted narrowly, cases like this can influence how payment partners structure permissions, settle revenue-sharing, and document user attribution. Traders and builders watching crypto payments may also take note of how disputes are increasingly tied to quantified customer metrics, signaling a shift away from purely reputational arguments toward measurable economic damages.

As proceedings move forward in Hong Kong and Singapore, the key questions for readers will be what the courts find about the parties’ contract scope—especially whether Binance Pay funding to RedotPay cards fell within agreed boundaries—and how damages, if any, are calculated once the facts are established.

The Aussie and the Kiwi are telling two very different monetary policy stories right now, and the divergence is starting to show up clearly in the cross. The RBA held its cash rate at 4.35% in August, but the hawkish tone that once dominated has faded fast: Q2 inflation cooled to 3.9% from 4.1%, prompting Goldman Sachs to abandon its call for one final hike this year. Markets now price next to no chance of an August move, with only roughly even odds of a hike by November.

Across the Tasman, the RBNZ is playing a different game entirely. Having already hiked to 2.50% in June, the central bank has kept its guidance firmly hawkish, and markets are now almost fully pricing a further 25bp increase in September. Wednesday’s employment data added an interesting twist: employment change q/q beat expectations sharply at 0.5% against 0.1% forecast, yet the unemployment rate also rose to 5.6% from 5.4%, above forecasts—a genuinely mixed print that complicates the otherwise hawkish RBNZ narrative.

The result: a Reserve Bank stepping back from further tightening against one still leaning hawkish, though now facing a labor market sending conflicting signals of its own.

Technical Analysis of AUD/NZD

As AUD/NZD chart shows, the pair broke above the 100-period EMA back in July and is now testing this level again, right where it converges with the 0.5 Fibonacci retracement near 1.2011-1.2013. This confluence marks a critical juncture after weeks of steady decline.

Bullish Scenario

Should buyers break this EMA-Fibonacci confluence decisively, the path would open toward the 0.618 retracement near 1.2037, followed by the descending trendline, which itself converges with the 0.786 level around 1.2073. A break above this second confluence would leave room to retest the 1.2200-1.2250 resistance, the upper boundary of the broader range that has trapped price since April..

Bearish Scenario

Conversely, a rejection at the EMA-0.5 confluence would send price back down to retest the 1.1900-1.1950 support, the level that has held since March.. This is the real test: a confirmed break below it would open the door to a more sustained and decisive downtrend.

With price wedged right at this pivotal confluence, and the broader March-to-August range still very much intact, AUD/NZD looks ready to decide whether it’s building toward a genuine breakout, or simply setting up for another rejection within its months-long range.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.