BitBox, the Swiss maker of self-custody hardware wallets, has released a firmware update to address two security issues it describes as “severe.” The company says the fixes reduce the risk of malicious firmware installation and prevent scenarios involving its Silent Payments feature that could cause Bitcoin to be locked to an unintended address.

BitBox reported that it has not received any information indicating either vulnerability has been exploited in the wild or that users have lost funds as a result. Still, the disclosure lands amid a broader run of hardware-wallet-related security concerns, including a Coldcard flaw that was later linked to losses exceeding $112 million, according to Galaxy Research.

Key takeaways

• BitBox’s latest firmware update targets two vulnerabilities it labels “severe,” including a memory corruption issue that could allow arbitrary code execution in unconfigured wallet states.
• The update also addresses a Silent Payments weakness that could enable Bitcoin to be locked to an unintended address, creating a potential ransom-type leverage scenario.
• BitBox says it has seen no reports of exploitation or user fund loss tied to either issue.
• The release arrives after high-profile incidents spanning hardware wallet devices and the services around them, including a Coldcard issue tied to large BTC theft totals.

What BitBox says the firmware flaws could enable

In a security disclosure released on Monday, BitBox said one of the vulnerabilities stems from memory corruption affecting “Multi editions of BitBox02 and BitBox02 Nova” when those devices have not been configured with a wallet.

BitBox explained that, under certain conditions, a malicious host could exploit the bug to execute arbitrary code and potentially install malicious firmware. If successful, that chain of events could expose user funds by altering how the device signs transactions or operates.

The second issue relates to BitBox’s Silent Payments implementation. BitBox said the vulnerability could allow a malicious host to lock Bitcoin to an unintended address. While the company stated that the flaw does not enable direct theft in the way some vulnerabilities do, it argued an attacker could still use the situation to demand a ransom in exchange for cooperation on recovering the coins.

Why the update matters for self-custody users

Hardware wallets are designed to minimize the amount of trust users must place in online systems. Even so, the BitBox disclosure highlights an important nuance: the device is not only responsible for protecting private keys, but also for maintaining a secure operating environment under all possible states—including those that occur before a wallet is configured.

For users, this is a practical reminder to keep firmware current, especially when device behavior can be influenced by connected hosts during setup or ongoing interactions. BitBox’s emphasis on “unconfigured” wallets suggests there is risk concentrated in specific device states rather than a universal exposure across all usage patterns. Still, the company’s decision to classify both bugs as severe indicates the potential outcomes are serious enough to warrant immediate action.

The timing: hardware-wallet incidents beyond device code

BitBox’s update arrives at a moment when the hardware wallet narrative has been dominated not only by device-level flaws, but also by problems in surrounding ecosystems—such as shipment and order-management systems.

Earlier, Cointelegraph reported on a Coldcard flaw that was traced to a March 2021 firmware change and reportedly remained undetected for more than five years. That vulnerability affected wallet-seed randomness. According to Galaxy Research, that defect enabled attackers to brute-force impacted wallet seeds and derive private keys without physical access. Galaxy Research said Coldcard-related losses exceeded $112 million, and reported approximately 1,778.6 BTC swept from more than 8,600 addresses.

More recently, separate data breaches involving Trezor and SafePal exposed customer and order information for more than 53,000 customers. Cointelegraph coverage noted that Trezor attributed exposure affecting 13,689 customers’ data to shipping provider ShipMonk. SafePal, meanwhile, said an authorization flaw in an order-tracking plug-in exposed details tied to 39,798 customers. In both cases, Cointelegraph reported that the incidents did not compromise device private keys or recovery phrases, but both companies warned the information could be used for targeted phishing and impersonation attempts.

These episodes underline a broader reality: self-custody security is shaped by a chain of components—device firmware, host-side software interactions, and operational services that handle customers and transactions. Even when devices themselves remain uncompromised, attackers may still exploit human and process-level weaknesses to increase the odds of successful fraud.

What investors and builders should watch next

BitBox says there are no reports of exploitation tied to either vulnerability, but the company’s disclosure nonetheless reinforces the need for disciplined update practices across the hardware wallet stack. The next signal to monitor is whether BitBox’s patch becomes the new baseline for Multi editions of BitBox02 and BitBox02 Nova users, and whether Silent Payments-related guidance triggers further clarification from the company about conditions under which users could be exposed.

For the industry, the broader question is how quickly manufacturers respond after audits or research uncover weaknesses—and how effectively they communicate practical mitigation steps to users who may not follow security advisories closely.

Kraken has launched trading in more than 7,000 US-listed stocks for customers in the European Economic Area (EEA), expanding its traditional finance offering alongside cryptocurrencies and tokenized equities.

The crypto exchange said Tuesday that eligible EEA customers can trade US stocks through Kraken Pro and its mobile app under the company’s Markets in Financial Instruments Directive II authorization.

The shares are available alongside more than 600 crypto assets and over 700 xStocks, which are tokenized versions of publicly listed equities.

The setup allows customers to hold conventional shares and tokenized representations of the same assets within a single platform.

The service is provided by Payward Europe Digital Solutions, Kraken’s Cyprus-based investment firm. Kraken said eligible customers can trade US-listed stocks commission-free, subject to applicable conditions. Kraken said it plans to extend its integrated equities offering to additional markets in the coming months.

Kraken launched xStocks in 2025, offering tokenized exposure to US equities and exchange-traded funds. The company said xStocks has since generated more than $38 billion in total transaction volume.

As of Monday, xStocks is the second-largest tokenized stock issuer by market capitalization, with about $609 million, behind Ondo Finance, with about $974 million, according to Token Terminal data. Binance’s bStocks is currently the third-largest issuer, with about $544 million.

Related: Kraken adds S&P 500 to funded trading program, commodities to follow

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

South Korea ordered domestic access to popular prediction market Polymarket blocked, becoming the latest of more than 30 jurisdictions to restrict the platform over gambling concerns.

The Korea Media and Communications Standards Commission approved the move after finding that Polymarket facilitates gambling and the operation of gambling venues under the country’s Criminal Act along with similar categories under the National Sports Promotion Act, according to local reports.

Polymarket lets users trade yes-or-no contracts tied to the outcomes of real-world events including elections, sports, economic data and the weather. It’s one of the largest prediction markets along with Kalshi.

The commission said that these markets’ structure encourages speculative behavior because users’ gains and losses depend on events beyond their control.

Polymarket, according to local media, said that it had removed Korean-language services, does not support payments in the country’s won fiat currency, and uses non-custodial peer-to-peer transactions and smart contracts.

The company did not immediately respond to CoinDesk’s request for further comment.

The regulator rejected the defense, saying Polymarket’s operator still manages market creation and trading rules while providing crypto deposit, withdrawal and settlement systems and charging fees.

• The first question for any crypto prop firm is whether trades hit a real order book or a simulation.
• A crypto-native perpetuals trader gets the most from a crypto-first structure with verifiable payouts.
• HyroTrader is crypto only: USDT perpetual futures, no forex pairs, no indices, no metals.

Every crypto prop firm’s homepage makes the same pitch: six figures of buying power, a generous profit split, a challenge fee that looks small next to the capital on offer. Read five pricing pages in a row, and they blur into one.

The differences that decide whether a funded account survives live below the marketing.

They come down to three structural questions: where orders execute, how drawdown is measured, and what a payout actually is.

A trader who can answer all three about a firm knows more than most reviews will ever tell them.

Test one: where orders execute

The first question for any crypto prop firm is whether trades hit a real order book or a simulation.

Both architectures exist, and both can be honest; the failure mode is a simulation dressed up as the real thing.

HyroTrader put direct exchange execution at the center of its model in 2023, the first crypto prop firm to do it.

Traders connect to Bybit by API, and trade USDT perpetual futures on the trader’s own account against live order books, across more than 700 pairs.

The same firm shows what honest simulation looks like.

Its CLEO platform, built for traders in Bybit-restricted countries, prices from real-time Binance market data and order book depth while filling trades internally, and it simulates the unflattering parts: market impact, commissions, slippage landing in the position PnL at fill.

If a firm will not say plainly where fills happen, assume the answer costs you money.

Test two: how drawdown is measured

Two firms quoting the same daily limit can be selling different products, because what matters is the reference point.

HyroTrader’s standard daily drawdown is trailing: measured from the highest equity point reached during the day, unrealized profit included, so the risk line rises as the day goes well.

Its swing variant, sold as a paid upgrade, is static, measured from the day’s starting equity and reset once every 24 hours.

The daily limit itself is 4 percent on the one-step model and 5 percent on the two-step, calculated from initial capital.

A trailing limit punishes how you win. Ride a position up, give a third of the move back, and the giveback can trip the limit while the day is still green.

Crypto compounds the effect because volatility arrives in bursts; CoinJournal’s analysis of Bitcoin’s current tight range describes exactly the kind of compression that precedes them.

Test three: what a payout actually is

A payout policy is three numbers and a proof: how often, how fast, and whether anyone can verify it happened.

At HyroTrader, payouts are on demand, typically processed within 12 to 24 hours, in USDT or USDC, with no withdrawal commissions, and the first one can be requested as early as the day of the first trade.

Since April 2026, payouts through its vault system execute as Solana transactions with publicly verifiable IDs on Fireblocks infrastructure, so the proof does not depend on the firm’s word.

Cost belongs in the same test. HyroTrader’s challenge fees run one-time, from $59 for a 5,000 USDT account to $969 for 200,000 USDT, with no recurring charges, and the fee is refunded with the first profit split after passing.

A firm confident in its payout process has no reason to bury these numbers.

The honest trade-off

HyroTrader is crypto-only: USDT perpetual futures, no forex pairs, no indices, no metals.

A trader who wants gold or the S&P alongside BTC needs a multi-asset firm and accepts the different execution model that comes with it.

There are consistency rules too: during evaluation, no single day may contribute more than 40 percent of the result, though exceeding the cap only discounts the excess rather than failing the account.

The structure fits deliberate traders and frustrates all-in ones, which is the point.

Choosing by profile

A crypto-native perpetuals trader gets the most from a crypto-first structure with verifiable payouts, which is HyroTrader’s case.

A generalist who wants metals and indices in the same account belongs at a multi-asset firm: FTMO, which popularized the modern evaluation model, runs crypto as one market among forex, indices, and metals, and FundedNext brings similar breadth.

Whatever the profile, start from a crypto prop firm comparison that puts evaluation costs, drawdown types, and payout terms side by side, then read the full rulebooks of the two finalists. Pick the rulebook you can recite before you pay for it.

Figures come from the firms’ published terms as of August 2026; verify current numbers before purchasing an evaluation. Trading crypto derivatives carries substantial risk of loss.

The takeaway is that even as oil prices retreat from their second-quarter highs, oil products are getting more expensive. The broader market, including BTC, may not have fully priced that in yet.

A second detail is that oil itself may be due for a bounce. Crude has emerged from a four-month-long bearish trend (check the Daily Signal), and there’s still disruption of tanker traffic through the Strait of Hormuz.

Those two effects, combined with concerns about government debt levels, continue to push yields on U.S. Treasuries and other advanced-economy bonds higher. That raises the opportunity cost of holding other assets and may cap bitcoin’s gains, a dynamic CoinDesk recently flagged.

One factor is still working in bitcoin’s favor, at least for now: the U.S. currency. The Dollar Index fell to a two-and-a-half-month low of 99.29 on Monday and broke down out of a bullish trendline, a technical signal pointing to further losses ahead. A weaker dollar has historically been a supportive backdrop for bitcoin.

Taken together, it’s a genuinely mixed tape that leaves bitcoin trading in the middle of several narratives pulling in opposite directions. Stay alert!

Read more: For analysis of today’s activity in altcoins and derivatives, see Crypto Markets Today . For a comprehensive list of events this week, see CoinDesk’s “Crypto Week Ahead.”

In an interview with crypto.news, Selva Ozelli speaks with TEXITcoin founder Richard W. Wisher about the Proof-of-Work network, its Texas mining operations and how merge mining allows TXC to be mined alongside Litecoin and Dogecoin.

The discussion also covers regulation and the Texas State Securities Board case against TEXITcoin, MineTXC, Blockchain Mint and Wisher. The founder disputes the regulator’s allegations and argues that mining a Proof-of-Work commodity does not constitute a securities offering.

Tell us about your journey to establishing TEXITcoin (TXC)

I began minting coins in 2008, the same year Satoshi introduced Bitcoin. My goal was to provide money that no government can print. While gold and silver served this purpose for centuries, I wanted to bring that same security to the digital age. In 2012, I even testified before Congress to advocate for these alternative currencies. By 2017, I started laser-etching private keys onto physical coins to bridge the gap between digital assets and tangible wealth. This journey led to TEXITcoin. We built it as a Texas-rooted, Proof-of-Work network with no pre-mine and no special favors for the team. Honest money isn’t a slogan, it’s just money that has to be earned the same way for everybody who touches it, and that is the only kind of money I have ever wanted to build.

Which platforms does TXC trade on?

TXC trades on MEXC, XT.COM, BitMart, and Pionex, with wrapped TXC also available on Ethereum. We’re in discussions with a number of other exchanges right now, so this list is likely to change and grow as new partnerships come together.

Why does Texas rank at the top for crypto mining?

Texas offers a competitive energy market and a massive network of wind and solar power. You will find plenty of land here and a state government that welcomes your business. This environment allows us to build real, physical infrastructure. We mine TXC in the open, using verifiable hardware and actual electricity. Plus, you can power down quickly when the grid is busy, which helps everyone.

Of course, the process is not always easy. Miners face long waits to connect to the grid and unpredictable power prices. You will also deal with transmission limits and more oversight from officials. Despite these hurdles, Texas remains the strongest place to build.

TXC is described as using multi-level marketing to sell mining packages. What are the challenges and growth concerns for crypto mining in Texas?

TEXITcoin is a Layer 1 crypto network, meaning it operates as its own currency, much like Bitcoin. We crowdsourced our mining infrastructure, which fostered a community where people actively participate rather than just watch from the sidelines. If you value collaboration and building real connections, this project is for you. We have created something fundamentally different from traditional network marketing and the scams common in the space.

However, scaling in Texas comes with real challenges. Companies must navigate long grid wait times, volatile power prices, and high startup costs. We also address complex factors like curtailment economics, local noise concerns, and the need for complete transparency when offering products to the public. We are building a sustainable model that accounts for these realities head-on.

How does TXC rank among major crypto-mining companies operating large facilities across Texas?

Comparing TXC to public Bitcoin-mining companies is misleading. We are a Layer 1 network, not a massive mining corporation. We operate on a different scale, so measuring us by megawatts or market cap ignores our true purpose.

We focus on building real infrastructure. We recently invested $5.5 million to expand our mining sites in McKinney, Mansfield, and Conroe. That money bought hardware that performs actual work rather than chasing a leaderboard. I have no interest in claiming a rank that we have not earned. My priority is the growth, security, and utility of the TXC network. That is the only scoreboard that matters.

How do TXC merge mining and energy use work?

TXC uses Scrypt, just like Litecoin and Dogecoin. Because they share the same algorithm, one machine can secure all three networks at the same time. This is called merge mining. It is highly efficient because you do not waste computing power on redundant tasks.

However, it is important to be clear that merge mining does not make mining free. Your machines still consume real electricity. You must manage them carefully to stay profitable. Merge mining simply makes every watt of energy go further rather than make the energy costs disappear.

How is merge mining regulated at state and federal level?

Merge mining does not trigger its own specific set of regulations. Regulators are less worried about the technical labels you use, but instead are focused on your actual activities. You must still follow the rules that apply to any business. This includes things like local environmental permits, electricity market standards, and building codes. If your operations involve financial products or transactions, you must also comply with anti-money laundering, consumer protection, and other applicable laws. Ultimately, authorities judge you by what you do, not by the technology you choose to use.

How is merge mining taxed at federal and state level?

Federal law views mined digital assets as taxable income. You must report their value the moment they become usable. If you sell these assets later, any change in price results in a separate capital gain or loss.

If, like us, you mine as a business, you face additional self-employment or corporate taxes. Texas offers an advantage by having no state income tax, but your business is not exempt from other costs. You must still pay franchise, sales, property, and local taxes. Additionally, the IRS taxes rewards from every network you secure, regardless of your mining efficiency. Because tax laws are complex, please consult a professional regarding your specific business needs.

How could the Texas PUC v. Attorney General public-records case affect the mining industry?

This legal case is not about mining regulations. It is about whether the state must release private data on facility locations and power use. People often confuse these two issues, but they are separate.

If the court chooses confidentiality, it protects mining companies from security risks. This is the position held by the Public Utility Commission. However, if the court mandates disclosure, the public gains vital clarity about the demands these companies place on the Texas power grid.

It is important to note that this case does not excuse companies from complying with the rules. They must still report their data to regulators. The core disagreement is simply about who has the right to see that data. This decision is one small part of a larger debate about how Texas manages its energy grid and the public’s right to know how its power is being used.

How did the Texas Blockchain Council/EIA survey case affect the mining industry?

The 2024 EIA case demonstrates that agencies must follow the law when collecting data. The agency tried to force Bitcoin miners to complete an emergency survey without using the standard notice and comment process. A federal court stopped them with a restraining order, ultimately forcing the EIA to delete the data they had already collected.

That’s the real lesson here, government agencies cannot bypass rules to demand private information. They must follow the Paperwork Reduction Act and allow for public feedback. This decision does not mean the EIA cannot request energy data in the future. It also does not excuse miners from standard reporting requirements. Instead, it ensures that agencies follow the law instead of taking shortcuts.

TXC is a fork of Litecoin, which is a fork of Bitcoin. How does that affect TXC’s classification under Texas securities law and the SEC/CFTC interpretation issued March 17, 2026?

This is the regulatory clarity we have been waiting for. On March 17, the SEC and CFTC officially classified Litecoin as a commodity. TXC uses the exact same Proof-of-Work structure, issuance logic, and mechanics as Litecoin. The only difference is that TXC is built and mined in Texas. 

Regulators have now confirmed that protocol mining does not turn an asset into a security. Miners contribute their own computing power, which is an administrative task rather than reliance on someone else’s management. Because TXC is a permissionless network built on this established foundation, its status as a commodity is clear. Our structure matches the model that regulators just validated, proving that TXC is a commodity from the ground up.

Tell us about the TSSB case, your counterarguments and its possible industry impact.

In February 2026, the Texas State Securities Board issued an order against TEXITcoin, MineTXC, Blockchain Mint, and me. They allege that we offered unregistered investments and made misleading statements. It is important to remember that these are unproven allegations, not facts determined by a hearing.

We retained Quinn Emanuel to represent us. We have requested a formal hearing to present our defense through the proper legal channels instead of the press.

Our position remains that we believe mining a Proof-of-Work commodity is not a security. Furthermore, our mining activity and equipment are real and fully verifiable. We look forward to proving this during the legal process. Because this case is ongoing, I will not speculate on the outcome or its impact on the industry. I prefer to let the facts of the legal record speak for themselves.

Can state regulators act independently even where a token is not treated as a security federally?

States do have their own security laws and regulators. Federal rules do not automatically replace them. However, these systems are deeply connected. Texas uses the same “Howey test” as the SEC and CFTC to define a security. When federal regulators decide an asset is not a security, that logic remains relevant at the state level. It does not simply disappear at the state border.

States should certainly protect consumers and stop fraud under their own authority. But that is different from labeling a legitimate Proof-of-Work asset a “security” just because it crossed a state line.

What are your views on the CLARITY Act and promises of daily passive mining returns?

The CLARITY Act is essential for fixing market structure. It draws clear lines between the SEC and the CFTC so builders know exactly which regulator oversees their work. This transparency rewards those who follow the rules. 

In regard to the timeline, the process remains lengthy. We face a cloture vote on September 15, which requires 60 votes just to begin debate. After that, we have to navigate floor debates, amendments, and a final vote. Anyone suggesting this bill is already law is jumping to conclusions. I prefer to be honest about our progress rather than promise a result that is not yet guaranteed.

Anything else you would like to add?

Just that I’m excited for what’s ahead. We’re building real momentum right now, we’re investing in expanding our mining network, we’re pushing crypto payment adoption forward across Texas, and every day we get to bring the idea of honest money to more people who’ve never really had it explained to them properly before. That’s the work, and I’m genuinely excited to keep doing it.

How can people reach you?

You can visit our website at Texitcoin.org and keep up to date with everything we’re doing on X https://x.com/TEXITcoin.

About the Author:
Selva Ozelli Esq, CPA, is an international digital asset legal expert and author of Sustainably Investing in Digital Assets Globally and an award winning artist.  Her writings are translated into 45 languages and republished in over 200 global publications.  She is recognized as an expert media/TV commentator on global AI,  digital asset regulation, tax, and technology matters.

The Aussie enters this week with genuine hawkish backing. RBA Assistant Governor Christopher Kent reaffirmed that tighter policy is working as intended, with markets now pricing roughly a 70% chance of one final hike to 4.60% by early next year, even as inflation eased below forecasts last quarter. That combination of commodity strength, gold, iron ore and LNG all running above forecast, and a still-hawkish central bank has kept AUD broadly supported near multi-week highs, with all eyes now on Thursday’s July employment report.

The loonie tells an even stronger story. Canada’s economy expanded at a blistering 3.4% annualised pace in Q2, well above the Bank of Canada’s own 2.5% forecast, while July employment surged by 75,100 jobs against expectations of just 15,000, pulling unemployment down to a two-year low of 6.4%. That combination of surprising growth and labour market strength has fuelled speculation the BoC could hike if elevated energy prices persist, giving CAD real independent momentum of its own.

The result: two resource-linked currencies both riding genuinely hawkish narratives, leaving AUD/CAD’s next move to hinge on which central bank blinks first.

Technical Analysis of AUD/CAD

As the chart shows, AUD/CAD has been compressing into a symmetrical triangle since early August, with a descending trendline from the 0.9926 high converging with an ascending trendline off the 0.9748 low, both meeting right around current price near 0.9847, exactly where the 100-period EMA also sits.

Bullish Scenario

Should buyers break above the descending trendline and the 0.382 retracement near 0.9858, the path would open towards the 0 level at 0.9926, a confirmed breakout that would suggest genuine momentum returning to the pair.

Bearish Scenario

Conversely, a break below the ascending trendline and the 0.5 retracement near 0.9837 would expose the 0.618 level near 0.9816, with a deeper slide risking a retest of the 0.786 retracement around 0.9786, or even the 0.9748 low that anchored this entire structure.With price coiled right at the apex of this triangle, sitting exactly on the 100-period EMA, AUD/CAD looks primed for a decisive break, will the Aussie’s hawkish backing prove enough, or does the loonie’s stronger data ultimately win out?

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.