Coldcard exploit hits $114M across 4 waves — and a 4th is still live. Solo miner nets $200K. Senate leaves Clarity Act off Monday’s agenda. BTC under $63K, 200-week SMA now signals downtrend.
Monday, August 3, 2026
A solo bitcoin miner struck block 960,804 early Monday, netting a reward of 3.157 BTC worth approximately $199,300 — the second solo win in just three weeks and the 13th such block claimed this year, defying the statistical odds that favor large mining pools. The upbeat headline is tempered by the broader mood. The Coldcard hardware wallet exploit, now entering its fifth day, has grown to an estimated $114 million in losses across four waves and more than 5,200 addresses, with a fourth wave still active Monday. Unlike earlier sweeps, the latest transactions use bitcoin’s replace-by-fee feature, meaning victims who spot their address in the mempool may still have minutes to outbid the attacker. The incident has triggered a visible behavioral shift: the number of BTC sending addresses spiked on Friday to levels not seen since early 2024, with the exchange reserve rising to 2.718 million BTC. Bitcoin is trading below $63,000 and below its 200-week simple moving average — a level Strategy, the world’s largest publicly listed bitcoin holder, has flagged as a key long-term signal. The 50- and 100-week averages have also crossed bearishly, confirming the path of least resistance is lower. On the regulatory front, the Senate left the Clarity Act off Monday’s agenda, leaving just five days of scheduled session before the August 10 recess. Stay alert!
Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep.
Roughly 594 bitcoin — worth approximately $38 million — was swept from around 500 separate wallets between 01:31 and 01:56 UTC on Friday in an attack traced to a flaw in how Coldcard hardware wallets generated their cryptographic keys. The attacker moved 1,324 chunks of bitcoin across 500 transactions inside a three-block window, then consolidated 562 BTC into a single address. The vulnerability was introduced in Coldcard firmware 4.0.0 in March 2021: a build setting caused devices to skip their hardware randomness generator and fall back to a software substitute seeded from the chip’s serial number and clock registers — none of which are secrets. Block’s Bitcoin engineering team disclosed the flaw publicly because exploitation was already under way. Coinkite warned users who generated a seed on an Mk3 running firmware 4.0.1 or later and stated that Mk4, Q, and Mk5 appear unaffected. The exposure extends beyond wallet seeds to paper wallet private keys, seed-splitting masks, device cloning keys, and Key Teleport transfers.
Coldcard wallet losses may near $114 million as possible fourth sweep emerges.
A fourth wave of sweeps targeting bitcoin held in Coldcard-generated addresses began early Monday and was still running hours later, with researchers estimating the attacker has moved about 1,816 BTC — roughly $114 million — from more than 5,200 addresses since July 30. Unlike the earlier three waves, the latest transactions use bitcoin’s replace-by-fee feature, meaning victims who spot their address in the mempool may still be able to outbid the attacker and move their funds first. Galaxy Research’s Alex Thorn, who flagged the wave, advised users to check funds, move anything off an affected device, and bid the fee up. The pattern covers blocks 960,778 to 960,792, with 218 transactions hitting 462 victim addresses — roughly 45 times the normal rate. None of the four waves touched multisignature setups, consistent with the flaw affecting only single-key seeds. Coinkite has released emergency firmware for all affected models; users who generated a seed on the flawed software should move funds to a wallet address created with a fresh seed immediately.
CoinDesk Disclosure: The information contained in this newsletter, and any information linked through the items contained herein, is not intended to provide sufficient information to form the basis for an investment decision. You should seek additional information regarding the merits and risks of investing in any cryptocurrency or digital assets.
L1.co Disclosure: This material is for informational purposes only, and the content contained herein should not be considered investment advice or a solicitation, offer, or recommendation to sell or buy any asset, strategy, or product. Investing in digital assets involves a high degree of risk, including the loss of principal.
Crypto Daybook Americas: A newsletter from CoinDesk
Coldcard's wallet flaw drains $38 million in bitcoin and shakes faith in self-custody. IBM's CEO says quantum computing is almost a business. And three things standing between crypto and its next bull run.
A firmware vulnerability in Coldcard hardware wallets — among the most respected self-custody devices in Bitcoin — was exploited to drain roughly 594 BTC worth about $38 million in a 25-minute sweep, sending shockwaves through the self-custody community. The flaw involves weak entropy during seed generation: an attacker who knows the pattern can recompute private keys without ever touching the device. Coinkite co-founder NVK issued an urgent warning — "move your funds now" — and shipped a hotfix protecting new seeds, but stressed it does not fix keys already generated on vulnerable firmware. Trezor's CTO put it bluntly: "Weak entropy during initialization = funds drained remotely. No device access needed." The community reaction was visceral, with some calling it worse than Mt. Gox because it strikes at the very bitcoiners who did everything right — studied the protocol, bought hardware wallets, took self-custody seriously. NVK attributed the discovery speed to AI-assisted code review: "AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts." Bitcoin fell 3% as the scope of the vulnerability became clear, and some commentators are already predicting a shift of self-custody holdouts toward ETFs and insured custodial solutions.
The only NYSE-listed crypto exchange, regulated by NYDFS, HKSFC, Bafin, and GFSC. Built for institutional trading, on the infrastructure regulated markets require.
One global order book, open 24/7, serving institutions in 50+ jurisdictions, with deep liquidity that holds in volatile markets.
Top 3 for BTC and ETH volume among the exchanges in the CME CF benchmarks. (CoinDesk Data)
Not investment advice. Digital assets and related products are high risk. Visit bullish.com/legal for more important information and risk warnings.
IBM CEO Arvind Krishna told CNBC that quantum computing is on track to begin generating meaningful revenue by 2028 or 2029, and that by the end of the 2030s the sector represents a potential $1 trillion in value. The comments come as IBM, Alphabet, IonQ, Rigetti, and a wave of startups race to build machines capable of solving problems intractable for classical computers — from molecular simulation and drug discovery to logistics optimization and materials science. Unlike AI's reliance on GPU clusters, quantum computing requires entirely different hardware and purpose-built facilities. IBM backed its confidence with action: it's building a standalone quantum chip foundry with $1 billion committed from the U.S. Department of Commerce and a matching $1 billion from the company itself. The technology has crypto implications too — a sufficiently advanced quantum computer could theoretically threaten Bitcoin wallet encryption, though most experts say that scenario is still years away and blockchain networks will have time to upgrade to quantum-resistant cryptography before it becomes a real risk.
STS Digital CEO Maxime Seiler says three forces are holding bitcoin back despite record institutional blockchain adoption: institutional options selling, capital rotating into AI, and stalled U.S. crypto legislation. The surge in institutions selling options has created a reflexive loop that compresses implied and realized volatility, trapping bitcoin in a tight range and capping the kind of outsized rallies that defined previous cycles. Meanwhile, AI has become the dominant growth narrative, drawing both attention and capital away from digital assets. And the failure of the Clarity Act to advance before the Senate's August recess has left regulatory uncertainty intact. Ironically, Seiler notes that much of Wall Street's blockchain adoption — banks and exchanges upgrading to 24/7 settlement and clearing — is accruing value to incumbent financial institutions rather than to token holders. He expects a meaningful rally will require regulatory clarity, broader 24/7 market infrastructure, and a more supportive macro backdrop, with rate cuts or renewed monetary easing as a likely catalyst.
