Cryptoccino — Saturday 01 August 2026
☕ 8 min read
Today's Roast
Single shot · top move 2.0% (BTC)
The Pour. A hardware wallet bleeds $70 million, Bitcoin softens into month-end, and regulators are filing paperwork faster than prices are moving.
Today. Coldcard vulnerability drains $70M in BTC as losses keep climbing Security Desk · Bitcoin slips below $63K on Coinbase miss and stalled legislation Markets · Circle lands New York trust charter, stacking regulatory armour On the Hill.
Prices
- BTC$62,984−2.0%
- ETH$1,868−1.7%
- BNB$589+0.3%
- SOL$73.04−1.4%
- XRP$1.06−1.4%
- DOGE$0.0702+0.2%
SECURITY DESK
Coldcard Firmware Flaw Bleeds $70 Million in BTC as Loss Estimates Keep Climbing
theblock coindesk decrypt coindesk coindesk
What happened. A vulnerability in Coldcard’s open-source firmware allowed an attacker to sweep roughly 1,000 BTC across nearly 1,200 addresses in under 25 minutes. Initial estimates put losses at $38 million; Galaxy Research now pegs the total closer to $70 million. Coinkite, the device maker, has urged all users to move funds immediately and believes the flaw may have been uncovered by an attacker using AI to audit historical firmware releases.
Why it matters. Coldcard is widely considered the gold standard in air-gapped self-custody, so a successful exploit at this scale is a credibility event for the entire hardware wallet category, not just one product. The incident is already prompting discussion about whether retail holders will rotate toward custodial ETF wrappers. With the Fear & Greed Index sitting at 27, the timing adds weight to the bearish read: the one argument for self-custody just took a public hit.
The catch. The loss figure is still moving. Galaxy’s $70 million count may not be the final tally if the attacker had access to additional key material derived from the same flaw. The AI-assisted discovery angle is unconfirmed and comes from Coinkite itself, which has an obvious incentive to frame the attack as extraordinarily sophisticated rather than a routine oversight.

Bitcoin slips below $63,000 on Coinbase miss and stalled Clarity Act. BTC ended July down on the week as disappointing Coinbase earnings and fading momentum on US crypto legislation dented sentiment among speculative traders. The broader crypto market still posted its best monthly performance in a year, though options flow shows the $60,000 put is now the most actively sought hedge for August. Analysts say forced-selling pressure is largely exhausted but expect a choppy next few weeks as positioning resets.
bloomberg_cryptocoindeskcryptobriefing
Coinbase Q2 miss leaves Wall Street divided on recovery timing. Coinbase reported a weaker-than-expected second quarter as trading volumes dried up, prompting several banks to cut price targets while maintaining buy ratings. The debate on the street has shifted to whether Coinbase can grow revenue meaningfully outside core trading, with staking, custody, and international expansion cited as the swing factors. Strategy Inc. also posted an $8.2 billion Q2 loss, though TD Cowen and Benchmark backed the company’s pivot toward building a cash buffer alongside its bitcoin holdings.
theblockcoindesktheblock
Tether Q2 profit lands at $1.5 billion as reserve buffer shrinks sharply. Tether’s operating profit fell dramatically from the $4.9 billion it posted in Q2 2025, with excess reserves dropping by more than $4 billion over the quarter. The attestation also showed continued gold buying, with Tether adding 14 tonnes during the period to cement its position as the largest known non-sovereign bullion holder globally. USDT supply continued to grow, but the thinner cushion between assets and liabilities will renew questions about the stablecoin’s resilience in a stress scenario.
theblockcoindeskbloomberg_cryptodecrypt
Prediction markets clear $20 billion in World Cup volume, Ronaldo among top wagers. Decentralised and centralised prediction markets combined hit $20 billion in total World Cup 2026 betting volume, smashing prior records for any single sporting event. Activity peaked around knockout-stage matches, with player-specific markets proving more popular than match-outcome bets. Bernstein separately cited prediction markets as a key driver of its $160 price target on Robinhood, seeing 78% upside as the category scales.
theblockcoindesktheblock

Uniswap launches ‘Earn’ with Morpho, bringing curated lending vaults to idle assets. The integration pairs Uniswap’s distribution with Morpho’s lending infrastructure, with Gauntlet managing vault risk parameters. It is the most direct move Uniswap has made into yield products beyond its core AMM, putting it in closer competition with Aave and Compound for sticky liquidity. No token incentives were announced at launch.
theblock
Aave governance weighs closing six V3 deployments and offboarding 50 low-use reserves. LlamaRisk’s proposal targets markets on Sonic, Scroll, zkSync, Metis, Soneium, and Aptos, arguing that thin liquidity and minimal usage make them a net liability for the protocol. Several of those markets were already partially wound down before the formal recommendation landed. A governance vote is expected shortly.
cointelegraph_defi
BitMEX shuts down as its cultural legacy migrates to TradFi. Bloomberg frames the closure as a symbolic endpoint for the offshore, high-leverage, never-close model BitMEX pioneered, noting that the instruments it invented, including perpetual futures, are now standard on regulated Wall Street venues. The company’s legal troubles over the past several years had already reduced it to a rounding error in volume terms. Its closure closes a chapter but opens little new territory.
bloomberg_crypto
Ethereum’s 43-day staking queue is a mechanics story, not a demand signal, Sygnum warns. Sygnum analyst Thomas Brunner cautions that the extended validator queue reflects the constrained churn limit built into the protocol, not a sudden surge of fresh capital entering Ethereum. Reading it as evidence of bullish demand could give a misleading picture of network health heading into August. TD Cowen separately cut its Sharplink price target to $13 on a lowered 2026 ETH price forecast.
theblocktheblock

Coldcard firmware exploit: see the Lead for the full breakdown. Roughly 1,000 BTC drained across 1,200 addresses; Galaxy Research now estimates losses at $70 million and rising. Coinkite has issued an immediate fund-migration advisory.
theblock
Trade.xyz begins compensating users hit by SKHYNIX perp pricing incident. An oracle failure on Trade.xyz’s synthetic equity derivatives caused incorrect liquidations on the SKHYNIX perpetual futures market. The platform has started reimbursing affected users, but the incident underscores the fragility of external data feeds powering synthetic RWA products.
cryptobriefing

Circle stacks a New York trust charter on top of its federal OCC approval. NYDFS granted Circle a limited-purpose trust charter for Circle Internet Trust Company, completing a two-layer regulatory structure that pairs state and federal oversight of USDC operations. The move makes Circle the most heavily licensed stablecoin issuer in the US, a meaningful competitive moat as the GENIUS Act framework takes shape. The approval came weeks after Circle secured its national trust bank charter from the OCC.
theblockcoindeskdecrypt
New York sues Kalshi for $36 billion, alleging the platform is an illegal gambling operation. The New York AG filed suit the day after the CFTC asked a court to block the state from enforcing its gambling laws against the federally regulated prediction market, setting up a direct federal-versus-state jurisdictional collision. The damages figure, at least $36 billion pending a full accounting, is deliberately large and appears designed to force a fast judicial resolution. Former Congressman George Santos separately agreed to pay the CFTC $35,000 to settle manipulation charges tied to trades he made on Kalshi around the State of the Union event.
theblockdecryptcointelegraph_regulationcoindesktheblockcftc_enforcement
US Treasury sanctions Iranian firms accepting bitcoin for Strait of Hormuz passage. OFAC designated two Iranian entities, including Hormuz Safe, which collected BTC and other digital assets as payment from vessels seeking safe transit through the strait. The action ties into a broader Dubai-linked network Reuters identified as handling roughly $4 billion in Iran sanctions evasion. Tehran’s escalating posture in the region, including a tanker strike near Oman, is running in parallel.
decryptcoindeskcoindesk
Senate Democrats propose a dedicated anti-corruption bureau as Trump crypto disclosures widen. Financial disclosures showed Trump earned hundreds of millions in crypto-related income, prompting a Democratic push to establish an independent oversight body targeting executive-branch conflicts of interest. The proposal has little path through the current Senate but signals the political salience of presidential crypto holdings is not fading. Expect it to surface repeatedly as the 2026 mid-term cycle accelerates.
theblock
What else is grinding?
- Russia has banned crypto mining in Moscow and the Kursk region through 2032, citing energy conservation priorities amid continued military operations.
cryptobriefing - Anthropic confirmed that a misconfiguration during internal red-teaming exposed three Claude models to the public internet long enough for the AI to compromise three real companies.
decrypt - The ECB published accessibility standards for its planned digital euro app, framing it as a baseline that participating payment providers would be required to meet.
cointelegraph_regulation - Texas lawmakers are weighing a ban on crypto kiosks after regulators attributed $57 million in resident losses to Bitcoin ATM scams, with three other states already having moved to outlaw the machines.
decrypt - Quantum Solutions and Hyperscale Data are both tapping crypto treasury assets to fund AI data centre builds, a capital-recycling move that is becoming a recognisable playbook for smaller listed companies.
coindesk - IBM’s CEO told investors the company is approaching a commercial quantum computing breakthrough, a claim that has resurfaced periodically for years without materially shifting the cryptographic threat timeline.
coindesk
Last sip. The Coldcard loss count is still moving, and no one has confirmed whether the attacker holds keys to more addresses derived from the same flaw.