Cryptoccino — Tuesday 18 August 2026

Bitcoin ETFs log worst outflow week in six weeks. Spot bitcoin ETFs shed roughly $390 million across the week, reversing a strong start to August and representing the steepest weekly outflow since late June. Bitcoin itself has been tracking equity moves, briefly crossing $64,000 in Asia hours, but the ETF drain keeps any sustained rally look unconvincing. Fear & Greed sits at 41 despite a 12-point recovery over the past week, which says the bounce in sentiment has not yet translated into fresh capital allocation. bloomberg_crypto coindesk

Bitcoin futures positioning is dangerously crowded. Open interest relative to available liquidity on major perp venues has reached levels where even a modest directional move could trigger a cascade of forced unwinds. Options implied vol is also running elevated against realised vol, pricing in tail risk even as spot grinds sideways. Traders leaning on leverage in either direction should note the exit is narrow. coindesk coindesk

Paul Tudor Jones’s fund rotates back into the iShares Bitcoin ETF. After roughly a year of selling, PTJ’s firm raised its IBIT stake 18.9% to 688,529 shares worth around $22.9 million in Q2, while simultaneously cutting call options exposure sharply. The shift signals a move from leveraged directional bets toward plain spot exposure, which reads as a more defensive posture rather than a high-conviction long. decrypt

XRP tests the $1 line it has held since the 2024 US election. The token slipped to the dollar mark over the weekend, with daily and weekly charts now both showing deteriorating momentum. Traders are positioning for a rebound, but bearish commentary is the loudest it has been in months, and a clean break below $1 would end a nearly two-year streak of support at that level. coindesk decrypt

Bitmine now controls close to 5% of Ethereum’s total supply. Tom Lee’s firm added 9,926 ETH last week at a cost of roughly $19 million, bringing total holdings to 5.82 million tokens worth around $11 billion. The company says it is 96% of the way to its stated 5% target, and buybacks have reached 20.8 million shares since July. It is the same treasury-accumulation playbook as Strategy but applied to ETH, and the concentration is getting hard to ignore. theblock coindesk decrypt

Compound pivots to institutional lending with $52 million and a new leadership team. The DeFi protocol is repositioning itself away from retail borrowers toward institutional clients, committing $52 million to the shift alongside a management overhaul. It is a direct acknowledgement that the retail DeFi summer model does not generate the sustained revenue that institutions can. Whether Compound can compete with purpose-built institutional credit desks is the open question. coindesk

Harmony plans a full chain rollback after an exploiter minted 3 trillion ONE tokens. The team considered blacklisting wallets and burning the forged supply but concluded a pre-attack rollback was the fairest resolution, which means 109,000 transactions will be wiped. Ravencoin is separately navigating its own rollback dispute from a different exploit, making this an unusually active week for the nuclear option in chain governance. theblock cointelegraph_defi

Tokenised equities have tripled market share since January, now at $2.8 billion. Ondo, Binance and xStocks are leading a segment that has grown its share of the broader tokenised asset market to 15%, up from roughly 5% at the start of the year. Meanwhile, Robinhood Chain’s TVL surged 45% in August, driven almost entirely by USDe stablecoin inflows rather than tokenised RWAs, which are actually losing ground on that specific chain. theblock theblock

Full Coldcard coverage is in the lead. See the lead story above for the $100 million Coldcard firmware exploit and its implications for hardware wallet security assumptions. coindesk

Bits of Gold data breach exposes 200,000 customers. Israel’s largest crypto broker confirmed a breach affecting the personal data of around 200,000 clients. No fund losses are reported, but the scale of the PII exposure creates significant phishing and physical attack surface for affected users. coindesk

SafePal order-tracking plug-in leaks physical addresses of 40,000 hardware wallet buyers. A vulnerability in a third-party order-tracking tool exposed names, home addresses and phone numbers for nearly 40,000 SafePal customers. Hardware wallet buyers are a high-value target for wrench attacks, and the combination of name plus delivery address is enough to make that risk very concrete. decrypt

macOS Screen Sharing auth flaw weaponised for Monero mining. The Dutch national cyber agency flagged active exploitation of an authentication bypass in macOS Screen Sharing that gives attackers root access, which is then used to silently deploy XMR miners. Public proof-of-concept code is circulating, so patch or disable the feature now. decrypt

US Treasury opens public comment on GENIUS Act stablecoin licensing rules. The Treasury is now formally soliciting input on regulations that will determine who can legally issue or distribute payment stablecoins in the US, with the law itself set to take effect in January 2027. The comment window is the first real opportunity for the industry to shape the implementation details, including which state licences qualify and how foreign issuers are treated. Exchanges and platforms distributing stablecoins to US customers face new compliance requirements under the proposed framework. coindesk theblock cointelegraph_regulation decrypt

OCC gives conditional approval to Trump family’s World Liberty Financial for a bank trust charter. The Office of the Comptroller of the Currency granted the conditional nod as ten House Democrats signed onto separate legislation framed explicitly as a safeguard against corruption in banking applications. The timing makes the approval politically radioactive regardless of its regulatory merits, and the Democrats’ bill is unlikely to move fast enough to matter. cointelegraph_regulation

SIFMA’s legal threat has paused the SEC’s crypto fundraising rulemaking. The SEC cited a scheduling conflict when it pulled back a digital-asset offering framework, but sources say Wall Street trade body SIFMA threatened legal action and the administration is waiting to see whether the Clarity Act clears in September before committing to a regulatory path. The delay leaves token issuers with no clear federal framework heading into the autumn. decrypt

Binance handed Russian authorities user data that contributed to the arrest of a Ukrainian donor. Reporting confirms that Binance complied with a Russian law enforcement request, sharing account data that was subsequently used to identify and detain a Ukrainian who had donated to the war effort. The case is a live illustration of the compliance risk that global exchanges face when operating across jurisdictions with adversarial governments. coindesk

What else is grinding?

• Austria’s FMA fined Bitpanda €70,000 for white paper and marketing disclosure failures, marking the first published MiCA enforcement action in the country. theblock coindesk
• Strategy raised $334 million by selling MSTR shares last week but made no bitcoin purchases, letting its dollar reserve climb to $4.8 billion while Saylor said buybacks are a possibility but not the priority. theblock decrypt
• Ethereum’s next upgrade is carrying 66 EIPs, with a headline privacy proposal that would allow shielded pools to pay their own gas fees without an intermediary. coindesk decrypt
• Binance is reportedly planning a fresh FCA licence application to re-enter the UK retail market after being barred from regulated activities there since 2021. cointelegraph_regulation
• Pirated downloads of the film ‘The Odyssey’ are already bundling Lumma Stealer, malware that exfiltrates crypto wallet credentials and browser sessions from infected machines. decrypt
• BitMart’s founder rejected calls for an independent audit as users publicly reported frozen withdrawals and employees described unpaid wages. coindesk

Last sip. Coldcard’s full firmware post-mortem still hasn’t landed, and until it does, nobody knows how many devices are still holding live exposure.