Friday, July 31, 2026

'Move your funds now' says CEO after Coldcard exploit

'Worst hit in Bitcoin history': Reactions pour in after Coldcard wallet flaw exposed

A firmware vulnerability in Coldcard hardware wallets — among the most respected self-custody devices in Bitcoin — was exploited to drain roughly 594 BTC worth about $38 million in a 25-minute sweep, sending shockwaves through the self-custody community. The flaw involves weak entropy during seed generation: an attacker who knows the pattern can recompute private keys without ever touching the device. Coinkite co-founder NVK issued an urgent warning — "move your funds now" — and shipped a hotfix protecting new seeds, but stressed it does not fix keys already generated on vulnerable firmware. Trezor's CTO put it bluntly: "Weak entropy during initialization = funds drained remotely. No device access needed." The community reaction was visceral, with some calling it worse than Mt. Gox because it strikes at the very bitcoiners who did everything right — studied the protocol, bought hardware wallets, took self-custody seriously. NVK attributed the discovery speed to AI-assisted code review: "AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts." Bitcoin fell 3% as the scope of the vulnerability became clear, and some commentators are already predicting a shift of self-custody holdouts toward ETFs and insured custodial solutions.

A message from Bullish

The standard for institutional crypto trading.

The only NYSE-listed crypto exchange, regulated by NYDFS, HKSFC, Bafin, and GFSC. Built for institutional trading, on the infrastructure regulated markets require.

One global order book, open 24/7, serving institutions in 50+ jurisdictions, with deep liquidity that holds in volatile markets.

Top 3 for BTC and ETH volume among the exchanges in the CME CF benchmarks. (CoinDesk Data)

Not investment advice. Digital assets and related products are high risk. Visit bullish.com/legal for more important information and risk warnings.

Learn more about Bullish

Markets

Quantum computing nears commercial breakthrough, IBM CEO says

IBM CEO Arvind Krishna told CNBC that quantum computing is on track to begin generating meaningful revenue by 2028 or 2029, and that by the end of the 2030s the sector represents a potential $1 trillion in value. The comments come as IBM, Alphabet, IonQ, Rigetti, and a wave of startups race to build machines capable of solving problems intractable for classical computers — from molecular simulation and drug discovery to logistics optimization and materials science. Unlike AI's reliance on GPU clusters, quantum computing requires entirely different hardware and purpose-built facilities. IBM backed its confidence with action: it's building a standalone quantum chip foundry with $1 billion committed from the U.S. Department of Commerce and a matching $1 billion from the company itself. The technology has crypto implications too — a sufficiently advanced quantum computer could theoretically threaten Bitcoin wallet encryption, though most experts say that scenario is still years away and blockchain networks will have time to upgrade to quantum-resistant cryptography before it becomes a real risk.

Markets

Crypto faces 3 barriers to next bull run, STS Digital CEO says

STS Digital CEO Maxime Seiler says three forces are holding bitcoin back despite record institutional blockchain adoption: institutional options selling, capital rotating into AI, and stalled U.S. crypto legislation. The surge in institutions selling options has created a reflexive loop that compresses implied and realized volatility, trapping bitcoin in a tight range and capping the kind of outsized rallies that defined previous cycles. Meanwhile, AI has become the dominant growth narrative, drawing both attention and capital away from digital assets. And the failure of the Clarity Act to advance before the Senate's August recess has left regulatory uncertainty intact. Ironically, Seiler notes that much of Wall Street's blockchain adoption — banks and exchanges upgrading to 24/7 settlement and clearing — is accruing value to incumbent financial institutions rather than to token holders. He expects a meaningful rally will require regulatory clarity, broader 24/7 market infrastructure, and a more supportive macro backdrop, with rate cuts or renewed monetary easing as a likely catalyst.

Know someone who should be reading this?

Share this newsletter

A 5-year-old bug just drained $38 million in BTC from 500 wallets.

SPONSORED BY

Friday, July 31, 2026

As July ends, the options market is flashing a clear bearish signal heading into August. The $60,000 bitcoin put option — a position protecting against a price drop — is now the most popular bet on Deribit, the world’s largest crypto options exchange, with notional open interest of $1.17 billion. Until yesterday, $70,000 and $72,000 call options were the market leaders, each boasting $2.5 billion in open interest as traders positioned for a post-Fed rally. That didn’t happen, and Friday’s $10 billion options expiry at 08:00 UTC likely flushed much of that bullish positioning. Seasonality adds to the caution: since 2013, a positive July — bitcoin is up 8.9% this month, near the historical median of 8.61% — has typically been followed by a negative August, with a median return of −7.51%. BTC and ETH are falling today even as equities rally, with the CoinDesk 20 on track for its best monthly gain since July 2025. Stay alert.

Read today’s full report →

Market snapshot

As of 9am EST

Asset

Price

24h

BTC

$63,756.89

+0.06%

ETH

$1,882.11

−1.04%

SOL

$73.45

−1.44%

XRP

$1.07

−1.77%

Prices approximate. Visit coindesk.com/price for live data.

A message from RealFi

Most stablecoins leave capital sitting still.

RealFi is different.

It connects on-chain capital to real-world markets like US Treasuries, money market funds, and private credit. Real transparency. Real impact. RealFi.

RealFi is launching August 2026.

Join the Testnet now at realfi.co

Find out more

What matters today

Markets

Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep.

Roughly 594 bitcoin — worth approximately $38 million — was swept from around 500 separate wallets between 01:31 and 01:56 UTC on Friday in an attack traced to a flaw in how Coldcard hardware wallets generated their cryptographic keys. The attacker moved 1,324 chunks of bitcoin across 500 transactions inside a three-block window, then consolidated 562 BTC into a single address that has not moved. Every drained wallet was single-signature and held more than 0.15 BTC, with many dormant for years. The vulnerability was introduced in Coldcard firmware 4.0.0 in March 2021: a build setting caused devices to skip their hardware randomness generator and fall back to a software substitute seeded from the chip’s serial number and clock registers — none of which are secrets. Block’s Bitcoin engineering team disclosed the flaw publicly because exploitation was already under way. Coinkite has warned users who created seeds on Mk3 devices running firmware 4.0.1 or later, and stated that Mk4, Q, and Mk5 appear unaffected. The exposure extends beyond wallet seeds to paper wallet private keys, seed-splitting masks, device cloning keys, and Key Teleport transfers. Bitcoin traded above $63,700 as the news broke, with the drain appearing to have little immediate market impact.

CoinDesk Disclosure: The information contained in this newsletter, and any information linked through the items contained herein, is not intended to provide sufficient information to form the basis for an investment decision. You should seek additional information regarding the merits and risks of investing in any cryptocurrency or digital assets.

L1.co Disclosure: This material is for informational purposes only, and the content contained herein should not be considered investment advice or a solicitation, offer, or recommendation to sell or buy any asset, strategy, or product. Investing in digital assets involves a high degree of risk, including the loss of principal.