Coldcard Exploit Hits $114M as Crypto Markets Bleed Quietly

The Coldcard hardware wallet exploit entered its fifth day with observed losses approaching $114 million, and the broader crypto market is taking it surprisingly well. ETH dropped 1.2% to $1,844.35 on $5.6 billion in volume. Bitcoin slipped below $63,000. The selling looks orderly, not panicked, which may say more about how thin participation has become than about actual resilience.

Cold Storage, Warm Panic

Galaxy Research flagged what appears to be a fourth wave of Coldcard-linked sweeps, with pending replace-by-fee transactions giving victims a narrow window to outbid attackers and redirect their own funds. Transfers of less than 1 BTC spiked to levels not seen since the days immediately following FTX's collapse, a proxy for small holders scrambling to move assets to safety.

The exploit has eroded confidence in cold storage as a category, though the damage so far has been contained to a specific firmware vulnerability in Coldcard devices. Hardware wallet maker Ledger saw a brief surge in social mentions as users explored alternatives, though Ledger has its own history of security incidents to answer for.

Thin Air Trading

Bitcoin's drop from $65,000 reflects stalled participation rather than forced liquidation, according to ARP Digital's Yusuf Fakhro. ETF flows turned negative. CME open interest has retreated to 2023 levels. Strategy, the largest corporate bitcoin holder, has been idle for five consecutive weeks, now tracking bitcoin's 200-week moving average as a key support indicator.

The bitcoin futures basis trade, once yielding north of 20%, now trails two-year U.S. Treasury notes. That spread has been negative since February. The arbitrage that drew institutional capital into crypto futures in 2024 and early 2025 has evaporated, leaving a quieter, more mature market with less speculative froth.

Coinbase's spot premium has been negative for 77 straight days, suggesting U.S. buyers remain less aggressive than overseas traders even as July ETF inflows briefly turned positive.

Regulatory Signals on Multiple Fronts

Bernstein expects the SEC and CFTC to accelerate crypto rulemaking under the administration's Project Crypto initiative if the Clarity Act fails to pass this year. The brokerage sees agency action as the path of least resistance compared to getting legislation through a divided Congress.

Robinhood secured UK crypto registration with the FCA before the country's new regulatory regime takes effect, positioning the trading platform for European expansion.

Bitget announced it will exit Japan entirely, halting new registrations immediately and closing remaining positions after December 31. The move follows Japan's increasingly rigid compliance requirements for foreign exchanges.

Corporate Moves

HashKey Exchange received JPMorgan approval to open client money accounts, weeks after securing similar arrangements with DBS Bank. The approvals give the Hong Kong-based exchange a traditional banking backstop that most crypto platforms still lack.

Trump Media's bitcoin wallets now hold roughly the amount the company previously pledged as loan collateral, following a $165 million BTC transfer to Crypto.com. Whether those moves were custody shuffles or sales will become clear in the company's next 10-Q filing.

ZeroStack, a Nasdaq-listed crypto treasury firm, warned of survival risk after reporting an $82.5 million loss. The company relies on staking rewards to fund operations, and its 0G token holdings were valued 91% below their recorded cost basis. South Korea's Bithumb, by contrast, outlined ambitions in the opposite direction: a preliminary IPO listing review in 2027 with a target date of 2028.

Circle and Galaxy Digital are set to report earnings in the week ahead, providing a read on stablecoin economics and institutional crypto infrastructure demand.

Macro Crosswinds

Oil and Treasury yields fell after fresh U.S.-Iran diplomatic engagement eased inflation expectations. 10x Research suggested bitcoin could confirm an August bear-market bottom, but flagged a risk scenario: if rising Treasury yields force the Fed to raise rates in September, any relief rally could be short-lived. The macro setup remains a tug-of-war between geopolitical de-escalation and stubborn long-end yields.

Magic City Update

The Coldcard exploit may be a global story, but it has a local edge. Miami-based self-custody meetups, which proliferated after the city branded itself a Bitcoin hub in 2021 and 2022, are fielding urgent questions from members about firmware verification and wallet migration. Several Wynwood and Brickell co-working spaces that host weekly crypto office hours reported higher-than-usual attendance over the weekend as holders sought in-person guidance on securing assets.

The timing is relevant for Miami's real-world asset tokenization builders. Homebase, which tokenizes residential real estate in South Florida, has consistently emphasized custodial security as a selling point for on-chain property investment. A crisis in hardware wallet confidence reinforces the argument for institutional-grade custody solutions in any tokenized asset framework, a message Miami's RWA sector has been making to skeptical traditional real estate players for over a year.

On the regulatory front, Bernstein's prediction that SEC and CFTC rulemaking will accelerate matters to Miami startups building in the tokenization and DeFi lending verticals. Florida's own digital asset legislation remains in committee, and clearer federal guidance could either complement or complicate the state-level framework Miami firms have been building around.