BIP-110 Split From Bitcoin, Then Its Only Miner Quit

The BIP-110 chain split off from Bitcoin at block 961,632 and stalled at 961,633 after its only miner stopped. The main chain kept building normally, reaching 961,721 by publish. Data: mempool.space.

By BitBrainers Editorial

Bitcoin split into two chains over the weekend. This one was not a surprise. BIP-110 hit its mandatory signaling deadline at block 961,632 on Saturday, and the numbers behind it had been telling the same story since March.

How The Split Actually Happened

BIP-110 is a one-year restriction on storing non-financial data, mainly Ordinals inscriptions, inside Bitcoin transactions. Supporters wanted it locked in through voluntary miner signaling. When that never reached the 55% threshold, the proposal's own rules forced a mandatory signaling period instead.

That period started August 7 at block 961,632. Nodes running BIP-110 software began rejecting any block that didn't signal support. Every other node kept validating normally, which is how you end up with two chains sharing one history up to a single block.

Support going into the deadline was thin: 2.53% of blocks signaled in the final two-week window, and the average since May sat closer to 0.42%. Ocean Pool provided most of what little signaling existed. We flagged this exact gap back in July, when support was still parked near zero.

The split didn't need majority support to trigger, only to lock in cleanly. Miners who reject non-signaling blocks simply start building their own chain the moment the deadline passes. Bitcoin Knots is the software behind that decision.

At block 961,632, AntPool mined the version the main network followed. Roughnecks, mining through Ocean, produced the signaling alternative that BIP-110 nodes accepted instead.

Ocean's own hashrate didn't move as one bloc, though. Its DATUM system lets individual miners set their own block templates, including whether to flip the BIP-110 signal. Simple Mining, which routes through Ocean, mined the very next block on the main chain instead. Even inside BIP-110's biggest backer, support was split.

The gap kept opening. By early Sunday afternoon the main chain had reached block 961,721 while the BIP-110 chain sat frozen at 961,633, the last block Roughnecks mined before it stopped. Eighty-eight blocks is several days of normal production on one side and nothing on the other.

Bitcoin has done this before without a split. Taproot activated at block 709,632 in November 2021 after building broad miner support first, and it never produced a persistent minority chain. BIP-110 entered its mandatory phase with a fraction of that support behind it, so the outcome here was closer to a default than a surprise.

Chain Splits Don't Wait For You To Catch Up

Get the mechanism explained before the headlines catch up. Free, straight to your inbox.

Subscribe

What This Means For Your Coins

Exchanges and ETF holders are not exposed to any of this. The people who need to pay attention are self-custody users running full nodes, especially anyone who updated to Bitcoin Knots to signal support. Replay protection is not automatic between the two chains, so moving coins carelessly during the split window can expose funds on both sides at once.

If you hold your own keys through a hardware wallet like Trezor, the fix is simple. Don't move anything until your node software and wallet firmware agree on which chain you're actually on.

Who's Saying What

Reaction split along predictable lines. Blockstream's Adam Back, who'd argued for months that a breakaway chain was the likely endgame, called the outcome settled and urged BIP-110 supporters back into the main ecosystem.

Strategy's Michael Saylor brought the clearest numbers: about 99.85% of Bitcoin's hashpower on the main chain, the minority branch stuck at two blocks and already more than 80 behind, figures that line up closely with what's above.

He followed with the math that matters. At roughly 0.15% of network hashpower, the minority chain needs 2,015 more blocks to reach its first difficulty adjustment, which at the current pace works out to about 25 years. His framing was blunt: "Consensus is earned, not declared."

There's a wrinkle if you mine through Ocean specifically. The pool switched its default endpoint to signal for BIP-110 on July 15, so anyone pointed at Ocean who never opted into the non-signaling endpoint has been mining the minority chain without realizing it. Developer Peter Todd flagged this over the weekend, estimating roughly $43,000 a day in hashpower value going to blocks the main network will never recognize.

The question of whether the minority chain would keep going got answered fast. Roughnecks, the pool behind both of its blocks, posted early Sunday that it was stopping mining under its own name after an internal team meeting around 3:40am UTC.

The post called it an escalation rather than a retreat and told anyone still mining BIP-110 blocks to stand down for now. Either way, the chain that split off at 961,632 no longer has an active miner behind it.

---

What Actually Got Resolved Here

Not much, honestly. The mandatory signaling period settled a governance mechanism, not the underlying argument. Whether non-financial data belongs in Bitcoin blocks is the same fight it was in March, and Ordinals volume has already been falling on its own for unrelated reasons.

The other side of this fight didn't need a fork at all. Ordinals advocate Leonidas proposed a client called DOG Mode in July that changes nothing about consensus rules. It just raises the transaction size Bitcoin Core will relay and drops the dust limit to one satoshi, making Ordinals and Runes cheaper to broadcast. DOG Mode needs one willing miner, not 55% of the network, which is the exact asymmetry BIP-110 just ran headfirst into.

With Roughnecks gone, the minority chain isn't fading out gradually so much as it just stopped. A chain with zero active miners doesn't creep toward its next difficulty adjustment. It sits frozen at whatever block it last reached, waiting for someone to pick the work back up.

The real story is what BIP-110 proved about changing Bitcoin's rules going forward. Getting 55% of hashrate to agree on anything in 2026 is a different bar than it was during Taproot, and the next controversial proposal will be measured against this exact outcome.

---

Sources

CoinDesk: Controversial Bitcoin fork BIP-110 mines two blocks, then stops

The Block: Bitcoin's BIP-110 supporters split onto minority chain as main network pulls ahead

KuCoin: Bitcoin BIP-110 Fork Fails as Mainnet Outpaces Minority Chain by 26 Blocks

ForkLog: Bitcoin network splits over BIP-110 soft fork

Binance Square (via Odaily): Roughnecks Stops Mining Operations Under BIP-110 Protocol

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

July Payrolls Fell. The September Hike Odds Went With Them

BTC/USD 1H reaction on August 7, 2026 following the July jobs report. Source: TradingView, Bitstamp.

By BitBrainers Editorial

July payrolls fell by 23,000. Consensus expected a gain near 80,000. June was revised down to 20,000 from the previously reported 57,000. September rate hike odds, which had climbed to 56.7% on Wednesday after Chair Warsh and Governor Cook both signaled openness to tightening, fell back to roughly 44% within hours of the print. Bitcoin spiked, then gave back most of the move, in the hours after the print.

The headline number is a contraction, not a miss. The economy shed jobs in July. Losses concentrated in local government education, down 50,000, and retail, down 19,000. Average hourly earnings rose just 0.1% on the month, 3.2% year over year, both soft.

The unemployment rate fell to 4.1% from 4.2%. That sounds like strength. It is not. The labor force participation rate dropped to 61.4%, the lowest level in more than five years. Fewer people looking for work pulls the unemployment rate down even when hiring is negative.

The Hike Case Just Lost Its Foundation

Wednesday's story was Warsh privately telling the Financial Times he would back a September hike if inflation data ran hot, with Governor Cook publicly saying the same. CME FedWatch odds jumped from 54.4% to 56.7% on that alone.

The hike case was never about jobs data hitting the mark. It rests entirely on the inflation prints still to come: CPI on August 12, PPI on August 13, and core PCE on August 26. But a labor market that is now shedding jobs, not just slowing, gives the doves on the committee real ammunition heading into those releases. Hammack, Kashkari, and Logan dissented for a hike on July 29 when the data still looked resilient. That argument gets harder to make in front of a negative payrolls print.

What the Market Did

Bitcoin spiked to $65,320 in the immediate reaction to the print, then faded back into the mid-$64,000s within hours. That is the print-below-100K, risk-recovers scenario from this morning's setup, not the sell-first pattern that shows up when weak data reads as recession fear instead of rate-cut relief. The fade is worth watching too: initial relief rallies that don't hold often mean the move was positioning unwinding, not fresh conviction.

It also lands on top of a genuine institutional bid. ETFs have taken in $763.6 million over four consecutive sessions heading into today. A soft jobs report that cools hike odds without reviving recession talk is close to the best case that streak could have asked for.

The reaction outside crypto confirms the read. Stock futures jumped and Treasury yields fell within minutes of the release, with the curve bull steepening as traders priced out the more aggressive tightening path Warsh had floated two days earlier. That is a market repricing toward easier policy, not one bracing for recession.

---

Get the Weekly Brief

One email. Monday morning. The macro events that move Bitcoin this week.

Subscribe

Why the Cut Path Still Isn't Guaranteed

A falling participation rate is not the same signal as a strong labor market, and traders reading today's unemployment tick as good news are reading half the report. One weak print plus heavy downward revisions is harder to wave off than a single soft month, but it is still one data point against three more scheduled releases before the Fed meets on September 15 and 16.

Hot inflation in any of those three reports puts the hike case back on the table fast. Warsh has not walked anything back. He has just lost his best piece of supporting evidence for now.

Watch whether Hammack, Kashkari, and Logan, the three dissenters who wanted a hike on July 29, say anything publicly before the next meeting. Their case was built on a labor market that was still adding jobs. A negative payrolls print with heavy revisions is the kind of data that makes a dissent harder to repeat, not easier.

Track the Next Signal Yourself

The same deviation-from-consensus logic that just moved hike odds by 12 points applies to every print between now and September 16. Markets do not react to whether a number is good or bad in isolation, they react to how far it lands from what was already priced in, which is exactly why a falling unemployment rate produced a rally instead of relief.

We built a one-page reference for reading each of the remaining releases: what a hot or cold surprise on CPI, PPI, and core PCE typically does to hike odds and to BTC, so you are not starting from scratch on August 12. Grab the free FOMC signal cheat sheet here.

For the full pre-print setup, including the ETF flow context behind today's rally: this morning's post

---

Sources

Reuters US nonfarm payrolls fall in July; unemployment rate eases to 4.1%

Bureau of Labor Statistics Employment Situation Summary

CME Group FedWatch Tool

Tools: Kraken for trading. Trezor for storage.

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

$763.6 Million in Four Days, NFP Decides If the Streak Holds

Spot Bitcoin ETF total net flows (green/red bars) and BTC price (orange line), January 2024 to August 2026. Source: SoSoValue.

By BitBrainers Editorial

Spot Bitcoin ETFs have recorded net inflows for four consecutive trading days in August 2026. The total stands at roughly $763.6 million. BlackRock's IBIT led every session. Franklin Templeton returned after 30 days of silence. The July nonfarm payrolls report lands at 8:30 AM ET. This is the first real test of whether the streak is conviction or reflex.

The numbers are straightforward. On August 3, the complex took in $170.1 million: IBIT led with $111.4 million, Fidelity's FBTC added $33.4 million, and Franklin Templeton's EZBC bought $9.2 million, its first purchase in more than 30 days. On August 4, IBIT added $170.3 million and the complex printed $211.5 million total.

On August 5, IBIT led again with $196.8 million and the daily total reached $244.4 million, the strongest single day of the run. On August 6, IBIT added $128.3 million and the complex printed $137.6 million total despite outflows from HODL and GBTC.

The cumulative August total is now roughly $763.6 million. Total net assets across the complex sit at approximately $79 billion. Cumulative net inflows since January 2024 are approximately $51.9 billion. The year-to-date deficit, which stood at $5.4 billion after June's carnage, has narrowed to roughly $4.5 billion.

The Context

June produced $4.5 billion in outflows, the worst month since the ETFs launched. July recovered only $172.4 million. August has already added roughly $763.6 million in four sessions. That is a reversal, not a recovery, and reversals in ETF flows have been short-lived in 2026.

The last sustained inflow streak ran seven sessions from July 14 to July 22, totaling roughly $981 million. It followed a ten-day outflow streak that pulled $2.73 billion from the complex. The streak before that, in April, brought $2.44 billion and nearly doubled March's $1.32 billion. Each streak has been followed by renewed selling. The question is whether August is different.

What makes this streak notable is the breadth. On August 3, every major fund printed green. IBIT, FBTC, BITB, ARKB, BTCO, and EZBC all bought. That level of coordinated participation has not happened since April. On August 5, even ARKB added $37.6 million, a fund that had been bleeding for most of July. The only red days in August came from HODL and GBTC, both legacy products with structural outflow trends.

---

What the Flows Actually Say

IBIT's flow profile tells the whole story. Over the past four trading days, IBIT has taken in roughly $607 million. Over one month, it has lost approximately $1.83 billion. Over three months, $3.91 billion has left. The four-day figure recovers roughly a third of one month's outflows. The streak matters, but it has real ground left to cover.

The year-to-date picture keeps the bulls honest. The complex would need roughly seven more weeks at the current pace simply to return to flat for 2026. One session in early 2026 recorded $753 million in a single day. The current streak averages roughly $189 million per day. The capacity for large creations exists. What has been absent is the sustained sequence that converts individual green days into a trend.

The structural improvement is durability. The complex has now been through an $8.2 billion drawdown, a $2.73 billion ten-day outflow streak, and a 21-month price low without any product closing, any issuer exiting, or any operational failure. The infrastructure held, which is not a price catalyst but the kind of datapoint institutional allocators underwrite before they size up.

---

The NFP Test

Consensus expects 83,000 to 100,000 jobs for July. The unemployment rate is expected to hold near 4.2%. The Fed held rates at 3.50% to 3.75% on July 29 with three dissenters voting for a hike. Chair Kevin Warsh said the Committee is positioned to wait for more data. That data arrives in hours.

A print below 100,000 with rising unemployment increases cut expectations. Risk assets typically sell first on recession fears before recovering on liquidity hopes. Bitcoin's $64,000 area, trading near $64,300 as of this morning, faces its first real test since February. If the ETF bid is conviction, it holds through the initial volatility. If it is reflex, the streak breaks today.

A print above 150,000 with steady unemployment validates the three dissenters. The dollar strengthens. The recent ETF inflows look premature. The streak breaks for a different reason.

The Goldilocks zone, 100,000 to 150,000, leaves the Fed holding in September and the market shrugging. The streak continues because the macro ambiguity that created it remains intact.

---

Get the Weekly Brief

One email. Monday morning. The macro events that move Bitcoin this week.

Subscribe

What to Watch

Watch the headline figure relative to 100,000. That is the threshold where recession pricing overtakes soft landing pricing.

Watch the unemployment rate. A tick to 4.3% or higher matches the highest level since late 2021.

Watch average hourly earnings. Sticky wages with weak jobs create the hardest outcome for the current policy framework.

And watch the ETF flow print for today. It will not be available until after the market close, around 4 PM ET. If the streak holds through an NFP miss, the institutional bid is real. If it breaks, the reflex trade is over.

For the full NFP preview and the Fed dissent context: yesterday's setup post

---

Sources

Farside Investors Bitcoin ETF Flow (US$m)

SoSoValue Bitcoin ETF Tracker

The Block Spot Bitcoin ETF Flows

Tools: Kraken for trading. Trezor for storage.

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

Tomorrow's NFP Is the Only Print That Matters Before Jackson Hole

BTC/USD daily. Orange vertical line marks the July 3 NFP print. Dashed lines show the $60,000 to $67,000 range that has contained price since. Source: TradingView.

By BitBrainers Editorial

Bitcoin has traded between $60,000 and $67,000 for most of the third quarter. Spot Bitcoin ETFs took in $626 million over the first three sessions of August, with BlackRock's IBIT accounting for the bulk, after $4.5 billion in outflows during June. For readers trading these levels, Kraken offers spot and futures on BTC and ETH. The July nonfarm payrolls report lands tomorrow at 8:30 AM ET.

June's report set the current setup. Here is the last print and how Bitcoin reacted:

Month	NFP	Est.	U Rate	Part.	AHE	BTC Reaction
June 2026	+57,000	110,000 to 115,000	4.2%	61.5%	3.5%	Dropped to $58K pre-print, then rose to $62K within 48h (+7%)

April and May were revised down by a combined 74,000 jobs. The three month average sits near 111,000.

---

What the Fed Did

On July 29 the FOMC held the federal funds target at 3.50% to 3.75% on a 9 to 3 vote. The three dissenters, Hammack, Kashkari, and Logan, preferred a 25 basis point hike. Chair Kevin Warsh said the Committee is positioned to wait for more data. That data is tomorrow.

Markets currently price about 55% odds of a September cut. The dissent complicates that pricing. One third of the voting committee believes policy is too loose. Warsh noted that tighter financial conditions already reflected in market rates gave the Fed room to hold, but he also said higher rates could well be part of the solution. The market heard that as a hawkish hold.

---

The Two Scenarios

A print below 100,000 with rising unemployment would increase cut expectations. Risk assets often sell first on recession fears before recovering on liquidity hopes. Bitcoin's $64,000 area faces its first real test since February. If the number collapses toward 80,000 or lower, the recession trade activates and the Fed faces pressure to cut 50 basis points, not 25.

A print above 150,000 with steady or falling unemployment would support the dissenters. The dollar would strengthen and the recent ETF inflows would look premature. $62,000 becomes the next level to watch. The market would reprice toward no cut in September, and the hawks would have the data they need to push again at the September meeting.

---

We read the filings so you can skip the timeline.

Weekly Bitcoin and macro analysis, built from primary sources.

Subscribe

What This Sets Up

Watch the headline figure relative to 100,000. That is the threshold where recession pricing overtakes soft landing pricing.

Watch the unemployment rate. A tick to 4.3% or higher would match the highest level since late 2021.

Watch average hourly earnings. Sticky wages with weak jobs create the hardest outcome for the current policy framework. The Fed cannot cut into accelerating wage inflation, and it cannot hold if the labor market is cracking.

And watch Bitcoin's reaction at $64,000. The level has held through three tests in the last month. If NFP misses and BTC drops through $62,000 on recession fear, the ETF bid will face its first real redemption test since June. If BTC holds or rallies on cut pricing, the institutional floor is real.

Jackson Hole runs August 27 to 29. This is the last major labor report before then. The ETF buyers are positioned for cuts. The three Fed dissenters are positioned for a hold or hike. Tomorrow's number settles it.

For the wider macro setup this week and the dates that matter: this week's Weekly Brief

---

Sources

Trading Economics United States Non Farm Payrolls

MUFG Research US Labor Update

U.S. Bank Federal Reserve Holds Rates at 3.50%-3.75% in July 2026

Texas Capital Bank No change in rates — Fed Meeting of July 29, 2026

The Wall Street Journal Fed Holds Rates Steady but Three Officials Vote for Increase

Kansas City Fed Jackson Hole Economic Policy Symposium

Tools We Use

Kraken — Spot and futures on BTC, ETH, and 200+ assets.

Trezor — Cold storage. No internet connection required.

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

BlackRock Bought the Dip. Italy's Largest Bank Sold 94% of IBIT. Someone Is Wrong

Source: The Block. Dark blue bars are IBIT. The chart updates daily.

By BitBrainers Editorial

Intesa Sanpaolo cut its BlackRock IBIT position by 93.7% in the second quarter, dropping from roughly ~646,809 shares to 40,723 shares. The filing also disclosed a new put position against the same fund and a tripling of the bank's staked Ethereum ETF stake. This is not retail panic. This is Italy's largest bank, with €1.5 trillion in customer assets, deciding that a quarter of a billion dollars in Bitcoin ETF exposure was too much to keep.

In the same quarter, BlackRock's IBIT took in $869 million in a single week. The fund now holds 3.70% of every Bitcoin in existence and has absorbed $60.81 billion since launch. One institution is running for the exit. Another is still vacuuming up the floor. Both cannot be right about the same asset at the same price.

---

The Filing That Got Buried

Intesa Sanpaolo's Q2 13F landed without the fanfare of a MicroStrategy purchase or a Tesla headline, which is exactly why it matters. The bank had been one of the more visible European institutional adopters, more than doubling its crypto ETF holdings to $235 million in Q1 2026. Sixty days later, the Bitcoin allocation was effectively gone.

The details are more interesting than the headline. The bank did not just sell. It bought puts. That is a directional bet, not a rebalancing. And the same filing shows the bank tripled its position in a staked Ethereum ETF, suggesting the capital did not leave crypto entirely. It rotated. Whether that rotation is a vote against Bitcoin specifically, or against the ETF wrapper, or simply a mandate level decision to favour assets that generate yield over assets that produce none, the filing does not say. What it says is that one of Europe's most conservative systemically important banks no longer wants to own Bitcoin through BlackRock's product.

---

BlackRock's Vacuum

IBIT has now led daily inflows for so many consecutive sessions that the pattern is almost boring. The fund took in $319 million of a $499 million weekly total in late July, then added another $183 million in the final days of the month. When the broader complex was bleeding $4.5 billion in June, IBIT still found buyers. When Fidelity's FBTC, a fund with zero fees, was shedding $85 million in a week, IBIT was taking in $869 million.

The explanation is not price. It is plumbing. BlackRock's products sit on the platforms that pension managers, endowments, and financial advisers already use. Buying IBIT means clicking a button they have clicked a thousand times before. For most institutional allocators, IBIT is not a crypto bet. It is an asset allocation decision made inside infrastructure they trust. That distribution advantage explains why a fund charging 0.25% is beating a free competitor four to one.

But distribution is not conviction. It is convenience. And convenience flows reverse faster than conviction flows when the narrative turns.

---

The Divergence

Here is the tension. Intesa Sanpaolo sold 94% of its IBIT stake in a quarter when Bitcoin traded between roughly $60,000 and $67,000. BlackRock's own clients added billions through the same product in the same price range. Either Italy's largest bank is front running a correction that BlackRock's allocators do not see, or BlackRock's allocators are averaging into a range that Intesa decided was a ceiling.

The third option is that they are different animals entirely. Intesa's $235 million position was a trading book allocation, nimble enough to rotate into staked ETH in sixty days. BlackRock's inflows are coming from model portfolios and target maturity funds that rebalance quarterly, if that. One is a speedboat. The other is an oil tanker. They can move in opposite directions without either being wrong about the destination.

What breaks that symmetry is scale. IBIT now holds roughly $48.86 billion in net assets. If Intesa's rotation is the first of many European banks trimming Bitcoin ETF exposure ahead of regulatory uncertainty, the EU's MiCA deadlines, the stalled CLARITY Act, the ethics deadlock in Washington, then BlackRock's inflows are absorbing exits that have not yet shown up in the daily flow data. The daily prints show BlackRock winning. The quarterly filings show someone large leaving. Both are true. One is just slower.

---

What the Flows Actually Say

Zoom out and the picture is less bullish than the IBIT headlines suggest. U.S. spot Bitcoin ETFs recorded $5.4 billion in net outflows in the first half of 2026, their first negative half year since launching in January 2024. June alone produced $4.5 billion in outflows, the largest single month exit on record. July's recovery covered roughly 15% of that damage before the final week flipped back to red.

The cumulative net inflow total since launch, roughly $53.94 billion, is still below the October 2025 peak. The funds have not made back what they lost between November 2025 and February 2026, a four month stretch that saw $6.38 billion leave alongside Bitcoin's slide from over $100,000 to nearly $60,000.

IBIT's dominance is real, but it is also a concentration risk. When a single fund is the only buyer in a market of sellers, the fund becomes the market. Large inflow days now have follow on effects on spot price that did not exist eighteen months ago. That feedback loop cuts both ways. If BlackRock's allocators ever stop buying, a bad quarter, a risk averse macro shock, a regulatory headline, there is no second buyer large enough to absorb the flow.

---

We read the filings so you can skip the timeline.

Weekly Bitcoin and macro analysis, built from primary sources.

Subscribe

What This Sets Up

Watch the next wave of 13F filings. Intesa was not the only European bank in these products. If Deutsche Bank, BNP Paribas, or Santander show similar reductions in Q3, the institutional adoption narrative needs a rewrite. One bank rotating is a trade. Three banks rotating is a trend.

Watch Ethereum ETF flows. Intesa did not leave crypto. It left Bitcoin for staked ETH. If that rotation repeats across other institutional filings, the Bitcoin is the only institutional crypto thesis takes a hit. Ethereum's ETF complex is smaller and younger, but it is yield bearing in a way Bitcoin's is not, and that matters for bank treasury desks.

Watch IBIT's daily prints for deceleration. The fund has led inflows for so long that the streak itself has become the story. The day that streak breaks, not because of a single red day, but because the weekly total turns negative while Bitcoin is still above $60,000, is the day the oil tanker starts turning.

And watch Friday's NFP. A print below 100,000 prices in a September cut and gives risk assets a macro tailwind. Above 150,000 and the Fed's three dissents start looking like a majority. Intesa and BlackRock are arguing about Bitcoin's institutional future. The jobs number might decide who is right.

For the wider macro setup this week and the dates that matter: this week's Weekly Brief

---

Sources

CryptoTimes Intesa Sanpaolo Slashes IBIT Holdings 94%, Boosts ETH Stake 3x in Q2

Yahoo Finance BlackRock's IBIT Leads Nearly $1B Bitcoin ETF Recovery as Inflows Hit 7 Straight Days

CryptoBriefing BTC ETF Flows Turn Negative for Over Half of 2026

CoinDesk The Bitcoin ETF Recovery in Flows Is Real. It Is Just Not Complete Yet

Investing.com BlackRock IBIT Sees $214M Outflow as Redemption Streak Hits $4.4B

Tools We Use

Kraken — Spot and futures on BTC, ETH, and 200+ assets.

Trezor — Cold storage. No internet connection required.

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

The Market Priced Everything This Week Except the $110 Million Theft

By BitBrainers Editorial

On July 30 an attacker emptied 1,196 Bitcoin addresses in 41 minutes. Four waves later the running total stands at 1,815.75 BTC across 5,294 addresses, with a fourth wave actively running on August 3. The devices holding those coins were Coldcards, the hardware wallet the most security-conscious corner of Bitcoin has recommended for a decade. Bitcoin closed July 30 around $62,800, down less than 1% from the prior session, and was back at $63,781 by August 3. A theft at that scale bought a brief dip inside an existing range.

Forty Bits Instead of One Hundred Twenty Eight

A hardware wallet generates a seed phrase from a dedicated chip built to produce true randomness. The target is 128 bits of entropy, a number large enough that guessing it is computationally impossible for anything humans can build.

A single code change on March 1, 2021 caused Coldcard firmware to silently fall back to a software pseudorandom generator instead of the STM32 hardware chip. On Mk3 devices the effective search space collapsed to roughly 40 bits. Coinkite has confirmed that figure. Every coin taken came from a wallet created after that March 2021 firmware release, which is the strongest on-chain evidence linking the thefts to the bug.

The gap between 128 bits and 40 bits is not a matter of degree. An attacker who could constrain the device UID, timer state and prior RNG-call history could reproduce candidate seeds offline, derive their addresses, and check them against public blockchain data. No physical access to any device was required at any point.

Coinkite CEO Rodolfo Novak apologised publicly and took full accountability, saying the company's review process had failed to catch it. Emergency firmware shipped on July 31. That firmware does not repair an existing seed. A seed created with weak entropy stays weak permanently, on any device, in any wallet software. Coinkite has since halted shipments and destroyed all remaining vulnerable inventory, an acknowledgment that the problem cannot be patched on existing hardware, only replaced.

---

The Coins Have Not Moved

Here is the detail that explains the muted reaction. Galaxy Research reported that the first three waves of stolen Bitcoin remain unspent in attacker-controlled addresses. Not mixed, not bridged, not sent to an exchange. A fourth wave is moving coins right now as this post publishes.

Galaxy called that unusual for a theft of this size and offered two readings: the operator is waiting for scrutiny to fade, or has no viable path to launder a sum this visible on a public ledger. A decade ago $75 million in stolen Bitcoin would have been through a mixer within hours. Today, with exchange compliance tightened and firms like Galaxy and Chainalysis watching in real time, moving it is the hard part.

What happened here was a change of ownership rather than supply hitting the market, and for price purposes those are entirely different events. Only one of them registers as flow.

That covers the mechanics. It does not explain why the drift since has been sideways rather than sharply lower, which is where the rest of the week comes in.

---

We read the filings so you can skip the timeline.

Weekly Bitcoin and macro analysis, built from primary sources.

Subscribe

What Was Actually Setting Price

The $116 million was competing for attention with a calendar that had far more direct claims on flows.

The FOMC voted 9-3 to hold rates at 3.50% to 3.75% on July 29, with three officials dissenting toward a hike. Fed Chair Kevin Warsh again declined to give forward guidance. The PCE print on July 31 showed continued cooling, which softened hike expectations at the margin without changing the committee's split.

Spot Bitcoin ETFs posted net outflows of $61.53 million for the week ending July 31, breaking a three-week inflow streak worth roughly $306 million. Fidelity's FBTC led redemptions at $85.19 million. BlackRock's IBIT ran the other way with $869.02 million in weekly inflows.

Senate Majority Leader John Thune confirmed the CLARITY Act would not get a floor vote before the August recess. Polymarket odds on 2026 passage sit near 28%, down from 82% in February.

Three catalysts with direct, measurable links to institutional flows. Against those, a firmware bug affecting a device with a niche installed base competes for headlines, not for order books.

Strategy's Michael Saylor flagged that Bitcoin is sitting almost exactly on its 200-week moving average, a level it has traded above 92% of the time by Strategy's own calculation. That is the company's number rather than an independent study, but the level is real and the market is respecting it.

---

The Part Nobody Is Pricing

Price gave this one candle. Bitcoin's security assumptions deserve considerably more than that.

The bug lived in open-source code for five years. Public review is supposed to be the defence, and the code was public the entire time. Coinkite says it suspects an attacker used an automated tool to comb old code versions, something Coinkite itself had attempted weeks earlier without finding it.

That is the uncomfortable part. Machine-assisted auditing found a five-year-old flaw before the vendor running the same class of tool did. Every open-source wallet firmware repository is now sitting in the same searchable pile, and the search cost has collapsed.

Victims are organising class-action claims over losses now exceeding $116 million. Legal opinion is split on whether a hardware manufacturer carries product liability for a firmware defect of this kind. Whatever the outcome, it sets the first real precedent for the category.

None of that is in the price. Some of it will be, eventually, in the form of slower self-custody adoption or a repricing of what a hardware wallet warranty is actually worth.

---

The Argument Happening Underneath

The louder claim circulating is that this marks a turning point for self custody, an assault on the be-your-own-bank position that has anchored Bitcoin culture since the beginning.

The counterargument is more persuasive. People who already cared about self custody will now care more and tighten their setup. People who never cared are still leaving coins on exchanges and were never going to be moved by a firmware advisory. The net behavioural change is probably close to zero, which is a duller conclusion than a revolution but fits how the last several custody scares actually played out.

The concrete prediction worth holding onto is narrower. Passphrases move from optional to standard practice, because a BIP-39 passphrase is the specific thing that protected people here. Dice-roll entropy sits in the same category. Both were treated as advanced-user extras for years, and both just became the difference between a working wallet and an empty one.

A paid hardware device is a convenience layer that a lot of holders quietly reclassified as a security guarantee. The device did the job it was sold to do, right up until one line of firmware meant it had never been doing it at all. Convenience and guarantee are not the same product, and the price difference between them is not what the market has been paying.

---

What This Sets Up

Watch whether the first three waves move. A transfer toward an exchange or mixer turns a custody story into a supply story, and that is the version that would show up on a chart. An OP_RETURN message has already appeared in one attacker address advertising laundering services and KYC bypass for a 10% fee. That is not the attacker moving coins. It is the wider illicit economy signalling it is ready when they are.

Watch the class-action filings. A ruling on manufacturer liability for a firmware defect would reprice risk across every hardware wallet vendor, not just Coinkite.

Watch the audit wave. If machine-assisted review of old firmware is now cheap enough for an attacker to run at scale, the next disclosure of this type is a question of scheduling, not probability. The vendors with the shortest patch-to-disclosure gap will be the ones that survive the next one with their reputations intact.

For the wider macro setup this week and the dates that matter: this week's Weekly Brief

---

Sources

Bloomberg Coldcard Bitcoin Wallets Compromised as Hackers Exploit Software Flaw

Fortune Bitcoin Owners Rocked by $116 Million Hack: What We Know About the Coldcard Exploit

The Hacker News Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes

TheStreet Crypto Coldcard Hack Just Grew to $89M

CryptoTimes Coldcard Hack Enters Wave 4: 449 BTC Swept Live

Blockhead A Five-Year-Old Coldcard Bug Let Hackers Guess Bitcoin Wallet Keys

Bitcoin Magazine Coinkite Releases Fixed Firmware After Coldcard Bug

Bitcoin.com News Coinkite Faces Class Action Threat as Bitcoin Wallet Bug Costs Users Over 1,300 BTC

CaptainAltcoin Bitcoin Spot ETFs End Inflow Streak

Tools We Use

Kraken — Spot and futures on BTC, ETH, and 200+ assets.

Trezor — Cold storage. No internet connection required.

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

Weekly Brief: July Closed Green. August Has a Record to Defend

By BitBrainers Editorial

Bitcoin closed July at roughly $63,000, up about 7% for the month. That makes three consecutive green Julys, a streak no other month can match. August arrives with the worst seasonal record on the board, a CLARITY Act that just lost its Senate floor window, and an ETF flow picture that flipped back to red in the final week of the month. The range from early July is still intact. Whether it holds is the only question that matters this week.

July Ended Green. August Has Never Been Kind.

Bitcoin held the $60,965 floor through July and closed near $63,000. The month printed green for the third consecutive year, which is genuinely rare. Seasonal data going back to 2013 shows August closing red more often than any other month, with a median loss around 8%.

That context does not make a down August inevitable. It does put the burden of proof on the bulls. A three-day close above $66,885 invalidates the bearish seasonal framing and opens a path toward $76,000. Losing $60,965 on a three-day close starts a different conversation, with the $54,000 zone as the next technical reference.

The range has held since early July with no break in either direction on real volume. Until that changes, the range is the trade.

---

ETF Flows: Three Weeks Up, Then a Friday Flush

Spot Bitcoin ETFs ran three consecutive weeks of net inflows through late July, roughly $306 million across the streak. That reversed June's $4.5 billion outflow month, the worst since the funds launched in early 2024.

The final week broke it. Net outflows hit $61.53 million for the week ending July 31, driven by a sharp move on the last trading day. Fidelity's FBTC led redemptions at $85.19 million. Grayscale's GBTC shed another $52.63 million.

BlackRock's IBIT was the outlier, posting $869.02 million in weekly inflows against the broader red tape. IBIT keeps functioning as the institutional anchor, but even that inflow could not offset redemptions across the rest of the product set.

Three weeks of inflows followed by one red week is not a trend reversal. It is a data point worth watching as August opens.

---

Flows over noise, every week.

The macro and Bitcoin read that skips the hopium and shows the data.

Subscribe

CLARITY Act: The Window Closed Without a Vote

Senate Majority Leader John Thune confirmed last week that the CLARITY Act will not get a floor vote before the recess. The bill is not dead, but the calendar now works against it in ways it did not in February.

The updated merged text dropped on July 22 at 616 pages, combining the Senate Banking and Agriculture drafts and adding ethics provisions barring covered federal officials from issuing or sponsoring digital assets while in office. Democrats had demanded those provisions for months. The compromise arrived too late for a floor calendar already consumed by a Russia sanctions package and a backlog of nominations.

Polymarket odds on the CLARITY Act becoming law in 2026 have fallen to roughly 28%, down from 82% in February. The bill passed the House in July 2025 with 294 votes and cleared the Senate Banking Committee in May. It has not received a full Senate floor vote. Missing August does not kill it, but it pushes the next realistic window into a fall calendar crowded by election-year politics and must-pass appropriations.

The market impact runs through what stays in place without it. The SEC and CFTC's March 17 joint guidance, classifying 16 digital assets under a five-category taxonomy, remains the operating framework. That guidance can be rescinded by any future administration without a congressional vote. A statute cannot. The longer the bill waits, the longer that reversibility sits under every institutional allocation decision.

---

The Fed Held. Jackson Hole Is the Next Real Signal.

The FOMC voted 9-3 to hold rates at 3.50% to 3.75% on July 29. Three officials dissented in favor of a hike. Fed Chair Kevin Warsh again withheld forward guidance in the post-meeting statement, consistent with his strategic-ambiguity approach.

The PCE price index released July 31 showed continued cooling, which softened rate-hike expectations at the margin. But three dissents on a hold is not a committee drifting toward cuts. The next FOMC is September 15 to 16. Warsh speaks at Jackson Hole on August 27 to 29, and that speech is the next real read on direction.

Bitcoin barely reacted to the hold. That tracks with how the market has treated Fed decisions all year. The live sensitivity sits in ETF flows and the legislative calendar, not the rate line itself.

---

Key Levels This Week

Bitcoin near $63,000 entering August 3. Support at $61,400 and $59,070. Resistance at $64,567, with $67,172 as the next target if reclaimed on volume. The $60,965 weekly floor is the structural line.

Price sits below the 20-day moving average inside a descending channel. ETH trades near $1,865 with supports at $1,807 and $1,717. XRP at $1.06, near its own channel support around $1.05.

None of the three have confirmed a breakout. All three are watching the same variables: the jobs print, ETF flows, and whatever the Senate does before it leaves town.

---

The Week Ahead: Dates That Matter

This is a calendar-heavy week where the macro prints and the Senate clock overlap. The dates below are the ones capable of moving price.

Date	Event	Why It Matters
Mon Aug 3	Senate floor opens	Published schedule lists only a spending-bill vote. No CLARITY Act action.
Wed Aug 5	Cloture filing deadline	Last day to file ordinary cloture for a Friday procedural vote on CLARITY.
Fri Aug 7	July NFP, 8:30am ET	Consensus around 87,500 vs June's 57,000. Below 100K prices in a September cut. Above 150K pushes yields up.
Fri Aug 7	CLARITY recess cutoff	Practical last chance for a 2026 Senate vote before the break.
Mon Aug 10	Senate recess begins	State work period starts. Legislative window for crypto closes until fall.
Wed Aug 12	July CPI	First inflation read after the July hold. Feeds directly into September rate positioning.
This week	Palantir, AMD earnings	Read as AI-demand signals. Palantir consensus is $1.81B revenue, up 81% YoY.

Beyond this week, Warsh speaks at Jackson Hole on August 27 to 29, and the next FOMC lands September 15 to 16. Both sit outside the immediate window but frame the back half of the quarter.

For last week's setup and what we were watching heading in: Weekly Brief: The Week the Market Celebrated Too Early

---

Sources

CaptainAltcoin Bitcoin Spot ETFs End Inflow Streak, Week of July 27-31

US Bureau of Labor Statistics Employment Situation Release Schedule, July 2026

CryptoNews CLARITY Act Senate Delay Drops 2026 Odds to 35%

CryptoSlate CLARITY Act Vanishes From Monday's Senate Schedule

CryptoRank Bitcoin, Ethereum and XRP Price Prediction for August 2026

CNBC Stock Market Next Week: Outlook for Aug. 3-7, 2026

BeInCrypto Bitcoin Price Prediction for August 2026: Whales Bet Against a 4-Year Losing Streak

Tools We Use

Kraken — Spot and futures on BTC, ETH, and 200+ assets.

Trezor — Cold storage. No internet connection required.

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

The CLARITY Act Is Not Stalling Over Crypto

By BitBrainers Editorial

The Senate leaves for its August recess in under a week and the most consequential crypto bill in US history still has no floor vote scheduled. It is not stalling over how to regulate digital assets. Every serious version of that fight was settled months ago. It is stalling over whether the sitting President should be allowed to keep earning from the industry the bill would legitimise.

---

Where It Actually Stands

The Digital Asset Market Clarity Act passed the House on 17 July 2025 by 294 to 134. The Senate Banking Committee advanced its portion on 14 May 2026 by 15 to 9. Since then: no floor vote, no cloture filed, no scheduled date.

The bill has been sitting on the Senate Legislative Calendar since 1 June, at number 423. Eligible for floor action for two months, never scheduled.

Industry and congressional negotiators marked 7 August as the practical deadline. Majority Leader John Thune told reporters he did not think they would get it done, adding that he would like to at least get CLARITY started.

The arithmetic is the whole problem. Republicans hold 53 seats. Cloture needs 60. That means at least seven Democrats, and under Senate Rule XXII the bill needs two separate cloture sequences, each of which typically eats most of a legislative week. Floor time that might have covered it went to a Russia sanctions package and a backlog of nominations.

---

What Is Actually in It

The merged text released on 22 July runs to roughly 616 pages. The core of it is a jurisdiction split. Spot markets in digital commodities go to the CFTC, investment contracts and ancillary assets stay with the SEC, and payment stablecoins fall under banking-style rules built on the already-enacted GENIUS Act. Exchanges, brokers and dealers would register with the CFTC.

Around that sit the provisions people actually argue about. A fundraising exemption lets projects raise up to $50 million a year and $200 million lifetime without full SEC registration. Intermediaries become financial institutions under the Bank Secrecy Act. Non-custodial developers get explicit protection from registration purely for writing code. Interest-like yields on idle stablecoin balances get banned while rewards tied to actual transaction activity survive. Most of it takes effect 360 days after enactment.

Worth noting what it is not. It does not touch tax treatment. Crypto remains property in the eyes of the IRS either way.

---

The Fight Is Not About Crypto

President Trump's 2025 financial disclosure showed roughly $1.4 billion in crypto-related income. About $636 million came from the $TRUMP meme coin and nearly $800 million from World Liberty Financial, the DeFi platform his family co-founded. A separate July disclosure tied more than $1 billion in income to his crypto ventures over the past year.

Democrats' position is structural rather than symbolic: they argue you cannot build a federal framework for an industry that produced the sitting President's single largest income stream without enforceable rules on his continued participation in it.

The White House agreed to ethics language that bars the President, Vice President, certain members of Congress, covered officials and their spouses from issuing or sponsoring a digital asset for consideration while in office, with a divestiture or blind trust requirement kicking in a year after enactment. Officials could still own crypto and would have to disclose sales.

Two details explain why that has not closed the deal. The ban sunsets on 20 January 2029, which is the end of the current presidential term, something we covered when the clause first appeared. And enforcement sits solely with the Attorney General, not state attorneys general and not private parties. So the restriction on the President expires when he leaves office and is enforceable in the meantime only by his own appointee.

Seven crypto-friendly Democrats rejected it. Angela Alsobrooks, Cory Booker, Catherine Cortez Masto, Ruben Gallego, John Hickenlooper, Mark Warner and Raphael Warnock said in a joint statement that the Republican text falls short, citing ethics alongside consumer protection, illicit finance, market integrity and DeFi regulation. Elizabeth Warren put it more directly, saying that whatever it is called, a provision that does not stop the President profiting from crypto is not an ethics provision.

Gallego, one of only two Democrats who backed the bill in committee, described the returned draft to Politico in language we will not reprint and said it was not a serious effort. He is now working on a counteroffer with Republican Thom Tillis.

Deadlines like this move fast.

We track what actually happens on the calendar, not what gets promised on it.

Subscribe

The Vote Might Happen Anyway, and Not to Pass

On 30 July, Treasury Secretary Scott Bessent publicly demanded an immediate floor vote, calling the bill floor-ready and accusing Senate Democrats of choosing politics over American leadership. Lummis amplified it, pointing to more than a hundred compromises already made and to the Fraternal Order of Police reversing its earlier opposition after the DeFi provisions were revised.

Thune has signalled he may bring the bill to the floor without the votes secured. That reads more as an election-year manoeuvre than a legislative one. Forcing senators to take a public position on crypto regulation months before November has value to Republicans whether or not the bill clears.

The risk is that it burns the negotiation. Cynthia Lummis, one of the Republican negotiators, posted that after nearly eleven months of giving almost everything asked of them, she does not know what else her Democratic colleagues need. Reporting on the talks suggests a forced vote on a text Democrats have already rejected could cause a rift that does not heal.

---

What the Market Thinks

Prediction markets have been brutal about this all year. Polymarket odds on CLARITY becoming law in 2026 peaked above 80 percent in February, hit a record low near 24 percent in mid-July, briefly recovered to around 45 percent when the updated text was expected, and have settled in the low-to-mid 30s as the ethics deadlock hardened. Galaxy Research cut its own estimate to 50 percent.

Worth noting what did not move those numbers. A direct public appeal from the President in mid-July produced no upward move at all, which tells you traders read the binding constraint as Democratic votes rather than presidential enthusiasm.

---

What Happens If It Slips

Failure before recess does not kill the bill. It pushes it into a September calendar with less momentum and then into an election year, where controversial votes get harder. Estimates of the delay range from 2027 to considerably longer. Lummis has warned that failure this year could push comprehensive federal rules out to 2030, after a Congress nobody has met yet is seated.

In the meantime the rules come from agencies rather than statute. The SEC and CFTC issued joint interpretive guidance on 17 March 2026 classifying sixteen digital assets under a five-category taxonomy, and the SEC has said it is prepared to write crypto rules if Congress does not. That is the part the industry actually fears, because interpretive guidance is not law. Any future administration can rescind it, and the whole framework reverts to enforcement discretion overnight.

Which is the real stake here, and it has little to do with this month. A statute is durable. Guidance lasts exactly as long as the people who issued it.

---

What to Watch This Week

One thing decides it: whether Thune files cloture on a motion to proceed before the chamber leaves. A filing typically sets up a vote two session days later, and without one there is no summer vote at all.

After that, watch whether the Gallego and Tillis counteroffer produces text the White House will accept, and whether any of the seven Democrats move publicly. If the window closes, the thing to track through autumn is whether leadership tries to attach CLARITY to must-pass year-end legislation. Lobbyists have floated that route in trade press. No senator has confirmed it.

---

Sen. Lummis (primary source) — Merged CLARITY Act text, released 22 July 2026

CoinDesk — Senators Ready to Send Stricter Ethics Rules on Trump's Crypto Ventures to White House

The Hill — Crypto Bill Faces Democratic Backlash Over New Ethics Rules

CoinDesk — US Senate Puts Off Crypto Clarity Act as It Focuses Limited Bandwidth Elsewhere

Bitcoin Magazine — Senate Democrats Reject Clarity Act Ethics Rewrite

Crypto News — CLARITY Act Senate Delay Drops 2026 Odds

Tools We Use

Kraken — Spot and futures on BTC, ETH, and 200+ assets.

Trezor — Cold storage. No internet connection required.

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

Nobody Has a Safe Place to Put It: What Coldcard Actually Proved

By BitBrainers Editorial

Coinkite shipped the code that lost other people's money, and nothing in what follows takes that off them. But the same category of failure has already hit the other side of the argument, the exchanges, and it hit harder. Blaming one company is correct and it is not sufficient. There is no side of this that is actually safe. Only different ways to lose.

---

The Number That Should Have Been the Headline

In the first half of 2026 the crypto sector recorded a record number of hacks, 207 by TRM Labs' count, most of them smart contract exploits. But the money did not follow the count. Infrastructure and key-management failures were about 15 percent of incidents and roughly 76 percent of the money stolen.

Coldcard sits in the second group, and so does every exchange breach in that same data. The exposure begins at the exact place the industry keeps losing the most money, which is how a key gets made and who holds it. That is not an obscure corner of the product. For a device whose entire purpose is generating and protecting a key, it is the product. For a custodian, it is the whole job.

We do not sell a safe answer here.

We read the failures honestly and tell you what they actually mean. That is the whole newsletter.

Subscribe

Why This Keeps Happening to Regular People

The people who lost coins on Coldcard were not careless. Many followed the exact advice the most respected names in Bitcoin were giving. The device sat on recommended-wallet lists for years. Trusting the consensus pick is not negligence.

---

This Was Coinkite's Failure, Start to Finish

The firmware was theirs. The change that routed seed generation away from the hardware random number generator, the device's only source of real entropy, and into a predictable software fallback went out in March 2021 under their name, in a product sold on the single promise that it would generate a key no one could guess. CEO Rodolfo Novak has said the company takes full accountability and that its review process failed to catch it. That much is not in dispute.

The context deserves more attention than it is getting. Coldcard was GPL-licensed until a competitor, Foundation, built a device on that code. Novak said publicly that he regretted the license. Coinkite moved to MIT plus Commons Clause, blocking competing derivatives, and stripped out the crypto libraries inherited from Trezor. Foundation has published a timeline showing the entropy bug entered in the same 120-file commit that removed those GPL dependencies. Foundation is a competitor with an obvious interest in that framing, but the commits are public and the dates line up.

The licensing choice has a second cost that nobody priced at the time. Source-available is not open source. Under the Commons Clause, other developers could read the code but could not legally build on it, which quietly thins out the population of people with any reason to read it closely. Five years is a long time for a seed generation routine to go unexamined in a Bitcoin product, and the license is part of why.

Then there is the response. Coinkite's first advisory on July 30 told Mk4, Q and Mk5 owners they were not affected. That was wrong, and the advisory had to be expanded the next day. In the interval, an attack was actively running and people with newer devices were reading an official statement telling them to stand down. One prominent developer publicly told Novak he had spread misinformation and said someone he knew personally had been robbed from a Mk4 seed within hours of that advisory. Samson Mow ended up telling people to migrate off every Coldcard model regardless of version, because the vendor's own guidance could no longer be relied on.

One more detail worth noting, because the week's commentary got it backwards. Coinkite's minimal data retention was treated as the reason it could not warn its own customers. In fact the company has now said it emailed every address it could reach through its store and newsletter systems, and its own store notice explains that Canadian law requires eight years of business records, so names and addresses were blanked while the email field was kept. Reaching customers during an active theft is the right call. It also means the privacy posture that was part of the pitch was never quite what buyers understood it to be.

Novak's other public framing was that the bug was likely found using AI, calling it a sober reality of the new paradigm. Read plainly, that is a company whose code lost roughly $88 million pointing at the tool that found the flaw rather than at the five years in which it did not find it itself. We covered that response in detail in our breakdown of Coinkite's statement.

The deeper issue is that the security model was never built for a normal person. Entropy bits, firmware version tracking, BIP-39 passphrases, multisig quorums, dice rolls to seed your own randomness. That is a specialist's checklist wearing consumer packaging, and most people bought the packaging.

---

It Is Not Over, and That Is the Point

The first wave was a clean $70 million sweep in 41 minutes. By August 2, Galaxy Research was tracking three waves totalling 1,367 BTC, roughly $88.6 million, across 4,585 addresses. The number has moved every day since the story broke, and it will likely move again after this is published.

Watch the direction of travel. The first wave went after the largest balances, pulling $30 million in ten minutes. The third is emptying wallets worth a few thousand dollars each. That progression only makes sense if the operator holds a long list of compromised seeds and is working down it by value, monetising the tail after the whales are gone.

The third wave also broke the fingerprint. The first two shared a hardcoded fee and identical batching, which is how researchers linked them. The third uses more complex, harder-to-trace patterns, and Galaxy says it cannot confirm the same operator is behind all three. Either the attacker is adapting, or others have worked out the same flaw independently. Neither is reassuring.

The reason this keeps going is structural. Coinkite's emergency firmware cannot repair a seed that was already generated. Every vulnerable seed still holding funds stays vulnerable until its owner moves the coins, and Galaxy has warned that future sweeps need not resemble the ones already mapped. This is not an incident that concluded. It is an exposure that stays open until every affected person acts, and most of them do not know they are affected.

---

So What Does a Normal Person Actually Do

Watch what has happened on the timelines since. Within two days, people who had just seen a consensus recommendation fail were issuing new consensus recommendations. Name a replacement device, argue that the answer is firms large enough to employ cryptographers, move on. Almost none of it comes with more verification than the advice that put Coldcard on every recommended-wallet list to begin with.

That is the mechanism, and it is running again right now. The problem was never that people picked the wrong brand. It was that a brand recommendation was ever load-bearing for something this consequential.

So the honest answer is that there is no zero-risk option, and anyone selling you one is selling something. What exists is a set of trade-offs you get to choose between with open eyes.

Self-custody removes the counterparty who can freeze or lose your funds, and hands you the entire job of key security, firmware, and backups. An exchange removes the technical burden, and reintroduces the counterparty, the honeypot, and the interface you cannot see behind. Both are real risks. Neither is theoretical.

The most defensible posture is not picking a winner. It is refusing to concentrate. Do not put everything on one device, one vendor's firmware, one exchange, or one signing method. Spreading holdings across independent failure modes will not stop a loss. It stops a single loss from being total.

For anyone rebuilding after this, the concrete version is keys split across manufacturers, a Trezor hardware wallet beside a different vendor in a multisig quorum. Not because that vendor is trustworthy. Because no single vendor has to be.

---

Why This Does Not End With Everyone in Custodians

Follow the argument to its usual conclusion and you get: most people cannot do this safely, so most people should hand their coins to someone who can. A lot of this week's commentary lands exactly there, and the ETF and treasury-company flows suggest the market already agrees.

The objection is concentration. Enough Bitcoin in a few custodians rebuilds the seizure risk the thing was built to route around. What stops that from being terminal is a property gold never had. You can leave. Any holder can open a wallet, demand settlement, and have final possession in minutes, globally, for a few dollars. Most gold was never in its owner's hands, and you could not demand it be moved from London to Singapore this afternoon.

So custody concentrates only as long as the custodians stay worth using. The exit is what keeps them honest, and the exit only exists because self-custody remains possible for anyone who wants it. That is the case for keeping these skills alive even in a week that made them look dangerous.

---

The Part Nobody Wants Printed

Here is the sentence the industry avoids. In its current form, self-custody asks for a level of technical fluency that most people holding Bitcoin do not have and should not be expected to acquire overnight.

Read the failures, spread the risk, and distrust anyone who tells you one product ends the problem. That is not a satisfying conclusion. It is the accurate one, and the accurate one is the only kind worth publishing.

---

TRM Labs — H1 2026 Crypto Hacks Reach Record High as Losses Fall Below $1 Billion

Crypto Briefing — Crypto Records Most Hacked Half-Year Ever With 212 Exploits and $1.1 Billion Stolen

CoinDesk — How Bitcoin Cold Wallets Lost $70 Million in an Attack That Never Touched the Devices

CoinDesk — Bitcoin Cold-Wallet Attack Spreads to 4,500 Addresses as Losses Near $89 Million

The Block — Coinkite Issues Warning for Coldcard Mk3 Users Amid 594 BTC Theft Reports

Forbes — Urgent Warning Issued After Sudden Spread Of Massive Bitcoin Attack

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.

Your Hardware Wallet Might Already Be Broken

By BitBrainers Editorial

It is tempting to read the Coldcard drain as a single company's mistake. That reading is too comfortable. In the space of about two months, three separate cryptographic flaws surfaced in crypto code that had all passed review, all of them years old, all found in a narrow window. Coldcard is the loudest one. It is not the only one, and the pattern is the actual story.

---

Three Failures, Three Layers

Start with the timeline, because the clustering is the point. In late May, security firm Coinspect disclosed a flaw it named Ill Bloom: a broken random number generator in certain mobile software wallets that made recovery phrases guessable. Affected wallets dated back to 2018. At least $5 million was drained, most of it Bitcoin.

Around the same window, Zcash disclosed a flaw of a different kind entirely. Not in a wallet, but inside the mathematical circuit that proves its private transactions are valid. A gap in the proving code that could, in theory, have allowed counterfeit ZEC. Zcash ran an emergency hard fork on July 28 to wall off the affected pool.

Then Coldcard, at the end of July. The same failure family as Ill Bloom, weak seed generation, but in the hardware wallets people had been told to trust precisely because software wallets kept failing. Roughly $70 million gone in 41 minutes.

---

The Detail That Ties Them Together

Here is the part worth sitting with. When Coinspect disclosed Ill Bloom, it said hardware wallet users appeared to be safe. That was true, for that flaw. It was also the advice that pushed exposed users toward hardware devices.

Weeks later, the hardware devices had their own entropy failure. The safe harbor from one bug was the epicenter of the next. Nobody was lying. The ground simply kept moving.

These were not the same bug or the same team. What they share is a category: old cryptographic code, sitting in production for years, doing something subtly wrong that nobody caught until someone went looking with the right tools.

Patterns matter more than incidents.

We connect the failures nobody else is connecting. Get the next one before it is obvious.

Subscribe

Why Old Code Is Suddenly Dangerous

For years, the industry treated survival as proof of safety. If a wallet or a library ran for five or ten years without incident, it was assumed sound. That assumption was always weaker than it looked.

A vulnerability that was never worth the enormous manual effort to find can become worth finding the moment that effort drops. Reading an unfamiliar codebase line by line, tracing dependencies, spotting one inverted check among thousands, used to take specialist time most attackers would not spend.

Coinkite said it plainly about its own bug: the code had been public since 2021, and the company has to assume someone used AI to review old versions of the firmware and found what human auditors, including a leading AI model Coinkite itself ran weeks earlier, had missed. We covered that admission in detail in our breakdown of Coinkite's response.

The uncomfortable implication is not about one vendor. It is that the cost of finding dormant bugs has fallen for everyone, defenders and attackers alike, and the attackers only need one.

---

What Is Actually Exposed

Bitcoin Core itself is not the worry here. It is probably the most reviewed open-source code in existence, with hundreds of people picking apart every proposed change. The danger lives in the sprawl around it.

Wallets, firmware, signing libraries, bridges, exchange infrastructure, swap tools. An enormous surface of code, most of it reviewed far less thoroughly than Core, much of it depending on the same handful of underlying libraries. Ill Bloom, Coldcard, and the Zcash circuit flaw all lived in that surrounding layer, not in a base protocol.

That is where the next one will come from too. Not a break in Bitcoin's core math, but a forgotten piece of the ecosystem that held enough money to make the search worthwhile.

---

What This Changes for You

The takeaway is not to panic or to abandon self-custody. It is to stop treating any single product's track record as a guarantee. Five clean years means the bug was expensive to find, not that it was never there.

The practical response is the same discipline that survives every one of these events: do not concentrate. Spreading holdings across independent devices, vendors, and methods will not prevent a flaw. It stops any one flaw from taking everything.

None of these three incidents touched a properly diversified setup for its full value. That is not luck. It is the one defense that works when the thing you trusted turns out to have been broken since the day you bought it.

---

The Hacker News — Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets

TechTimes — Zcash Ironwood Launches Tuesday: Supply-Verification Checkpoint Closes Four-Year Flaw

CoinDesk — How Bitcoin Cold Wallets Lost $70 Million in an Attack That Never Touched the Devices

This is market commentary, not financial advice. Nothing here is a recommendation to buy or sell any asset. Do your own research.