Coldcard Bitcoin Exploit Balloons to $88 Million in Losses

Galaxy Research identified a third wave of thefts from compromised Coldcard hardware wallets, lifting observed losses to roughly 1,367 BTC worth about $88.6 million across 4,585 addresses. The firm called the exploit ongoing and flagged some 600 suspected attacker addresses to federal investigators.

The flaw traces to a March 2021 firmware build error that told devices to skip their hardware randomness generator, falling back to software seeded by chip serial numbers and clock registers. None of those values are secret, leaving private keys guessable.

An initial sweep drained 594 BTC from around 500 single-signature wallets inside a 25-minute window. Galaxy's Alex Thorn described the operation as deliberate and likely orchestrated with a large language model, warning that every affected address will empty eventually.

Stolen coins had sat dormant an average of 3.18 years, marking victims as long-term holders. The fallout has driven an unusual reversal of self-custody orthodoxy, with affected users racing to move bitcoin back onto exchanges or freshly generated wallets.

Russian Law Bans Crypto Mining Across Moscow Through 2032

The Russian government issued a decree banning crypto mining and mining pool participation across Moscow, the surrounding oblast, and parts of Kursk from August 15 until the end of 2032. The measure finalizes an Energy Ministry proposal published in late June.

Regional officials estimated mining consumes roughly 1 gigawatt across the capital's grid, warning of shortages without a year-round prohibition. The decree expands a regional approach Russia began in late 2024, even as lawmakers advance a national framework for regulated retail trading.

Trump Media Moves $165 Million in Bitcoin to CryptoCom

Wallets associated with Trump Media transferred 2,628 bitcoin worth about $165 million to CryptoCom across two transactions. A company spokesperson said the coins were moved but not sold, matching its explanation for a similar transfer back in May.

The move left roughly 4,261 BTC worth $268 million in tracked wallets, nearly matching the collateral pledged against its convertible notes. CryptoCom serves as one of two custodians chosen when the firm established its treasury strategy in May 2025.

Minnesota's Crypto ATM Ban Takes Effect After Scam Losses

Minnesota's ban on cryptocurrency ATMs took effect after residents reported losing nearly $1 million to scams involving the machines since 2023. Governor Tim Walz signed the legislation in May, and every existing kiosk must be removed by December 31.

State officials said criminals disproportionately targeted seniors, often impersonating law enforcement and pressuring victims into sending money for a relative's supposed release. Last year alone brought 70 cases and more than $540,000 in losses, averaging nearly $6,800 per transaction.

Data of the Day

Ethereum's validator entry queue has swelled to roughly 2.5 million ETH, leaving new stakers waiting about 43 days to activate while the exit queue sits largely empty. Sygnum's Thomas Brunner cautioned the backlog is not the clean bullish signal it appears.

Much of it is mechanical, stemming from the Pectra upgrade letting validators hold up to 2,048 ETH and compound automatically, so operators topping up existing positions queue alongside fresh entrants. About 41.2 million ETH, or 33.8% of supply, is currently staked.

More Breaking News

• New York sued Kalshi over illegal gambling claims, seeking at least $36 billion in damages and a court order blocking the prediction market from operating in the state.
• Strategy held its STRC dividend at 12% despite the preferred stock trading near $89, breaking from Michael Saylor's custom of raising payouts whenever shares sit well below par.
• An Iran-linked Dubai exchange sent $676 million to wallets on Binance, part of a $4 billion sanctions-evasion network tied to Iranian gambling sites and the IRGC, per Reuters.
• Bank of Italy research found stablecoin remittances are not systematically cheaper, with costs spanning 0.3% to nearly 9% as fiat on-ramps and off-ramps swallow most of the expense.
• BNB Chain is pursuing legal action against a former employee who allegedly used a tutorial wallet seed phrase to launch a memecoin and pocket about $628,000.
• PumpFun reportedly laid off workers two months before they were due to receive PUMP tokens worth millions, with a co-founder attributing the cuts to growing too quickly.
• Circle secured a limited-purpose trust charter from NYDFS, adding a state layer to federal oversight weeks after winning final OCC approval for its national trust bank.
• The FCC banned foreign-made advanced robots and connected power inverters from new approvals, a definition broad enough to cover robot vacuums, lawnmowers, and delivery machines.