The Week in One Sentence
A five-year-old firmware flaw let attackers drain $88 million from Coldcard wallets, the CLARITY Act entered its final week before recess without the votes, and the Fed held while September turned hawkish.
1. The Coldcard Flaw, and What It Actually Says About Self-Custody
At 1:10 on Thursday morning, someone began emptying Bitcoin wallets. Over the next 41 minutes they swept 1,082 Bitcoin, roughly $70 million, out of 1,195 addresses. Two more waves followed over the next two days. Galaxy Research now counts 1,367 Bitcoin gone, about $88.6 million, across 4,585 addresses. The coins sit unspent in seven attacker addresses, which researchers read as someone waiting for attention to fade or lacking a safe way to move a sum that visible.
Nobody was phished. No device was stolen. No seed phrase was typed into a website. The attacker never touched a single one of those wallets.
The flaw was in how the wallets were born. Coldcard, the Bitcoin-only hardware wallet built by the Canadian firm Coinkite, has a good reputation among people who take custody seriously. In March 2021, a firmware change quietly broke the part of the device that generates randomness. The device was supposed to draw entropy from a dedicated hardware random number generator on its chip. Because of a build configuration error, where a software library checked whether a setting existed rather than whether it was switched on, seed generation fell back to a predictable software algorithm seeded from things like the device's serial number and its internal clock.
That is the whole disaster, and it is worth sitting with. A 12-word seed phrase is supposed to be one of roughly 340 undecillion possibilities. If the randomness behind it is predictable, the search space collapses to something a determined attacker can simply enumerate on their own hardware, offline, and check against the public blockchain. The keys were never secret. They were just waiting for someone to do the arithmetic.
Engineers at Block, Jack Dorsey's company, identified the pattern and made it public. Coinkite's advisory came about 30 hours after the sweeps began, initially covering Mk3 devices on firmware 4.0.1 and later, then expanding to certain Mk4, Mk5, and Q versions, where seeds carried about 72 bits of entropy instead of the intended 128. The company shipped emergency firmware for every affected model. Here is the cruel part: updating does not fix an existing seed. If your seed was generated on vulnerable firmware, it stays weak forever. You have to generate a new one and move the coins. Coinkite's other products, TAPSIGNER, OPENDIME, and SATSCARD, use different code and are not affected.
Two details matter for anyone drawing lessons. Every victim in the first waves held single-signature wallets. No multisig setups appeared among them, because compromising a multisig would require breaking keys from separate devices. And this was not a failure of Bitcoin. The protocol did exactly what it is designed to do: it honored valid signatures from whoever held the keys. What failed was one vendor's implementation of randomness, five years ago, in a build config.
There is a comparison worth making here. In issue #017 we covered a bug in Zcash's shielded pool that could have allowed undetectable counterfeiting. The coin fell 30% not because anyone proved an exploit, but because the privacy design meant nobody could prove there had not been one. Bitcoin's transparent ledger produced the opposite outcome this week. Within hours, independent researchers mapped every affected address, published the transaction fingerprints, quantified the loss precisely, and warned everyone still exposed. The transparency that costs Bitcoin its privacy is the same property that let the network see exactly what happened and respond in public.
None of which makes this less painful for the people who lost money. Some observers, including analysts quoted by CoinDesk, expect the episode to push nervous holders toward ETFs and regulated custodians. That is a real reaction, and it deserves an honest answer rather than a slogan. Self-custody removes counterparty risk and replaces it with operational risk. This week the operational risk arrived through a vendor most people had every reason to trust. The response that actually addresses it is not surrendering your keys to a custodian. It is refusing to let any single manufacturer be the only thing standing between you and your coins, which in practice means multisig across devices from different vendors, adding your own entropy to seed generation, and verifying with tools you did not buy from the same company.
If you hold a Coldcard, check your model and firmware version against Coinkite's advisory today. Galaxy has warned that future attacks do not need to follow the pattern already observed.
2. CLARITY Has Five Days
The CLARITY Act is not dead, and it is not going to pass. Both of those things are true this morning, and the gap between them is where the entire story sits.
The Senate returns Monday afternoon and stays in session through roughly Friday, then leaves and does not come back until September 14. That is the last pre-recess window, and it is five days long. Majority Leader John Thune, who had pledged a floor vote before the break, stepped away from that pledge on July 23. "I don't think we'll be able to get them done," he told reporters, though he added that he would "like to at least get Clarity started" and would see where the votes are. Getting a bill started is not passing one.
The arithmetic explains the retreat. Cloture requires 60 votes. Republicans hold 53 seats, at least two are expected to vote no, so leadership needs roughly seven Democrats. On July 24, seven Democrats did speak up, but to say the opposite of what was needed. Senators Angela Alsobrooks, Catherine Cortez Masto, Cory Booker, Ruben Gallego, John Hickenlooper, Mark Warner, and Raphael Warnock said the revised text falls short, citing consumer protection, illicit finance, and market integrity. That group includes both Democrats who voted the bill out of committee in May. The sticking point remains the ethics provisions restricting senior officials from holding crypto business interests, language written in response to President Trump's disclosed crypto income, which Democrats consider too weak and which places enforcement with a Justice Department that answers to the same president.
The procedural clock is worse than the vote count. No cloture motion has ever been filed on the bill. Under Senate rules, cloture sequences can each consume most of a legislative week, and this week's floor time is already committed to other business, including a government funding vehicle. Even a sudden outbreak of agreement would struggle to fit.
Prediction markets have moved accordingly. Polymarket odds on 2026 passage sit near 30%, down from a February peak above 80%. Galaxy Research cut its own estimate to 30% from 75% in May. More than 200 industry groups have asked the Senate to vote anyway. White House crypto adviser Patrick Witt said he was perplexed by Thune's pessimism and pointed at this exact week, saying he would not count it out.
What is actually at stake is narrower than the headlines suggest. The joint SEC and CFTC guidance issued in March still classifies the major digital assets and remains in force, so nothing breaks on Friday. Spot trading continues, the ETFs continue, and Bitcoin's status as a commodity was settled in practice long before this bill existed. The difference between guidance and law is durability. Guidance can be rewritten by the next administration in an afternoon. A statute cannot. Institutions sizing multi-year allocations price that difference heavily, which is why the industry has spent a year pushing for it.
If this week passes without action, the runway narrows to a few weeks in September before midterm campaigning consumes the calendar, then a lame duck session after November where retiring members vote on legislation they will not have to defend. Senator Cynthia Lummis has warned that failure this year could push comprehensive rules toward 2030. Watch Monday.
3. The Fed Held, and September Turned Hawkish
The Federal Reserve left rates at 3.50% to 3.75% on Wednesday, which was expected and which was not the news. The news was what the meeting did to September. Futures markets now put the odds of a rate hike at the next meeting near 72%. Not a cut. A hike. Three regional Fed presidents had already argued for raising rates in July.
The bond market moved with it. The 10-year Treasury yield climbed to a three-month high, and the 30-year reached levels not seen in about two decades. That combination is the least friendly backdrop Bitcoin has faced this year. Every increase in the safe yield available on government debt raises the cost of holding an asset that pays no yield at all, and Bitcoin is the most volatile version of that trade.
Bitcoin absorbed it without breaking. The price traded near $63,000 into the weekend, down roughly 3% on the week, holding well above the $57,750 low from July 1 and comfortably inside the $60,000 to $62,000 band that has held through repeated tests since June. The institutional bid, which returned for seven sessions in mid-July, turned around again. Spot Bitcoin ETFs shed about $526 million over four sessions, took in $233 million on July 30, then gave back $265 million on July 31.
The reason to hold this loosely is that the Fed is now visibly caught. Inflation cooled to 3.5% in June, which argues for patience. The labor market added only 57,000 jobs that month, which argues against tightening into weakness. Oil has climbed again on renewed Middle East conflict, which argues the other way. A central bank with no forward guidance, a chair who declines to publish his own rate projection, and three genuinely conflicting data series is not a body anyone should claim to predict. What can be said plainly is that the market spent the first half of 2026 waiting for rate cuts, and it now expects the opposite. August has averaged a 10% decline for Bitcoin over the past four years, and this one begins with the tightest macro setup of the year.
The Numbers
| Metric | Value |
|---|---|
| BTC Price | ~$63,000 (Sat Aug 1) |
| On the Week | down ~3% |
| From All-Time High | ~50% (peak $126,198) |
| Coldcard Losses | 1,367 BTC (~$88.6M) across 4,585 addresses |
| Fed Funds Rate | held at 3.50%–3.75% |
| September Hike Odds | ~72% (futures) |
| Treasury Yields | 10-year at a 3-month high; 30-year near 20-year highs |
| Spot ETF Flows | ~$526M out over four sessions; $265M out Jul 31 |
| CLARITY 2026 Odds | ~30% (Polymarket), down from a February peak above 80% |
What to Watch Next Week
The Senate floor, Monday through Friday. Whether Thune files cloture on CLARITY at all is the tell. No motion means no vote, and the bill waits until September 14.
More Coldcard sweeps. Galaxy has warned that further attacks need not match the observed pattern. Watch whether the attacker moves the 1,367 Bitcoin sitting unspent, which would be the first chance to trace it.
Whether other wallets are affected. Randomness bugs are rarely unique to one vendor. Expect scrutiny of other hardware manufacturers, and watch Bitcoin Optech and independent researchers rather than social media speculation.
Fed speakers. With no forward guidance and September priced for a hike, individual policymaker remarks carry more weight than usual.
Free Tools
Track price, sentiment, ETF flows, and network health in one place with Bitcoin Pulse, our free live dashboard. No account required.
Weeks like this are the argument for a fixed schedule over reacting to headlines. See what steady buying through the drawdown would have done with the DCA Calculator.
New here? Start with Intro to Bitcoin or browse the Bitcoin Glossary.
New to Bitcoin? → Intro to Bitcoin
Explore every term → Bitcoin Glossary
Correction: Last week's issue said Senate Majority Leader John Thune had promised a CLARITY Act floor vote before the August recess. He had walked that commitment back on July 23, two days before we published. We regret the error.
Bitcoin Weekly is published every week by 21VOX. Written by Karl. No financial advice. Just signal.