A **critical vulnerability** in a March 2021 Coldcard firmware release has enabled attackers to systematically drain bitcoin from thousands of wallets. The attack, first flagged by Galaxy Research, has now expanded to **4,585 addresses**, with total losses approaching **$89 million**.

## Third Wave Targets Smaller Balances

Galaxy Research identified a **third wave of sweeps** early Sunday, with roughly **208 bitcoin** drained from **1,912 addresses** between Friday midday and Saturday morning UTC. This wave averages just over **0.1 bitcoin per victim**, a significant drop from the initial wave on July 30, which saw an average of nearly **1 bitcoin per address**.

The first wave alone netted **1,083 bitcoin** from **1,196 addresses** in just 41 minutes. Across all three waves, attackers have now siphoned **1,367 bitcoin**, worth nearly **$89 million** at current prices.

## Evolving Attack Tactics

The latest wave shows **more sophisticated techniques**:
- **Unique destinations**: Each victim's coins are sent to separate addresses, unlike previous waves that used shared collector addresses.
- **Complex outputs**: Funds are parked in **pay-to-witness-script-hash (P2WSH)** outputs, which can carry multisignature or timelock conditions, making them harder to trace.
- **Batching**: An average of six victims are swept per transaction, compared to one at a time in the first wave.
- **Narrower scanning**: The attacker only checks the default derivation path, rather than multiple branches per seed.

## Root Cause: Weak Randomness

The vulnerability stems from a **March 2021 firmware update** that routed seed generation to a **predictable software randomizer** instead of the chip's hardware random number generator. This left a **bounded set of possible keys** that can be reproduced offline by anyone with the disclosure and sufficient computing power.

## Ongoing Threat

Despite the attack being publicly flagged, the sweeps have continued for nearly three days. The **declining average haul** suggests that the most profitable keys have already been drained, but the attacker persists in targeting smaller balances.

Galaxy Research believes each wave is the work of a **single operator**, but cannot confirm whether the same actor is behind all three waves. The blockchain does not reveal whether separate sweeps are coordinated.

**Key takeaway**: This incident underscores the **critical importance of using hardware wallets with verified randomness** and keeping firmware up to date. Users who generated keys with affected Coldcard firmware should **immediately move their funds** to newly generated addresses.

Galaxy Research flagged a third wave of sweeps tied to weak Coldcard-generated keys, with the attacker now targeting smaller balances and changing how funds are collected onchain.

Bitcoin Cold-Wallet Attack Escalates: 4,500+ Addresses Drained, Losses Near $89M

The Senate returns on Monday, August 3, with just **five working days** before its recess until September 14. The **CLARITY Act**, which would solidify XRP's commodity status into federal law, still has no scheduled floor vote. This bill is crucial for institutional investment in XRP, yet its fate hangs in the balance.

## Can the CLARITY Act Pass Before the August 7 Recess?

![Legal services and expert consultation cover business, finance, and intellectual property matters](https://247wallst.com/wp-content/uploads/2026/05/shutterstock-2629129701-huge-licensed-scaled.jpg)

The CLARITY Act passed the House 294-134 in July 2025 and cleared the Senate Banking Committee 15-9 on May 14. It has been on the Senate's list of bills ready for a floor vote since June 1, but **Majority Leader John Thune** has not given it time. With Republicans holding 53 seats, the bill needs 60 votes, so Democratic support is essential. Only two Democrats are publicly behind it, and Senator Cynthia Lummis notes that even Republican support isn't unanimous, with Josh Hawley being "really resistant."

Two main issues block Democratic support: **banks want changes to stablecoin rules** (arguing that paying interest on stablecoins would pull deposits from banks), and **Democrats seek a stronger ethics provision** to bar Trump and other senior officials from crypto projects. The latest ethics provision went to the White House on July 30, and the response could determine if the Senate acts this week.

Thune has prioritized nominations and a Russia sanctions bill over the CLARITY Act. He stated on July 23 that he doesn't expect a vote before the break, though he wants to start the process. The most progress possible by Friday is filing a **cloture motion**, which would place the bill first in line when the Senate returns.

## What a CLARITY Act Vote Would Mean for the XRP Price

![Judge hammer and XRP crypto coin](https://247wallst.com/wp-content/uploads/2026/04/shutterstock-1976930807-huge-licensed-scaled.jpg)

Historical reactions show that **XRP's price spikes on progress but fades quickly** because nothing changes legally. On May 14, when the committee advanced the bill, XRP jumped 6.6% to $1.54, but fell back to $1.33 by late May. Similarly, in mid-July, when Trump agreed to the ethics provision, XRP rose 3.5% intraday to $1.1511, but again gave back gains.

These moves are temporary because **the bill's actual passage is what would change XRP's legal status**. The SEC and CFTC already classified XRP as a digital commodity in a joint interpretation on March 17, but that's not law. The CLARITY Act would **codify that classification into federal statute**, handing XRP oversight to the CFTC, the agency regulating oil, gold, and wheat.

Institutions like pension funds and asset managers are waiting for this permanence. XRP ETFs saw **$131.94 million inflows in May**, their strongest month of 2026, coinciding with the bill's progress. This shows institutions are ready to commit at scale once legal status is settled.

## What Another Delay Would Mean for XRP

![Ripple XRP on cryptocurrency coin with falling crashing graph](https://247wallst.com/wp-content/uploads/2026/03/shutterstock-1152384794-huge-licensed-1-scaled.jpg)

A delay would cost at least six weeks, as the Senate returns September 14. September is the **final shot** for the bill this year, since both chambers are out for most of October ahead of the November 3 midterms. Polymarket traders now put the CLARITY Act's chances of becoming law in 2026 at around **30%, down from 82% in February**.

XRP has already shown the impact: it slid to $1.06 when the Senate set the bill aside on July 27, and has traded between $1.05 and $1.08 since. Holders would also wait alongside the rest of the crypto market, as the bill would set rules for the whole industry, potentially sparking a broad rally.

ETF inflows are shrinking: $131.94 million in May, $59.46 million in June, and $27.29 million in July, as buyers hold back until the law is settled.

## Can the CLARITY Act Still Pass in 2026?

Yes, but not this week. **September is the only month with enough floor time** to run the bill through cloture, debate, and a final vote, while also dealing with government funding. The Senate version differs from the House-passed text, so it would need another House vote before reaching Trump's desk, all within that narrow window.

This week decides how much of that window the bill starts with. **A cloture motion filed by Friday** would put the CLARITY Act first in line on September 14. Otherwise, it competes for floor time all over again.

The Senate has five working days to move the CLARITY Act before its recess. Here is what passage or delay would mean for the XRP price.

CLARITY Act Countdown: 5 Days Left in Senate – What It Means for XRP's Future

A quantum computer could crack the cryptography guarding millions of Bitcoin. Inside the freeze debate, the $470 billion exposed, and the startups racing to fix it.

## The Quantum Threat Looms

"I think we're four years away from Bitcoin going away," David McAlvany, CEO of gold app Vaulted, said on the On The Margin podcast. "Within four years we have quantum computing, and that is the end of Bitcoin. You can solve all the math problems instantly."

He added, "I have no idea if it's four years from now, five years from now, or two months from now." No machine that could do it exists in mid-2026, but the threat now carries a number.

## Attackers Understood That Before Security Teams

"What's a bit unfortunate about it is that attackers understood that before infrastructure teams and before security teams," said Ido Sofer, founder of key-management firm Sodot, on the podcast. "We're meeting every new attack vector first."

Galaxy Digital estimated in March 2026 that roughly **7 million Bitcoin** sit in addresses that have already exposed their public key on-chain, worth about **$470 billion**. Glassnode put it at 6.04 million, or 30.2% of supply. Both are estimates, not protocol counts. Galaxy called the risk "real, but far from an existential crisis." Exposed coins are Satoshi-era addresses that reveal the raw public key, plus any address reused after its first spend. Exposure is not theft; it becomes theft only when a machine can reverse the math—and that machine does not exist yet.

## Bring Your Own Locks

"When you're on Bitcoin, when you're on Ethereum, when you're on Solana, right now, you're locked into whatever lock they permit you to use, which is just one kind," said Yoon Auh, CEO of BOLTS Technologies. "When you see quantum advances, these locks can be broken, and that's what they're scared of."

Those locks look more breakable every year. Google researcher Craig Gidney showed in May 2025 that breaking RSA-2048 might take fewer than a million qubits, a twentyfold cut from his 2019 figure. An April 2026 Google whitepaper put cracking Bitcoin's elliptic-curve cryptography at fewer than 500,000. Ethereum Foundation researcher Justin Drake estimates a 10% chance a quantum computer could pull a Bitcoin key from an exposed public key by 2032. In April 2026, a researcher broke a 15-bit key on real quantum hardware. Real keys are 256 bits, so it's a toy, but it's a toy that didn't work at all a year before.

Auh's answer is to hand the choice of cryptography to the user instead of the chain. "Bring your own locks, choose your own locks," he said. BOLTS demonstrated its per-transaction cryptography to NIST's post-quantum cryptographers and ran a quantum-resilience pilot on Canton Network in December 2025. NIST finalized its first three post-quantum standards in August 2024.

Bitcoin's own developers are split on what to do. One draft proposal, **BIP-360** from Hunter Beast, would add a quantum-resistant address type. A second, **BIP-361** from Jameson Lopp and co-authors, would retire legacy signatures in two phases—any coins that never migrated, including those thought to be Satoshi Nakamoto's, would become unspendable. Freezing dormant coins, supporters argue, beats letting a future quantum thief drain them and dump them on the market. Critics call it confiscation. Algorand has signed its state proofs with quantum-resistant Falcon signatures since 2022; the Quantum Resistant Ledger and the publicly listed BTQ are chasing the same problem from other angles.

## It's Like Discovering Cold Fusion

Into that crowd steps **American Fortress**, an Austin company that raised an $8 million seed round in May, co-led by 0G Labs, SAVA Digital Asset Fund, and Moon Pursuit Capital. Formerly MatterFi, it pitches quantum resistance "for all chains without users having to migrate any addresses at all," paired with a backward-compatible Bitcoin soft fork designed to auto-freeze vulnerable dormant wallets before an attacker reaches them. Founder Michal "Mehow" Pospieszalski doesn't undersell it: "It's so good I can't give it away," he said on the podcast. "It's like discovering cold fusion."

Those claims are worth reading with care. "This style of algorithm is not new news," Pospieszalski said. "People have suggested there's this way to create extra proofs around existing addresses. But it was so slow that people abandoned it. We made it work 100 times faster on a regular PC." American Fortress has filed a patent for post-quantum transaction signing, but a filing establishes priority, not proof; its technical paper hasn't been published, and the design hasn't been publicly audited. The company has deployed a beta on Arbitrum, with a partnerships manager at Offchain Labs quoted supportively, though that's a deployment rather than a formal endorsement. "Post-quantum security isn't a future feature, but a present necessity," said Michael Heinrich, CEO of 0G Labs, in the funding announcement.

## Privacy Is Not Anonymity

The quantum work is only half the sell. The other half is a compliance-and-privacy layer, built on the same argument that crypto never actually proves who paid whom. "If I send money to you, you get a cryptographic proof that actually came from my private key," Pospieszalski said. "That's been completely impossible before." He points to address poisoning, where scammers seed a victim's history with lookalike addresses; one such attack drained $68 million in wrapped Bitcoin in May 2024, though the funds were later recovered. His fix attaches a provenance proof to every transaction and lets users disclose an identity only when they choose. "We don't make you get an ID to use the system," he said. "It's like ENS, except private."

Whether a privacy layer with built-in compliance is coherent is exactly the question others are wrestling with. "I always think of privacy and anonymity as completely different things," said Varun Kabra, chief growth officer at Concordium, on the podcast. Concordium builds identity into the chain using zero-knowledge proofs, so "because there is selective disclosure, there is zero knowledge proof, nobody knows it is you." That's the same bet American Fortress is making. Kabra frames the compliance line the same way: "You are in control of what you want to disclose and to whom, but within the constraints of law," he said. "Nobody should be above the law."

## You Can't Prove It

Pospieszalski's conviction that systems should prove their own honesty predates crypto. A self-described white-hat hacker, he was CTO of the Election Science Institute and around 2006 analyzed ES&S iVotronic voting machines, warning they had no cryptographic way to confirm a ballot was counted once. "You as the vote counter can't prove to me that you counted my vote, that you didn't double count it or under count it," he said. "You can't prove it." He later did forensic work for plaintiffs in the disputed 2020 Antrim County, Michigan case. By his own account, the anomaly traced to a misconfigured ballot-definition file, the same clerical explanation a bipartisan hand audit reached and every court accepted before the suit was dismissed; no fraud was ever substantiated.

None of the fixes now being funded settle the deeper question a long-term holder actually cares about. McAlvany, whose business is selling gold, asks whether Bitcoin will be here in 5,000 years. "Gold, I'm pretty sure will be," he said. "Bitcoin may or may not be."

A quantum computer could crack the cryptography guarding millions of Bitcoin. Inside the freeze debate, the $470 billion exposed, and the startups racing to fix it.

Quantum Showdown: Could Bitcoin's $470B Be at Risk? The Race to Save Crypto

A sophisticated attack drained **over 1,000 BTC (worth ~$70 million)** from 1,196 Coldcard hardware wallets in just 41 minutes on July 30, 2026. The theft didn't involve physical access or malware – instead, attackers exploited a **critical firmware flaw** that allowed them to reconstruct private keys offline.

## The Vulnerability: Weak Seed Generation

Coldcard wallets are designed to generate seed phrases using a dedicated hardware randomness generator. However, an internal build setting skipped this generator, and a supporting library only checked if the setting existed, not if it was enabled. This caused key generation to fall back to a basic software substitute seeded from the chip's serial number and clock registers.

This reduced the possible key space from astronomically large to a **computationally enumerable range**. For Mk4, Q, and Mk5 models, attackers could brute-force through roughly **4 billion possibilities** – a trivial task for modern computers.

## The Attack: Systematic Enumeration

The attacker generated candidate seeds on their own hardware, derived addresses, and checked them against the public blockchain. This process ran entirely on the attacker's machine, meaning victims' devices were never involved and could be powered off in safes.

Galaxy Research's analysis revealed the attack swept funds across **three address formats** (native segwit, older standards), indicating a systematic scanner rather than targeted theft. The funds now sit in four addresses and remain unmoved.

## The Aftermath: Uncertainty and Ongoing Risk

**Coinkite** (Coldcard's maker) initially warned Mk3 owners, but **Block's report** also implicates Mk2, Mk4, Q, and Mk5. Owners cannot easily determine if their seeds were generated on vulnerable firmware, leaving many in limbo.

Investigators found a crucial mistake: the attacker used a **paid account at a blockchain data provider**, whose logs matched the suspicious queries with "extraordinary specificity." This information has been passed to authorities.

## The Bigger Picture: Cold Storage Isn't Bulletproof

This incident challenges the core promise of hardware wallets – that keys are unguessable. As computational power grows, even supposedly secure devices can be compromised without physical access. The attack underscores the need for **rigorous firmware auditing** and **post-quantum cryptography** to future-proof digital assets.

For now, affected users are urged to **move their funds** to wallets with freshly generated seeds, as further waves of attacks are likely.

Galaxy Research said weak seed generation let an attacker recreate likely private keys offline, sweep more than 1,000 BTC from nearly 1,200 wallets and continue searching without ever accessing the devices.

Coldcard Cold Wallet Heist: $70M Stolen Without Touching Devices – Here's How

Cryptocurrencies like **Bitcoin** have evolved from a novelty to a significant force on Wall Street. As the market matures, **stablecoins** have emerged as a potential bridge between traditional finance and the crypto world. The European Central Bank (ECB) has recently issued a warning about stablecoins, raising questions about the future of digital assets. Here's what you need to know.

## The Rise of Stablecoins

Stablecoins are designed to maintain a stable value by being pegged to assets like fiat currencies or precious metals. Examples include **Tether (USDT)**, linked to the U.S. dollar, and **Tether Gold (XAUT)**, backed by gold. These coins aim to combine the benefits of cryptocurrencies—such as decentralization and low transaction costs—with the stability of traditional assets.

## ECB's Warning

The ECB has cautioned that stablecoins pose a significant threat to banks and the financial system. If customers shift their funds to stablecoins, it could drain reserves from banks, making them less stable and potentially less profitable. This warning highlights the disruptive potential of stablecoins, which could bypass traditional banking intermediaries.

## The Digital Euro Initiative

In response, the ECB is developing a **digital euro**, a central bank digital currency (CBDC) that would be backed by the traditional banking system. This move aims to provide a regulated alternative to private stablecoins, ensuring that the banking system remains relevant in the digital age.

## Implications for Crypto Investors

For investors, the rise of stablecoins and the ECB's warning have several implications:

- **Risk**: Stablecoins, despite their name, are not risk-free. They depend on the backing assets and the trustworthiness of the issuer.
- **Evolution**: The crypto market is evolving, and older cryptocurrencies like Bitcoin may face competition from more stable alternatives.
- **Regulation**: Increased regulatory scrutiny could slow the growth of stablecoins but may also legitimize them in the long run.

## The Future of Crypto

The ECB's warning underscores the tension between innovation and regulation. While stablecoins offer benefits, they also challenge the existing financial order. The development of a digital euro suggests that traditional institutions are adapting to the crypto revolution, potentially leading to a hybrid system where both coexist.

As the industry matures, investors should stay informed about these developments. The shift from speculative cryptocurrencies to asset-backed stablecoins could reshape the market, offering both risks and opportunities.

Are banks looking to protect their industry position, or is there a real risk that investors should be worried about?

Bitcoin Articles Published Today

Bitcoin Articles Published Yesterday