The Coldcard exploit is ongoing, with Galaxy Research now tracking about $88.6 million stolen across 4,585 addresses in three waves.
Galaxy’s Alex Thorn described the sweeps as deliberate and likely LLM-orchestrated, warning that every single-sig Coldcard address created after the March 2021 firmware flaw will eventually be drained.
The breach has spurred an unusual reversal of the “not your keys, not your coins” ethos as users move Bitcoin back to exchanges.
The theft of Bitcoin from compromised Coldcard hardware wallets is still underway, with researchers now tracking losses of roughly $88 million and warning that every vulnerable device will eventually be emptied.
Galaxy Research said Saturday it has identified a third wave of thefts, in which 207.73 BTC was drained, lifting its observed tally to about 1,367 BTC—around $88.6 million—across 4,585 addresses. The firm called the exploit ongoing and urged anyone holding single-signature funds on a Coldcard to move them at once. Galaxy said it has flagged roughly 600 suspected attacker addresses to federal investigators, compliance firms and cross-industry cyber investigators, crediting victims who shared transaction details for helping map the on-chain patterns.
“I continue to investigate and add new Coldcard victim and attacker addresses to our investigation database,” Galaxy’s head of research Alex Thorn posted to X. “The attack is ongoing—move your funds off Coldcard-generated addresses immediately if you have not done so.”
i continue to investigate and add new Coldcard victim and attacker addresses to our investigation database tonight
THE ATTACK IS ONGOING — move your funds off Coldcard-generated addresses immediately if you have not done so. i will provide additional updates on estimated…
The flaw, as Decryptpreviously reported, stems from a March 2021 firmware build error on Coinkite’s devices that caused seed phrases to be generated with far too little randomness, leaving private keys guessable. Thorn wrote that the sweeps look deliberate and programmatic, probably orchestrated with a large language model, and cautioned that every single-sig Coldcard address created after that 2021 update will eventually be drained, saying it is only a matter of time.
Thorn noted the stolen coins had sat untouched for years before being taken—an average dormancy of 3.18 years—underscoring that the victims were long-term holders. The funds from the three documented waves remain parked in attacker addresses and have not moved.
The fallout has driven a panicked response from affected users, with security experts urging caution when moving funds to new addresses. Many of the affected users are racing to move Bitcoin off self-custody and back onto centralized crypto exchanges, such as Coinbase or Binance, or freshly generated addresses—an inversion of the industry’s usual “not your keys, not your coins” ethos.
$1.6 million dollars in Bitcoin was drained from my account on July 29th in the Cold Card wallet hack.
My Bitcoin was in cold storage. My keys were on a ColdCard device kept in a safety deposit box that had never been connected to the internet.
For some, the warnings came too late. Canadian coach Jonathan Goodman said in a post on X that 18.25 BTC, worth about $1.6 million Canadian, was swept from his wallets in a seven-minute span on July 29, despite his keys sitting in a safety deposit box that never touched the internet. “Perhaps the hardest part about this is that I did everything right,” he wrote, adding that he is filing reports with police and the Ontario Securities Commission.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Cardano [$ADA] climbed 8.74% over the past 24 hours, extending bullish momentum after breaking out of its multi-week consolidation.
After establishing a firm base near $0.1531, $ADA gradually regained strength, setting the stage for a decisive breakout. Buyers then reclaimed the $0.1750 mid-range level before pushing through the key $0.1812 resistance.
At press time, the altcoin traded around $0.1860, reflecting a strong recovery from late-July lows. Moreover, the breakout candle printed 3.49 million $ADA in volume, confirming genuine buying interest rather than a weak rally.
Source: $ADA/USDT on TradingView
This improving structure strengthens bullish momentum. However, the rapid gains may create opportunities for short-term pullbacks after the breakout. If $ADA can maintain the support at $0.1812, the next leg up will likely be towards $0.2000 resistance.
Consequently, losing that level would increase the likelihood of a healthy retest before another advance.
Market rotation reinforces Cardano’s rally
Such an improving technical structure also appears to reflect a broader shift across the altcoin market rather than Cardano alone. The Altcoin Season Index climbed 5.77% over the past 24 hours to 55, moving further above the neutral 50 threshold.
This suggests capital is gradually rotating from Bitcoin [BTC] into higher-beta altcoins. Meanwhile, the altcoin market cap stabilized near $900 billion after recovering from its late-June lows, reinforcing improving risk appetite.
Source: CoinMarketCap
That broader backdrop strengthens Cardano’s breakout above $0.1812, indicating buyers are responding to favorable market positioning alongside project-specific demand.
Although the Altcoin Season Index remains far short of the 75 altcoin season threshold. This suggests that broader participation must continue before a sustained sector-wide rally becomes more convincing.
Derivatives reinforce the breakout
That broader optimism is also becoming visible in Cardano’s derivatives market. After whales accumulated more than 240 million $ADA over the past five days, Santiment data shows the token rallied 22%, encouraging more leveraged participation.
Source: X
As confidence improved, futures trading volume jumped 61.06% to $639.62 million, while Open Interest climbed 13.91% to $485.58 million. Those gains suggest traders are opening fresh positions instead of closing existing ones, reinforcing the breakout above $0.1812.
Source: CoinGlass
Meanwhile, short liquidations continued outpacing longs, showing bearish positions helped fuel the rally. However, options volume fell 92.94%, while options open interest eased 0.27%. Sustained whale accumulation and rising futures participation would provide stronger confirmation that the breakout remains well supported.
Final Summary
Cardano broke above multi-week resistance as improving market sentiment strengthened its bullish breakout.
$ADA must hold $0.1812 to sustain its rally, while continued derivatives participation could support a move toward $0.2000.
Leading cryptocurrencies edged higher on Sunday as investors weighed President Donald Trump’s remarks about a potential Iran peace agreement.
Crypto Market Consolidates
Bitcoin wobbled within a range of $62,890 to $63,700, with trading volume surging 19% over the 24-hour period. Ethereum also remained stuck within $1,800, while XRP and Dogecoin traded in the green.
Nearly $150 million was liquidated from the cryptocurrency market in the last 24 hours, predominantly in bearish short positions, according to Coinglass data.
Bitcoin’s open interest rose 0.31% over the last 24 hours. Retail and whale derivatives traders remained net long on $BTC, but trimmed their exposure from the day before.
“Fear” sentiment prevailed in the market, according to the Crypto Fear & Greed Index.
Top Gainers (24 Hours)
The global cryptocurrency market capitalization stood at $2.17 trillion, following an increase of 0.82% over the last 24 hours.
Stock Futures Lift on Peace Hopes
Stock futures climbed overnight on Sunday. The Dow Jones Industrial Average Futures rose 205 points, or 0.39%, as of 8:41 p.m. EDT. Futures tied to the S&P 500 spiked0.42%, while Nasdaq 100 Futures rallied 0.65%.
The upsurge came after Trump after being “asked” by Tehran and other Middle East nations to “hold off” to allow a deal to be reached.
$BTC’s ‘Strong and Vital Move’ Incoming?
Michaël van de Poppe, a widely followed cryptocurrency analyst and trader, noted record-low Bitcoin sentiment and high net negative positioning in the current cycle
He predicted that a sustained breakout above the $67,000-$68,000 resistance would trigger a “strong and vital move” due to liquidations, “accelerating” the move upward.
On-chain analytics firm Santiment also spotlighted Bitcoin’s lowest positive-to-negative commentary on major social platforms, with just 0.58 bullish comments for every 1 bearish comment.
“This panic reading is larger than the peak war fears earlier this year, as well as the other aforementioned events from crypto’s past,” Santiment added.
Bitcoin’s price is on the move today, prompted by the latest developments on the US-Iran war front, but this time in the opposite direction.
After it slipped to another multi-week low yesterday evening, the cryptocurrency has rebounded by approximately $1,500 and now sits at around $63,500. The reason for this is the major de-escalation announced by the POTUS hours ago.
US President Trump announced on his social media platform, Truth Social, that although his country’s military remains “locked and loaded” to continue attacking Iran, they were asked by the Middle Eastern country and other nations in the region to pause the strikes for now.
He added that those countries are working on a new deal that would include the “immediate, complete and total opening of the Hormuz Strait, and an end to Iran’s nuclear threat.”
“Based on this request, I have agreed, for the future benefit of the WORLD and, likewise, the survival of a successful and prosperous Iran, to cancel the attack, subject to being able to rapidly make a DEAL. The Country of Israel joins me in this commitment. Get to work, everybody, and get it DONE.”
As mentioned above, $BTC reacted immediately with a notable rebound. It had dipped to an 18-day low at $62,200 yesterday evening as the tension between the two had increased once again, with new planned strikes. In addition, there are other factors, such as ETF exodus and technical indicators, that suggested the cryptocurrency could face another leg down soon.
For now, though, the war developments appear to have the most significant impact on bitcoin’s price moves, and essentially every de-escalation brings back hope to the market. The actual impact is likely to be experienced on Monday morning, as it has happened numerous times in the past several weeks.
Strategy Chairman Michael Saylor said the company had never made a commitment to never sell its Bitcoins, but expected to remain a net Bitcoin buyer in the long term.
Saylor’s statement came after reports that Strategy had received new authorization allowing it to sell up to $5 billion worth of Bitcoin. Responding to these claims, Saylor stated that the sales authorization was not new and had been announced on June 29th as part of the company’s capital management framework.
Saylor stated, “Old news is being presented as new. Strategy announced this authorization on June 29th as part of its capital management framework. This arrangement permits the sale of $BTC for the stated purposes but does not compel the company to sell. No new authorization has been announced, and we expect to continue to be a net Bitcoin buyer over time.”
Related NewsMichael Saylor Announced That the Bitcoin Update He Opposed Is Now Impossible to Pass
Saylor stated that Strategy’s Bitcoin monetization program does not require the company to sell its $BTC holdings, and noted that the company has never officially adopted a “$BTC will never be sold” policy.
Galaxy Research announced the detection of a third wave of attacks believed to target addresses created on Coldcard devices. The latest wave reportedly resulted in the withdrawal of 207.7294 $BTC, bringing the total loss to 1,367.05 $BTC, or approximately $88.6 million, across 4,585 addresses.
According to the research firm, the first two waves of attacks exhibited largely similar on-chain behavior. Both waves saw funds being transferred to a small number of shared collection addresses, P2WPKH addresses being used, and wallets originating from different derivation paths being targeted. The approximately 27-hour interval between the two waves and the similarities in transaction structures suggest that the attacks may have been carried out by the same person or group.
However, Galaxy Research emphasized that there were differences between the first two waves in terms of transaction fees and “replace-by-fee” signals, therefore it could not be definitively proven that the same attacker was involved.
The Third Wave May Point to a Different Attacker
According to Galaxy Research, the third wave of attacks differs from the previous two in almost every measurable behavioral characteristic. Instead of using shared collection addresses in the first attacks, the third wave was found to have created a separate target address for each victim.
It was stated that the Bitcoins stolen in the third wave were held in P2WSH addresses instead of P2WPKH addresses, and that an average of 6.37 victim addresses were aggregated in each dump. In the first wave of the attack, each transaction targeted only a single victim address. It was also stated that the third wave only scanned addresses in the default derivation path.
Researchers noted that these changes could stem from the same attacker re-engineering their tools to make on-chain tracing more difficult. However, it was also noted that it is possible a second attacker targeting the same vulnerable key pool emerged after information about the Coldcard vulnerability was made public.
Galaxy Research reported that on-chain data did not allow for a definitive distinction between these two scenarios. The company stated that while it was certain each attack wave was managed by a single operator, it could not be definitively said that all three waves were linked to the same attacker.
Related NewsMichael Saylor: “We Never Said We’d Never Sell Bitcoin”
Bitcoins in Attacker Addresses Have Not Yet Moved
According to Galaxy Research’s calculations, the attackers control a total of 1,366.3865 $BTC. It is stated that not all of the final attacker addresses to which these Bitcoins, worth approximately $88.6 million, were transferred have yet spent them on the chain.
Graph showing the total amount of Bitcoin lost in the attacks. Source: Galaxy Research
Block-by-block analysis revealed that addresses were dumped en masse during attack waves. The absence of any dumping operations in intermediate blocks within each wave that could be attributed to the attackers indicated that the operations were sent to the network in groups, not continuously.
It was noted that the losses were mostly concentrated in wallets with balances below 1 $BTC in terms of address count, but addresses with larger balances were decisive in terms of total value. Galaxy Research assessed that this distribution resembled individual users’ own custodial wallets rather than institutional custodial services.
The study also indicated that the vulnerable Coldcard software was released on March 17, 2021, around block 674,951 of the Bitcoin network. Galaxy Research stated that none of the Bitcoins identified as stolen in the first three waves of attacks were created before this block.
$SOON [$SOON] crypto gained 14% over 24 hours, outperforming a broader market where Bitcoin [BTC] and Ethereum [ETH] traded lower.
The rally appeared largely leverage-driven, with perpetual traders supplying much of the buying pressure. However, uneven positioning and retail dominance left the move vulnerable to a reversal.
Why is $SOON price rising?
Data from CoinGlass shows perpetual market traders on the top cryptocurrency exchanges Binance and OKX have played the key role in driving the surge.
A Long/Short Ratio above 1 indicates a long bias, while a reading below 1 favors shorts.
At press time, the ratio stood near 1.5 on Binance and 1.3 on OKX. Both readings reflected stronger bullish positioning among traders on these exchanges.
Source: CoinGlass
Together, Binance and OKX accounted for $13.56 million in $SOON’s perpetual Trading Volume. They also held the two largest Open Interest positions, collectively valued at $34.05 million.
However, the aggregate Long/Short Ratio across centralized exchanges stood at 0.96, indicating a slightly broader short bias.
Do Funding Rates support $SOON crypto?
Although aggregate positioning leaned slightly bearish, $SOON’s positive Funding Rate showed that long traders were paying shorts.
This suggested that bullish traders were willing to pay periodic fees to maintain their leveraged positions.
Source: CoinGlass
However, the reading did not prove that most of $SOON’s $41.82 million Open Interest represented long contracts. Further increases in Open Interest and Funding Rates could leave the market vulnerable to an overleveraged unwind.
On top of that, Spot demand supported the rally over the previous 48 hours. Net buying reached $97,920, while total buying stood near $1.84 million during the same period.
Retail dominance leaves $SOON’s rally exposed
The rally’s sustainability hinges on who dominates between whales—who control large capital and tend to hold for much longer—and retail investors, who are quick to sell.
Data confirms retail traders have driven much of the $SOON rally over the past 24 hours, as the whale-retail delta fell significantly to -0.039, which points to this group holding heavy control over the market.
Source: CoinGlass
The risk here, however, is this group may sell at the slightest opportunity, flipping long positions to short and triggering significant liquidations across the market. Overall, while the market leans bullish, traders should approach it with caution.
Final Summary
$SOON’s 14% climb was powered largely by leveraged perpetual traders on Binance and OKX, which together hold the two largest open interest positions at a combined $34.05 million.
Retail investors now dominate the rally, with the whale-retail delta at -0.039, leaving the move vulnerable to a quick sell-off.
Fake $XRP Platform Vanished After Collecting Investor Funds
The Seoul Metropolitan Police Agency announced July 30 that investigators had apprehended three people accused of operating a fraudulent $XRP investment platform, according to Korean newspaper Chosun. Authorities allege the group collected approximately 3.4 million $XRP from 71 investors between Oct. 16 and Oct. 23 before closing the website and disappearing.
The suspects allegedly promoted Fxrpntwork.com through portal blogs, online articles, and Youtube videos while promising guaranteed principal and monthly returns between 1.5% and 1.8%. Investors were instructed to move $XRP from South Korean exchanges through overseas platforms before transferring the assets into wallets controlled by the group.
Seoul police warned prospective cryptocurrency investors to verify official sources carefully before transferring assets to unfamiliar wallets or unverified platforms:
“Do not be misled by unverified information on YouTube or other platforms. Verify official sources before investing.”
Investigators arrested two 29-year-old suspects and plan to refer the case against a 34-year-old alleged accomplice to prosecutors while pursuing another 29-year-old suspect abroad. Police obtained an Interpol Red Notice for the overseas suspect and continued examining additional participants accused of building and promoting the fraudulent website.
Fraudsters Copied Flare and FXRP Branding
The alleged operators used the names Flare Network and FXRP to make their platform appear connected to legitimate blockchain infrastructure. Flare’s official FAssets system is designed to represent assets such as $XRP on the Flare network through overcollateralized mechanisms, allowing those tokens to participate in decentralized applications.
Ripple has warned that cryptocurrency impersonation schemes frequently copy trusted names, logos, videos, websites, and executive identities to create false credibility. Interpol has also identified financial fraud as an increasingly organized cross-border threat, with criminal networks using digital platforms and rapid transfers to move proceeds across jurisdictions before authorities can intervene.
Guaranteed Returns Remain a Common Crypto Fraud Signal
Impersonation scams involving $XRP have increasingly relied on counterfeit promotions, fabricated endorsements, and promises that victims will receive more tokens after sending funds.
Warnings about expanding $XRP impersonation schemes have emphasized that legitimate companies do not request cryptocurrency transfers through unsolicited promotions, particularly when scammers combine familiar branding with urgent instructions or guaranteed returns. A fraud case involving fake “no-risk” cryptocurrency returns further illustrates how guaranteed-profit claims can be used to attract victims.
FBI data on billions of dollars in cryptocurrency scam losses shows that cryptocurrency investment fraud continues producing substantial losses across borders, often through fake dashboards and fabricated account balances. An international cryptocurrency scam crackdown resulting in 276 arrests also targeted networks accused of moving victims’ assets through layered wallets, exchanges, and overseas financial channels.
South Korean investigators froze 17.3 billion won in virtual assets shortly after detecting the alleged scheme, although approximately 10 billion won moved during the investigation. Wallet analysis later identified 27.3 billion won in transfers connected to the addresses, prompting authorities to examine whether additional victims and accomplices remain unidentified.
$XRP‘s range trading continues as price chugs near the crucial $1 support. $XRP held above the $1.02 support for all of July, a feat that remained significant and saw it close the month in the green, gaining 2.18%.
$XRP faced choppy price action in July, albeit price held above the important level of $1. The price tested support in the range between $1.02 and $1.06 during the month, making this a crucial zone to watch. However, as August begins, bears seem to be testing this crucial price zone, seeking to break it.
The price of $XRP is currently $1.06, performing multiple tests in the $1.05 and $1.06 range within the last 24 hours.
card
$XRP recorded its first green month since April when it closed July up 2.18%. The $1.02 support is now being watched, with a decline potentially testing $1.00, a strong support for $XRP price. The positive sign is that $XRP has held above $1.00 so far in 2026. Resistance levels are at the weekly MA 200 and 50 at $1.80 and $1.21, respectively.
Key XRPL features to land in August
August may be a noteworthy month for $XRP Ledger upgrades, with five amendments set to arrive in the week ahead.
According to Jazzi Cooper, RippleX head of product, the upcoming release of xrpld 3.3.0 includes five amendments. These are Confidential MPT, which brings native privacy to Multi-Purpose Tokens (MPTs) on $XRP Ledger; Batch, which enables up to eight transactions across different accounts to execute atomically in a single ledger.
Permission Delegation allows institutions to delegate narrowly scoped transaction permissions without handing over full signing authority; Sponsored Fees and Reserves allow a sponsor such as a bank, issuer, or platform to pay $XRP transaction fees and account reserves on behalf of another account. Dynamic MPT allows issuers of Multi-Purpose Tokens to define, at issuance, exactly which properties may be updated over time.
According to Cooper, the xrpld 3.3.0 release is currently anticipated for next week.
Digital Asset Acquisition Corp., the SPAC seeking to combine with the parent of regulated bank Old Glory Bank, postponed the shareholder vote on the deal to 10 a.m. Eastern Time on Aug. 14 from July 31.
The original meeting date fell two days after the stated July 29 redemption deadline. DAAQ said in a July 31 filing that it would continue soliciting proxies but gave no reason for the delay.
The postponement did not automatically reopen redemptions. DAAQ’s final prospectus says investors could withdraw a redemption request through the deadline and afterward only with the company’s consent before closing. The filing does not say whether DAAQ has approved any post-deadline withdrawals.
Capital gap meets the cash test
The parent company at the center of the deal is Old Glory Holding Company. The bank was below two distinct capital thresholds going into the vote window. The final prospectus said its Tier 1 leverage ratio remained below the ordinary 4% adequately capitalized threshold as of June 29, putting Old Glory in technical noncompliance with a merger-agreement covenant. Old Glory considered that noncompliance nonmaterial, according to the filing.
A May 2024 consent order from the Federal Deposit Insurance Corp. and Oklahoma State Banking Department sets a much higher requirement. It requires a 14% Tier 1 leverage ratio while the order remains in effect, along with regulator-reviewed capital and business plans and prior consent for dividends and bonuses. Separately, prompt-corrective-action rules restrict growth, capital distributions, acquisitions, branches and new business lines while the bank is undercapitalized.
The holding company’s consolidated financial disclosures say its capital is not expected to cover operating losses and minimum regulatory capital needs over the next 12 months, creating substantial doubt about its ability to continue as a going concern.
Management identifies cash from the merger as a mitigation, but says closing depends on other parties and market conditions and is not assured. The warning is not a declaration that the bank is insolvent or about to close.
The merger agreement requires at least $50 million of closing aggregate cash, calculated from trust cash remaining after redemptions, PIPE proceeds actually received, and proceeds to be received from other transaction financing. The party benefiting from the condition can waive it in a signed writing where lawful.
DAAQ reported $178.58 million of trust securities and 17.25 million redeemable public shares as of March 31. That historical balance does not show what will be available at closing. The postponement filing disclosed neither the July redemption tally nor the remaining trust cash.
The July 7 prospectus also said no PIPE or other transaction financing had been entered into or obtained. A June filing said DAAQ intended to negotiate non-redemption agreements, but the attached form identified no executed investor or committed share amount.
Approval timing remains uncertain. As of the final prospectus, a Federal Reserve application was pending, and Nasdaq approval of the combined company’s initial listing remained a closing condition. The July 31 filing announced neither approval, though its silence does not establish their current status.
DAAQ now has two more weeks to chase votes, while the deal’s cash picture remains murky. Investors need the redemption count and firm funding commitments to see whether it can clear the $50 million closing test, plus a fresh capital ratio to gauge Old Glory Bank’s shortfall.
