&lt;p&gt;The U.S. Department of the Treasury has unveiled its latest proposed rulemaking to implement Section 3 of the GENIUS Act, setting clear licensing deadlines and new compliance duties for stablecoin issuers and digital asset platforms. Issuers must be federally or state-licensed by January 18, 2027, and from July 18, 2028, exchanges and other service providers will be barred from offering or selling unlicensed stablecoins to U.S. persons.&lt;/p&gt;
&lt;h1&gt;What the GENIUS Act Is and Why It Matters&lt;/h1&gt;
&lt;p&gt;The Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act, signed into law on July 18, 2025, created the first comprehensive federal framework for payment stablecoins. Section 3 of the Act prohibits the issuance, offer, or sale of payment stablecoins in the United States by anyone who is not a licensed or permitted issuer, with limited exceptions for qualifying foreign issuers. Treasury&amp;rsquo;s August 17, 2026 Notice of Proposed Rulemaking (NPRM) defines key terms and sets the operational guardrails that will determine which stablecoins can legally circulate in the U.S. market.&lt;/p&gt;
&lt;h1&gt;Key Deadlines and Licensing Requirements&lt;/h1&gt;
&lt;p&gt;1. January 18, 2027: It becomes unlawful to issue a payment stablecoin in the U.S. without a federal or state license, unless the issuer is foreign and meets Treasury&amp;rsquo;s comparability and registration conditions.&lt;/p&gt;
&lt;p&gt;2. July 18, 2028: Digital asset service providers cannot offer or sell any payment stablecoin to U.S. persons unless it was issued by a permitted or qualifying foreign issuer.&lt;/p&gt;
&lt;p&gt;These dates create a two-stage compliance runway: first for issuers to secure authorization, then for platforms to delist or restrict access to noncompliant tokens.&lt;/p&gt;
&lt;h1&gt;New Duties for Exchanges and Platforms&lt;/h1&gt;
&lt;p&gt;Under the proposal, platforms listing offshore stablecoins can no longer rely solely on an issuer&amp;rsquo;s self-certification. Treasury requires &amp;ldquo;reasonable due diligence&amp;rdquo; before a platform can depend on an issuer&amp;rsquo;s representation that it will comply with U.S. lawful orders. At a minimum, platforms must confirm that no secondary-trading ban is in force against the issuer. This shifts some regulatory burden onto exchanges, pushing them to vet foreign issuers more rigorously before listing or continuing to support their tokens for U.S. users.&lt;/p&gt;
&lt;h1&gt;How Treasury Defines &amp;ldquo;Issued in the U.S.&amp;rdquo;&lt;/h1&gt;
&lt;p&gt;The proposal adopts a conduct-based test rather than importing securities-law concepts. A foreign issuer is generally not considered to have &amp;ldquo;issued&amp;rdquo; in the U.S. if it:&lt;/p&gt;
&lt;p&gt;1. Reasonably believes its buyers are located outside the U.S.,&lt;/p&gt;
&lt;p&gt;2. Maintains real operational controls (not just paper policies) to prevent U.S. sales, and&lt;/p&gt;
&lt;p&gt;3. Does not market to U.S. persons.&lt;/p&gt;
&lt;p&gt;For individuals, Treasury looks at physical presence; for companies, it considers U.S. incorporation or principal place of business at the time of issuance.&lt;/p&gt;
&lt;h1&gt;Penalties and Enforcement&lt;/h1&gt;
&lt;p&gt;Knowing participation in an unlawful issuance, including market-making, white-labeling, or coordinating minting, can carry fines up to $1 million and up to five years in prison per violation. This creates significant personal and corporate liability for actors who facilitate unlicensed stablecoin activity after the 2027 and 2028 deadlines.&lt;/p&gt;
&lt;h1&gt;Public Comment and Next Steps&lt;/h1&gt;
&lt;p&gt;Treasury has opened a 60-day public comment period following the NPRM&amp;rsquo;s publication in the Federal Register on August 18, 2026. Stakeholders can submit feedback on the proposed definitions, due diligence standards, and foreign-issuer treatment before final rules are adopted. Treasury Secretary Scott Bessent framed the rulemaking as part of an effort to keep the U.S. &amp;ldquo;the crypto capital of the world,&amp;rdquo; signaling that clarity, not restriction, is the stated goal.&lt;/p&gt;

US Treasury Proposes GENIUS Act Stablecoin Rules

&lt;p&gt;South Korea has officially moved to block domestic access to Polymarket, the world&amp;rsquo;s largest decentralized prediction market, after regulators classified the platform as an illegal gambling operator. The decision, announced on August 18, 2026, marks a significant escalation in the country&amp;rsquo;s crackdown on crypto-based betting platforms and aligns Seoul with more than 30 nations that have already restricted access to the site.&lt;/p&gt;
&lt;h1&gt;Regulatory Decision and Legal Basis&lt;/h1&gt;
&lt;p&gt;The Korea Communications Standards Commission (KCSC), also referred to as the Broadcasting, Media and Communications Review Committee in some reports, held a communications deliberation subcommittee meeting on August 18 and voted to issue a corrective measure requiring internet service providers to block access to Polymarket. Regulators determined that Polymarket provides information that facilitates gambling under South Korea&amp;rsquo;s Criminal Act and enables activities classified as &amp;ldquo;similar acts&amp;rdquo; under the National Sports Promotion Act. The commission emphasized that technical features or service methods cannot exempt a platform from compliance with domestic law. &amp;ldquo;Since Polymarket provides a real illegal gambling environment to domestic users, access blocking is unavoidable to protect them,&amp;rdquo; the KCSC stated in its announcement.&lt;/p&gt;
&lt;h1&gt;Rising Popularity and Legal Gray Zone&lt;/h1&gt;
&lt;p&gt;Polymarket allows users to trade &amp;ldquo;Yes&amp;rdquo; or &amp;ldquo;No&amp;rdquo; shares on real-world events, from election outcomes to economic indicators and even local weather patterns like Seoul&amp;rsquo;s rainfall. Prices on the platform reflect the crowd&amp;rsquo;s implied probability of an outcome, and users can buy, sell, or hold positions before events resolve. Despite South Korean law prohibiting online wagering on event outcomes, the platform remained accessible for months, with users purchasing dollar-backed stablecoins on local exchanges, transferring them to personal wallets, and depositing them into Polymarket. In May 2026 alone, wagers placed by Korean users on the outcome of Seoul&amp;rsquo;s mayoral election reached $43.68 million on the platform. This surge in activity drew scrutiny from authorities. By June 2026, cybercrime units in Gangwon Province had begun charging domestic users with gambling offenses, tracing crypto-asset transaction records to identify suspects nationwide.&lt;/p&gt;
&lt;h1&gt;Polymarket&amp;rsquo;s Preemptive Moves&lt;/h1&gt;
&lt;p&gt;Ahead of the formal block, Polymarket took steps to limit its exposure in South Korea. In late July 2026, the platform discontinued Korean-language support and stopped displaying South Korea-related prediction markets to users in the country. However, the global English-language site remained accessible, and South Korea was not included on Polymarket&amp;rsquo;s official list of 39 restricted jurisdictions.&lt;/p&gt;
&lt;h1&gt;Enforcement and Penalties&lt;/h1&gt;
&lt;p&gt;The final access-block order will require South Korean telecom operators to enforce ISP-level restrictions, effectively making the site unreachable without circumvention tools. Users who attempt to bypass the block using VPNs or similar tools face individual enforcement risk under Article 246 of the Criminal Act, with fines of up to 10 million won (approximately $6,500).&lt;/p&gt;
&lt;h1&gt;What&amp;rsquo;s Next for Korean Users and the Crypto Industry&lt;/h1&gt;
&lt;p&gt;With ISP-level blocks imminent, Korean users will lose direct access to one of the most active prediction markets globally. The move underscores Seoul&amp;rsquo;s hardline stance on crypto-based gambling, even as the country advances broader digital asset legislation, including stablecoin frameworks and spot crypto ETFs. For content creators and crypto professionals tracking the space, the Polymarket ban signals tighter enforcement ahead and a potential shift toward compliant, regulated prediction market alternatives in the region.&lt;/p&gt;

South Korea Blocks Access to Polymarket

&lt;p&gt;Robinhood is expanding its AI-driven trading suite to cryptocurrencies, letting eligible U.S. users connect third‑party AI agents to a dedicated &amp;ldquo;Agentic Account&amp;rdquo; that can research markets and execute crypto trades automatically. The move, announced in late July 2026 and now in a gradual rollout through August, marks one of the first mainstream broker integrations of autonomous AI agents into live crypto markets.&lt;/p&gt;
&lt;h1&gt;What&amp;rsquo;s launching and when&lt;/h1&gt;
&lt;p&gt;Robinhood first opened its brokerage to AI agents on May 27, 2026, with a beta focused on equities and options. On July 20-21, 2026, the company extended Agentic Trading to crypto for eligible U.S. customers at no extra cost, and it has been rolling the feature out progressively since then. By early August, reports indicated the feature was reaching more users as part of a staged expansion.&lt;/p&gt;
&lt;h1&gt;How Robinhood&amp;rsquo;s AI agent crypto trading works&lt;/h1&gt;
&lt;p&gt;The core idea is simple: users create a separate Agentic Account, fund it with cash, and then connect an AI agent through Robinhood&amp;rsquo;s Trading Model Context Protocol (MCP) server. Once connected, the agent can:&lt;/p&gt;
&lt;p&gt;1. Access portfolio data, balances, buying power, transaction history, and watchlists inside that account.&lt;/p&gt;
&lt;p&gt;2. Research assets, propose strategies, and place trades in supported cryptocurrencies, alongside equities and options if enabled.&lt;/p&gt;
&lt;p&gt;3. Automate strategies such as portfolio rebalancing, thematic baskets, dollar‑cost averaging, and rule‑based responses to market moves.&lt;/p&gt;
&lt;p&gt;4. Provide performance summaries and explain the logic behind executed trades.&lt;/p&gt;
&lt;p&gt;Crucially, agents can only use funds explicitly deposited into the Agentic Account; they cannot touch the user&amp;rsquo;s main brokerage balance. The feature is currently limited to cash accounts, so margin trading is not supported for agentic strategies. Users can choose whether the agent must request approval before each trade or operate fully autonomously within preset limits, and they receive trade notifications and live portfolio tracking to stay informed.&lt;/p&gt;
&lt;h1&gt;Which crypto assets are supported&lt;/h1&gt;
&lt;p&gt;Robinhood is not adding new tokens as part of this launch; instead, AI agents can trade the same cryptocurrencies already supported on Robinhood&amp;rsquo;s platform. That means major assets like Bitcoin and Ethereum, plus other listed coins available to U.S. users, are in scope, subject to Robinhood&amp;rsquo;s existing eligibility and regional rules.&lt;/p&gt;
&lt;h1&gt;Why this matters for crypto traders&lt;/h1&gt;
&lt;p&gt;For retail crypto investors, agent-powered trading turns complex, data-heavy strategies into something closer to &amp;ldquo;set-and-monitor.&amp;rdquo; Instead of manually tracking indicators or rebalancing across multiple coins, users can delegate routine execution to an AI agent while keeping ultimate control over capital and risk parameters. Robinhood has also been enhancing the data available to agents. In late July 2026, it added 18 technical indicators (including RSI, MACD, and Bollinger Bands) that agents can read natively, making chart-based strategies easier to automate. This sits alongside Robinhood&amp;rsquo;s broader push into AI-native infrastructure, including its Robinhood Chain Layer‑2 network, which has already seen thousands of AI agents deployed in its ecosystem.&lt;/p&gt;
&lt;h1&gt;Risks and limitations to keep in mind&lt;/h1&gt;
&lt;p&gt;Robinhood is clear that users remain responsible for losses caused by their agents, and that sharing data with external AI providers may reduce privacy protections. Agents cannot make unsupervised strategic allocation decisions outside the rules users set, and they cannot access accounts or funds beyond the dedicated Agentic Account. Because crypto markets run 24/7 and can be highly volatile, automated strategies require careful parameter design, ongoing monitoring, and an understanding of how the agent behaves in fast-moving conditions.&lt;/p&gt;
&lt;h1&gt;What&amp;rsquo;s next&lt;/h1&gt;
&lt;p&gt;Robinhood describes the crypto agentic rollout as gradual and limited to eligible U.S. users, without publishing a firm completion date or detailed eligibility criteria. As adoption grows, the integration of AI agents into crypto could reshape how retail traders approach automation, risk management, and portfolio construction.&lt;/p&gt;

Robinhood Is Rolling Out AI Agent-Powered Crypto Trading

&lt;p&gt;Sui has introduced Tessera, a private B2B settlement network designed to help companies settle invoices with stablecoins without publicly exposing payment amounts. Developed by Mysten Labs, the prototype combines Sui&amp;rsquo;s Confidential Transfers technology with Seal multi-party computation (MPC) to balance commercial privacy, regulatory oversight, and blockchain-based settlement.&lt;/p&gt;
&lt;p&gt;The announcement comes as financial institutions increasingly explore stablecoins for faster cross-border payments and treasury operations. However, public blockchains often reveal transaction values, allowing competitors and other market participants to monitor pricing, payment volumes, and corporate cash movements. Sui says this lack of privacy has been a major obstacle to wider blockchain adoption in business payments.&lt;/p&gt;
&lt;p&gt;&lt;img src=&quot;https://ds7uldi88krbs.cloudfront.net/posts/post_6a7b0b1595f08.png&quot; alt=&quot;Sui Introduces Tessera for Private B2B Stablecoin Settlements&quot; width=&quot;274&quot; height=&quot;300&quot;&gt;&lt;/p&gt;
&lt;h1&gt;How Tessera Protects Corporate Payments&lt;/h1&gt;
&lt;p&gt;Tessera is designed as a closed settlement network for KYC-approved businesses. Participating companies can use a confidential stablecoin to settle invoices while the blockchain continues to record the sender, recipient, and transaction time. The key difference is that the payment amount remains encrypted for outside observers. A supplier and its customer can view the relevant transaction details, but an unrelated company monitoring the network cannot see the value of the payment.&lt;/p&gt;
&lt;p&gt;This structure could help businesses protect sensitive information, including supplier pricing, trade volumes, payroll data, treasury movements, and commercial agreements. Tessera supports both one-time payments and recurring payment channels, making it potentially useful for regular invoices and ongoing business relationships.&lt;/p&gt;
&lt;h1&gt;Compliance Remains Central&lt;/h1&gt;
&lt;p&gt;Tessera is not designed as an anonymous payment network. Access is restricted to verified businesses, while authorized third parties can receive limited access to transaction information when necessary. Seal MPC enables permission-based access to encrypted payment data. For example, a regulator may be allowed to review activity across the network, while a tax authority could receive access only to records connected to a specific company. An arbitrator might be given temporary access to a disputed payment while a commercial disagreement is being resolved.&lt;/p&gt;
&lt;p&gt;According to the available details, these permissions can be scoped, time-limited, and revoked. Authorized viewers can inspect transaction data, but they do not gain the ability to move the underlying funds. This approach is intended to give enterprises privacy without removing auditability and regulatory controls.&lt;/p&gt;
&lt;h1&gt;Sui&amp;rsquo;s Growing Payments Strategy&lt;/h1&gt;
&lt;p&gt;Tessera forms part of Sui&amp;rsquo;s broader push into institutional payments and stablecoin infrastructure. Sui&amp;rsquo;s payments platform highlights subsecond settlement, gasless stablecoin transfers, programmable payment logic, and high-throughput transaction processing. The network currently advertises approximately 300-millisecond finality and capacity of up to 20,000 transactions per second, with a reported 297,000 consensus-based transactions per second under benchmark conditions. Sui&amp;rsquo;s website also reports $36 billion in stablecoin utilization for April 2026.&amp;nbsp;&lt;/p&gt;
&lt;p&gt;The network positions its infrastructure as a way for companies to move stablecoins without managing a separate gas token, while connecting settled capital to wallets, fiat on-ramps, and decentralized finance applications. These features could make Sui attractive for companies seeking faster settlement than traditional correspondent banking systems. Nevertheless, payment speed alone is not enough for institutional adoption. Businesses also require clear legal frameworks, reliable stablecoin liquidity, strong custody systems, and integration with existing accounting and enterprise resource planning software.&lt;/p&gt;
&lt;h1&gt;Prototype Status and Next Steps&lt;/h1&gt;
&lt;p&gt;Tessera remains a prototype, rather than a fully launched commercial network. Sui has not publicly disclosed a launch date, participating companies, stablecoin issuer, or initial deployment jurisdiction. SUI was trading at approximately $0.69 following the announcement, within a reported 24-hour range of roughly $0.684 to $0.704. The token showed no clear price reaction directly linked to the Tessera announcement.&amp;nbsp;&lt;/p&gt;
&lt;p&gt;The project&amp;rsquo;s next major test will be whether Sui can move Tessera from a controlled demonstration to a production-ready solution for regulated companies. If it succeeds, confidential B2B stablecoin settlement could become an important use case for Sui and strengthen its position in the growing institutional payments market.&lt;/p&gt;

Sui Introduces Tessera for Private B2B Stablecoin Settlements

&lt;p&gt;Ethereum co-founder Vitalik Buterin has revealed how the network&amp;rsquo;s priorities have changed since its 2023 roadmap. In an update shared on August 10, 2026, Buterin compared his earlier roadmap with Ethereum&amp;rsquo;s latest development plan, known as the &amp;ldquo;Strawmap.&amp;rdquo; The updated Ethereum roadmap places greater emphasis on quantum-resistant security, native privacy, faster processing, simpler protocol design and new scaling technologies. It also introduces several concepts that were not part of Ethereum&amp;rsquo;s original 2023 plan, highlighting how quickly blockchain research and cryptography have evolved.&lt;/p&gt;
&lt;p&gt;&lt;img src=&quot;https://ds7uldi88krbs.cloudfront.net/posts/post_6a7b079ab50e3.png&quot; alt=&quot;Vitalik Buterin Reveals Updated Roadmap for Ethereum&quot; width=&quot;436&quot; height=&quot;300&quot;&gt;&lt;/p&gt;
&lt;h1&gt;Ethereum&amp;rsquo;s New Strawmap Explained&lt;/h1&gt;
&lt;p&gt;The Strawmap is a living technical document outlining Ethereum&amp;rsquo;s potential upgrades through 2029. It currently includes seven possible network forks, following an approximate schedule of one major upgrade every six months. However, the roadmap is not a fixed release calendar. Each proposal still requires research, testing, developer agreement and community approval before it can be implemented.&lt;/p&gt;
&lt;p&gt;Buterin said the updated plan still shares significant similarities with Ethereum&amp;rsquo;s 2023 roadmap. Nevertheless, some priorities have moved higher or lower, while several earlier proposals have been replaced by newer technical approaches. The latest plan is part of the broader &amp;ldquo;Lean Ethereum&amp;rdquo; vision, which Buterin previously described as a three- to four-year effort to redesign much of the protocol. The project could become Ethereum&amp;rsquo;s most extensive technical transformation since The Merge, which moved the network from proof-of-work to proof-of-stake in 2022.&lt;/p&gt;
&lt;p&gt;&lt;img src=&quot;https://ds7uldi88krbs.cloudfront.net/posts/post_6a7b07d4c19b5.jpg&quot; alt=&quot;Updated Roadmap for Ethereum&quot; width=&quot;251&quot; height=&quot;300&quot;&gt;&lt;img src=&quot;https://ds7uldi88krbs.cloudfront.net/posts/post_6a7b07ee2c9ab.jpg&quot; alt=&quot;Updated Roadmap for Ethereum&quot; width=&quot;398&quot; height=&quot;300&quot;&gt;&lt;/p&gt;
&lt;h1&gt;Privacy Becomes a Core Priority&lt;/h1&gt;
&lt;p&gt;One of the biggest changes is Ethereum&amp;rsquo;s growing focus on native privacy. Privacy was not a major feature of Buterin&amp;rsquo;s 2023 roadmap, but it has now become a central objective for the base layer. Proposed technologies include privacy pools, keyed nonces, recent roots and &amp;ldquo;wormholes.&amp;rdquo; These tools are designed to help users conduct transactions without exposing their complete financial history or publicly linking every wallet activity.&lt;/p&gt;
&lt;p&gt;The goal is not simply to add optional privacy features for specialised applications. Instead, Ethereum developers are exploring ways to make privacy a fundamental part of the protocol while preserving compliance options and preventing misuse. This could be important for businesses, decentralised finance users and institutions that need stronger transaction confidentiality before using public blockchains at scale.&lt;/p&gt;
&lt;h1&gt;Quantum Safety and Advanced Scaling&lt;/h1&gt;
&lt;p&gt;Quantum-resistant cryptography has also moved significantly higher on Ethereum&amp;rsquo;s priority list. Powerful quantum computers do not currently threaten the network, but future machines could challenge cryptographic systems used by blockchains today. Ethereum&amp;rsquo;s roadmap explores post-quantum signatures, hash-based cryptography and STARK-based verification systems. One proposal, known as zkzk frames, could combine post-quantum signatures with STARK aggregation to improve security and scalability. Scaling remains another major objective. The Strawmap&amp;rsquo;s long-term targets include faster finality, a more powerful layer 1 and substantially higher throughput across layer 2 networks. Native rollups, blob and gas futures, multidimensional gas pricing and specialised scaling mechanisms are among the technologies being considered.&lt;/p&gt;
&lt;h1&gt;What the Update Means for ETH Users&lt;/h1&gt;
&lt;p&gt;For users, developers and investors, the updated Ethereum roadmap signals a long-term shift toward a network that is more private, secure, scalable and easier to verify. Buterin summarised Ethereum&amp;rsquo;s future goals as becoming quantum-safe, privacy-focused, secure, censorship-resistant, highly performant and &amp;ldquo;lean.&amp;rdquo; These objectives could strengthen Ethereum&amp;rsquo;s position as infrastructure for decentralised finance, digital identity, tokenised assets and Web3 applications.&lt;/p&gt;
&lt;p&gt;However, the Strawmap should not be interpreted as a promise that every proposal will launch on schedule. Ethereum&amp;rsquo;s development remains research-driven, and priorities may change as testing progresses. For now, the roadmap offers a clear view of the network&amp;rsquo;s direction: privacy and post-quantum security are no longer distant possibilities but central parts of Ethereum&amp;rsquo;s next phase.&lt;/p&gt;

Vitalik Buterin Reveals Updated Roadmap for Ethereum

&lt;p&gt;Bitcoin hardware wallets are considered one of the safest ways to store cryptocurrency because they keep private keys offline. This protects them from many online threats, such as malware, phishing, and exchange hacks. However, the Coldcard hack showed that offline storage is only as secure as the software that creates the wallet&amp;rsquo;s keys. In late July 2026, attackers exploited a weakness in some Coldcard firmware versions and drained Bitcoin from thousands of wallets. Within a few days, estimated losses exceeded $130 million, affecting more than 7,000 wallets. The incident shows that keeping a wallet offline is not enough. Every part of the security process must work properly to keep cryptocurrency safe.&lt;/p&gt;
&lt;p data-pm-slice=&quot;0 0 []&quot;&gt;Note: The Cryptolenz editorial team will continue updating this article as new findings about the Coldcard hack emerge. Last updated on August 7, 2026.&lt;/p&gt;
&lt;h1&gt;Quick Summary&lt;/h1&gt;
&lt;table style=&quot;border-collapse: collapse; width: 100%; height: 185px;&quot; border=&quot;1&quot;&gt;&lt;colgroup&gt;&lt;col style=&quot;width: 50%;&quot;&gt;&lt;col style=&quot;width: 50%;&quot;&gt;&lt;/colgroup&gt;
&lt;tbody&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Category&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Details&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Incident&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Coldcard Hardware Wallet Hack&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Root Cause&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Firmware entropy (random number generation) bug introduced in March 2021&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Attack Method&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Reconstruction of weak wallet seeds and private keys- no physical device access required&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Estimated Losses&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;More than $130 million in Bitcoin&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Affected Wallets&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Approximately 7,000+ addresses&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Bitcoin Network Compromised?&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;No&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Firmware Patched?&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Yes&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Existing Vulnerable Wallets Safe After Update?&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;No - seeds must be regenerated&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Recommended Action&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Generate a brand-new wallet and migrate all funds immediately&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;
&lt;h1&gt;Key Takeaways&lt;/h1&gt;
&lt;p&gt;1. A firmware flaw in Coinkite&#039;s Coldcard hardware wallet weakened the randomness used to generate wallet seeds, tracing back to a March 2021 code change.&lt;/p&gt;
&lt;p&gt;2. Attackers did not need physical access to a device, its PIN, or malware on a victim&#039;s computer; they exploited predictable seed generation to reconstruct private keys from scratch.&lt;/p&gt;
&lt;p&gt;3. Losses are estimated at $130 million+ in Bitcoin across roughly 7,300 addresses, according to Galaxy Research, TRM Labs, and CertiK.&lt;/p&gt;
&lt;p&gt;4. Coinkite has released patched firmware, but existing vulnerable seeds remain at risk until funds are moved to a brand-new wallet.&lt;/p&gt;
&lt;p&gt;5. This is being called one of the worst self-custody security failures in Bitcoin&#039;s history and a wake-up call for how &quot;offline&quot; hardware wallets are actually secured.&lt;/p&gt;
&lt;h1&gt;Table of Contents&lt;/h1&gt;
&lt;p&gt;1. What Happened: The Coldcard Hack, Explained&lt;/p&gt;
&lt;p&gt;2. Timeline of the Attack&lt;/p&gt;
&lt;p&gt;3. Why the Vulnerability Was So Dangerous&lt;/p&gt;
&lt;p&gt;4. Which Coldcard Devices Are Affected?&lt;/p&gt;
&lt;p&gt;5. Where Did the Stolen Bitcoin Go?&lt;/p&gt;
&lt;p&gt;6. Coinkite&#039;s Response&lt;/p&gt;
&lt;p&gt;7. What Should Coldcard Users Do Now?&lt;/p&gt;
&lt;p&gt;8. Does This Affect Other Hardware Wallets?&lt;/p&gt;
&lt;p&gt;9. Security Lessons for Every Crypto Investor&lt;/p&gt;
&lt;h1&gt;What Happened&lt;/h1&gt;
&lt;p&gt;The Coldcard hack wasn&#039;t an attack on Bitcoin itself, and it wasn&#039;t a case of someone physically stealing a device out of a safe. It was something far more unsettling for self-custody advocates: a software bug that made supposedly random wallet seeds predictable.&lt;/p&gt;
&lt;p&gt;Coldcard, made by Canadian company Coinkite, is one of the most popular Bitcoin-only hardware wallets on the market prized precisely because it&#039;s designed to generate and store private keys entirely offline. That&#039;s what made this incident so damaging: the flaw meant an attacker sitting anywhere in the world could reconstruct a victim&#039;s private keys without ever touching their device.&lt;/p&gt;
&lt;p&gt;Coinkite&#039;s core message to users: &quot;Updating your firmware alone does not make an existing wallet safe.&quot;&lt;/p&gt;
&lt;p&gt;Coinkite traced the root cause to a firmware and library migration made in March 2021. During that update, the process used to generate wallet seeds was unintentionally rerouted away from Coldcard&#039;s dedicated hardware random-number generator and toward a much weaker software-based fallback. On the oldest affected models, researchers estimate the effective randomness collapsed from an intended 128 bits down to roughly 40 bits, the difference between a computationally impossible brute-force attack and a feasible one. The bug sat undetected inside trusted firmware for more than five years before attackers began exploiting it at scale.&lt;/p&gt;
&lt;h2&gt;Timeline of the Attack&lt;/h2&gt;
&lt;table style=&quot;border-collapse: collapse; width: 100%; height: 74px;&quot; border=&quot;1&quot;&gt;&lt;colgroup&gt;&lt;col style=&quot;width: 50%;&quot;&gt;&lt;col style=&quot;width: 50%;&quot;&gt;&lt;/colgroup&gt;
&lt;tbody&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Date&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Development&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;March 2021&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Vulnerable firmware/library migration introduced (root cause)&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;July 29 - 31, 2026&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;First large-scale sweeps detected; 1,082 BTC drained from 1,196 addresses in 41 minutes, Coinkite CEO Rodolfo Novak publicly urges all users to move funds immediately&lt;/td&gt;
&lt;/tr&gt;
&lt;tr style=&quot;height: 18.5px;&quot;&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Aug 2 - 7&lt;/td&gt;
&lt;td style=&quot;height: 18.5px;&quot;&gt;Losses climb to 1,367 BTC from 4,500+ addresses ($89M), TRM Labs ties losses to 1,816 BTC from 5,200+ addresses ( $116M), Galaxy Research and CertiK estimates surpass $130M across 7,300 wallets&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;
&lt;p&gt;The scale and speed of the very first sweep suggested the attacker had already built a large database of cracked seeds and private keys before the theft even began. Because some victims still haven&#039;t discovered their funds are gone, and investigators are still separating the original exploit from copycat activity, the final total is expected to keep climbing.&lt;/p&gt;
&lt;h2&gt;Why the Vulnerability Was So Dangerous&lt;/h2&gt;
&lt;p&gt;A standard 12-word Bitcoin seed is designed to carry about 128 bits of entropy, a number so astronomically large that guessing it is considered computationally impossible with any existing technology.&lt;/p&gt;
&lt;p&gt;The Coldcard flaw shattered that assumption for affected devices:&lt;/p&gt;
&lt;p&gt;1. Mk2 and Mk3 models: effective security fell to roughly 40 bits&lt;/p&gt;
&lt;p&gt;2. Mk4, Mk5, and Q models: partially protected by additional secure-element entropy, but still estimated at only around 72 bits instead of the intended 128&lt;/p&gt;
&lt;p&gt;Forty bits might sound like a lot, but in cryptographic terms it&#039;s a completely different category of problem. With enough computing power and knowledge of how the flawed seed-generation process worked, attackers could systematically generate candidate seeds, check them against known Bitcoin balances, and derive working private keys, all without needing the physical wallet.&lt;/p&gt;
&lt;h2&gt;The Technical Root Cause&lt;/h2&gt;
&lt;p&gt;The bug traces to a 2021 migration in which Coldcard moved its elliptic-curve cryptography to Bitcoin Core&#039;s widely trusted &amp;ldquo;libsecp256k1&amp;rdquo; library, using a new embedded library called &amp;ldquo;libNgU&amp;rdquo;. As part of that change, seed generation shifted from Coldcard&#039;s device-specific hardware RNG call to a generic software function that, due to a build configuration error, silently fell back to a weak pseudo-random number generator instead of the intended hardware entropy source. Because both the correct hardware RNG code and the flawed fallback code existed side-by-side in the firmware, the bug was easy to miss during code review; anyone auditing the source could see the secure code path without realizing wallet seeds never actually reached it.&lt;/p&gt;
&lt;h2&gt;Which Coldcard Devices Are Affected?&lt;/h2&gt;
&lt;table style=&quot;border-collapse: collapse; width: 100%;&quot; border=&quot;1&quot;&gt;&lt;colgroup&gt;&lt;col style=&quot;width: 33.3333%;&quot;&gt;&lt;col style=&quot;width: 33.3333%;&quot;&gt;&lt;col style=&quot;width: 33.3333%;&quot;&gt;&lt;/colgroup&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;Device / Firmware Track&lt;/td&gt;
&lt;td&gt;Vulnerable Versions&lt;/td&gt;
&lt;td&gt;Fixed Version&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Coldcard Mk2 / Mk3&lt;/td&gt;
&lt;td&gt;4.0.1 &amp;ndash; 4.1.9&lt;/td&gt;
&lt;td&gt;4.2.0+&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Coldcard Mk4 / Mk5 (standard)&lt;/td&gt;
&lt;td&gt;Before 5.6.0&lt;/td&gt;
&lt;td&gt;5.6.0+&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Coldcard Mk4 / Mk5 (Edge)&lt;/td&gt;
&lt;td&gt;Before 6.6.0X&lt;/td&gt;
&lt;td&gt;6.6.0X+&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Coldcard Q (standard)&lt;/td&gt;
&lt;td&gt;Before 1.5.0Q&lt;/td&gt;
&lt;td&gt;1.5.0Q+&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Coldcard Q (Edge)&lt;/td&gt;
&lt;td&gt;Before 6.6.0QX&lt;/td&gt;
&lt;td&gt;6.6.0QX+&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;
&lt;p&gt;Coinkite has confirmed that original Mk1 devices, along with TAPSIGNER, OPENDIME, and SATSCARD, run on different codebases and were not affected.&lt;/p&gt;
&lt;p&gt;Important: Updating your firmware today does not retroactively fix a seed that was already generated on vulnerable firmware. It only ensures any new seed you generate going forward is secure.&lt;/p&gt;
&lt;h2&gt;Where Did the Stolen Bitcoin Go?&lt;/h2&gt;
&lt;p&gt;Early on, blockchain analysts observed that most of the stolen Bitcoin was being consolidated into a relatively small number of attacker-controlled wallets, with little evidence of laundering. That began to shift by early August: on-chain trackers at CertiK identified roughly 64 BTC connected to the exploit moving through the Bitcoin mixing service Wasabi, along with around 200 ETH tied to related activity flowing into Tornado Cash. No single group has been publicly identified as responsible, and differing transaction patterns across the various attack waves suggest multiple independent actors, possibly including copycats who reverse-engineered the vulnerability after Coinkite&#039;s public disclosure.&lt;/p&gt;
&lt;h1&gt;Coinkite&#039;s Response to the Coldcard Hardware Wallet Hack&lt;/h1&gt;
&lt;p&gt;Following discovery of the vulnerability, Coinkite publicly acknowledged the issue and released a detailed technical explanation of how the bug occurred. The company emphasized that the incident was not caused by a compromise of Bitcoin itself or a breach of Coldcard&#039;s infrastructure; it stemmed from an entropy-generation error introduced during the 2021 firmware migration.&lt;/p&gt;
&lt;p&gt;To limit further damage, Coinkite has:&lt;/p&gt;
&lt;p&gt;1. Released patched firmware for all affected product lines&lt;/p&gt;
&lt;p&gt;2. Published technical documentation explaining the vulnerability&lt;/p&gt;
&lt;p&gt;3. Halted shipments of devices running vulnerable firmware&lt;/p&gt;
&lt;p&gt;4. Removed remaining vulnerable inventory from distribution&lt;/p&gt;
&lt;p&gt;5. Coordinated with blockchain security researchers and industry partners&lt;/p&gt;
&lt;p&gt;6. Begun working with law enforcement agencies investigating the theft&lt;/p&gt;
&lt;p&gt;Coinkite has also acknowledged it was unaware of the defect prior to the attacks, noting that the bug may have ultimately surfaced through AI-assisted code review even though the company&#039;s own internal AI-assisted audit earlier in 2026 failed to catch it.&lt;/p&gt;
&lt;h1&gt;What Should Coldcard Users Do Now?&lt;/h1&gt;
&lt;p&gt;If you generated a wallet on affected firmware, assume the recovery seed could eventually be reconstructed by an attacker even if your wallet hasn&#039;t been targeted yet. Migrating to a new wallet is the safest course of action.&lt;/p&gt;
&lt;p&gt;Step 1: Stop Using the Existing Wallet&lt;/p&gt;
&lt;p&gt;Do not send any new Bitcoin to addresses derived from the old seed. Every additional deposit increases your potential exposure.&lt;/p&gt;
&lt;p&gt;Step 2: Install the Latest Firmware&lt;/p&gt;
&lt;p&gt;Download and install the latest official firmware for your specific Coldcard model, obtained only from Coinkite&#039;s official channels.&lt;/p&gt;
&lt;p&gt;Step 3: Generate a Brand-New Wallet&lt;/p&gt;
&lt;p&gt;Create an entirely new recovery seed using the updated firmware, which uses the corrected entropy-generation process.&lt;/p&gt;
&lt;p&gt;Step 4: Verify the Backup&lt;/p&gt;
&lt;p&gt;Before transferring funds, confirm every recovery word, verify the wallet fingerprint and check the first receiving address displayed on the device. Small mistakes during backup can permanently lock you out of your Bitcoin.&lt;/p&gt;
&lt;p&gt;Step 5: Test the New Wallet&lt;/p&gt;
&lt;p&gt;Before moving your entire balance, send a small test amount of Bitcoin, wait for confirmations, verify the transaction arrived correctly and confirm you can access the new wallet&lt;/p&gt;
&lt;p&gt;Step 6: Transfer All Funds&lt;/p&gt;
&lt;p&gt;Once testing succeeds, move your remaining Bitcoin, double-check the destination address on the Coldcard screen and wait until every transaction is confirmed. Once complete, stop using addresses associated with the old seed entirely.&lt;/p&gt;
&lt;p&gt;Step 7: Keep the Old Recovery Phrase Safe (But Unused)&lt;/p&gt;
&lt;p&gt;Don&#039;t destroy your old seed immediately; it may still be useful for verifying historical transactions, supporting insurance or legal claims, or assisting investigations. However, never enter the old recovery phrase into a website, software wallet, browser extension, or smartphone app.&lt;/p&gt;
&lt;h1&gt;Does This Affect Other Hardware Wallets Like Ledger or Trezor?&lt;/h1&gt;
&lt;p&gt;No, based on current evidence. There is no indication this firmware vulnerability impacted other popular hardware wallets, including:&lt;/p&gt;
&lt;p&gt;1. Ledger&lt;/p&gt;
&lt;p&gt;2. Trezor&lt;/p&gt;
&lt;p&gt;3. BitBox&lt;/p&gt;
&lt;p&gt;4. Blockstream Jade&lt;/p&gt;
&lt;p&gt;5. Bitkey&lt;/p&gt;
&lt;p&gt;The vulnerability was tied to a specific firmware and build-integration path used only by certain Coldcard devices. That said, the incident is a reminder that every hardware wallet depends on more than secure hardware. Firmware quality, cryptographic implementation, testing procedures, and software supply-chain security are all essential parts of a secure self-custody solution.&lt;/p&gt;
&lt;h1&gt;Security Lessons Every Crypto Investor Should Learn&lt;/h1&gt;
&lt;p&gt;1. Offline Doesn&#039;t Mean Invulnerable&lt;/p&gt;
&lt;p&gt;Keeping private keys offline protects against many common threats, but it doesn&#039;t eliminate every risk. If the seed is generated incorrectly, an attacker may never need physical access to the device.&lt;/p&gt;
&lt;p&gt;2. Randomness Is the Foundation of Wallet Security&lt;/p&gt;
&lt;p&gt;Every Bitcoin wallet ultimately depends on one thing: a truly unpredictable recovery seed. Weak entropy can undermine even the most advanced hardware security features.&lt;/p&gt;
&lt;p&gt;3. Firmware Matters as Much as Hardware&lt;/p&gt;
&lt;p&gt;Users often focus on the physical device while overlooking firmware updates. Always install security updates promptly and monitor announcements from wallet manufacturers.&lt;/p&gt;
&lt;p&gt;4. Follow Official Security Advisories&lt;/p&gt;
&lt;p&gt;Security researchers and wallet manufacturers regularly publish vulnerability disclosures. Subscribing to official updates can help you respond quickly if a new issue is discovered.&lt;/p&gt;
&lt;p&gt;5. Consider Multisignature for Large Holdings&lt;/p&gt;
&lt;p&gt;Investors managing significant Bitcoin holdings may benefit from a multisignature (multisig) setup. By requiring approvals from multiple independent devices, multisig reduces reliance on any single hardware wallet or firmware implementation. It&#039;s more complex to manage, but it adds meaningful protection against single points of failure.&lt;/p&gt;

Coldcard Hardware Wallet Hack 2026

&lt;p class=&quot;mb-2 text-sm text-gray-800&quot;&gt;In partnership with Oxbull - Cryptobuddy community members will get &lt;span class=&quot;text-blue-900 font-bold&quot;&gt;10&lt;/span&gt; exclusive whitelist spots (Tier 3) for the upcoming IDO.&lt;/p&gt;&lt;p class=&quot;mb-2 text-sm text-gray-800&quot;&gt;MetaFighter is a skill-based Play-to-Earn fighting game in Binance Smart Chain Network which captures the essence of arcade fighting classics like Street Fighter, Virtua Fighter and Soul Calibur, while delivering an in -game economy that rewards players for their combat prowess. Launching on Oxbull with &lt;span class=&quot;text-blue-900 font-bold&quot;&gt;130K&lt;/span&gt; initial market cap&lt;/p&gt;

Uponly × Cryptobuddy Airdrop Giveaway

In partnership with Oxbull - Cryptobuddy community members will get 10 exclusive whitelist spots (Tier 3) for the upcoming IDO.MetaFighter is a skill-based Play-to-Earn fighting game in Binance Smart Chain Network which captures the essence of arcade fighting classics like Street Fighter, Virtua Fighter and Soul Calibur, while delivering an in -game economy that rewards players for their combat prowess. Launching on Oxbull with 130K initial market cap

MetaFighter Oxbull IDO - Whitelist for Cryptobuddy Community

In partnership with Oxbull - Cryptobuddy community members will get 10 exclusive whitelist spots (Tier 3) for the upcoming IDO.Fantom Pad has developed the first Hybrid Incubator-DEX built on the Fantom network, creating a safer, seamless environment for all emerging projects. Launching on Oxbull with 144K initial market cap

FantomPad Oxbull IDO - Whitelist for Cryptobuddy Community

FantomPad

Oxbull

Cryptobuddy

CryptobuddyAnnouncement

In partnership with Oxbull - Cryptobuddy community members will get 10 exclusive whitelist spots (Tier 3) for the upcoming IDO.Shark Race Club is an interesting and unique NFT play-to-earn racing game that is featuring a variety of Shark NFT Characters. Launching on Oxbull with 328K initial market cap

Shark Race Club Oxbull IDO - Whitelist for Cryptobuddy Community

SharkRace Club

In partnership with Oxbull - Cryptobuddy community members will get 10 exclusive whitelist spots (Tier 3) for the upcoming IDO.Crimecash is a game where you can buy weapons and loot other players. Crimecash is launching on Oxbull

CrimeCash Oxbull IDO - Whitelist for Cryptobuddy Community

CrimeCash

XYRO is an AI-powered gamified trading platform that leverages gamification and social features to redefine crypto, making it accessible and engaging. &nbsp; &nbsp; &nbsp; XYRO operates in the rapidly growing and high-potential gamified social trading and Web3 space, leveraging both AI and gamification to drive user engagement. By combining advanced AI insights with engaging gamified experiences, the platform becomes more intuitive, accessible, and appealing to a wide range of users. &nbsp; &nbsp; &nbsp; XYRO is an AI-powered, fully decentralized platform that combines gamification and social trading, making crypto participation engaging and accessible for both newcomers and experienced traders.

Zaya AI works on combating cancer through an innovative ecosystem. By seamlessly integrating the latest AI technologies with state-of-the-art medical screening procedures, they strive to revolutionize early detection, prevention, and treatment strategies. This comprehensive approach holds the promise of saving countless lives by identifying and addressing malignancies at their earliest stages when intervention is most effective.

Base

DTRXBT by Virtuals is a token on the Base blockchain that grants holders access to exclusive AI-generated insights from the Decentralized Tech Researchers (DTR) alpha group, using advanced algorithms to find high-probability market signals.

Cryptocurrency Information Aggregator & Research Platform

Trending Cryptocurrencies

Airdrops

IDO/ICO Events

Upcoming

Recently Added

Closed

Fear and greed index

Our Articles

US Treasury Proposes GENIUS Act Stablecoin Rules

South Korea Blocks Access to Polymarket

Robinhood Is Rolling Out AI Agent-Powered Crypto Trading

Sui Introduces Tessera for Private B2B Stablecoin Settlements

Vitalik Buterin Reveals Updated Roadmap for Ethereum

Coldcard Hardware Wallet Hack 2026

Subscribe to Newsletter

Company

Quick Links

Community

Company

Quick Links

Community