A Coldcard hardware wallet user was hacked for about 30 BTC, with 17 BTC moved via THORChain and swapped into 229.72 ETH (about $445,000) before being deposited into offshore gambling platform Duelcom Casino. The victim and a researcher emailed all known Duelcom Casino addresses with transaction details and requested the funds be frozen. Duelcom Casino replied that it would only act if contacted directly by police. The incident highlights gaps in how downstream centralized services enforce KYC/AML and respond to cross-chain fund flows.

The U.S. Securities and Exchange Commission paused its conditional approval of Nasdaq’s Phlx cash-settled bitcoin index options, ticker QBTC, which had been granted on an expedited basis in May. The move follows a petition from CME Group challenging whether the product should fall under the Commodity Futures Trading Commission rather than the SEC. The SEC has opened a public comment period that runs through August 24, while the commission reviews the petition. QBTC is designed to track the Nasdaq Bitcoin Index, which is derived from the CME CF Bitcoin Real Time Index.

Security researcher Dustin Dettmer traced the COLDCARD hardware wallet’s firmware commit history to confirm how a flaw was introduced that has been described as one of the most serious bugs in Bitcoin self-custody in recent years. The issue directly affects users’ ability to maintain full control over their private keys. It also threatens the security of cold storage built on Bitcoin’s UTXO model, according to Dettmer.

BNB Chain said a former employee created a wallet address internally for a video tutorial and later used it to generate a token. After leaving the company, the individual allegedly retained unauthorized access to the address’s seed phrase and used it to generate a new private key and issue a meme token independently. BNB Chain said it did not create, authorize, promote, or participate in the token’s creation and has no control over the token or the wallet address. The company said it is pursuing legal action and is cooperating with relevant authorities.

Hackers tampered with an Adform third-party script and inserted malicious logic across multiple customer-run websites, silently replacing wallet addresses when users copy them. The incident was not aimed at any specific blockchain and could affect web-based address entry for transfers of crypto assets including Bitcoin (BTC), Ethereum (ETH) and TRON (TRX). It underscores the severity of front-end supply-chain attacks and is a cross-site wallet hijacking case, with no disclosed loss amount or count of affected sites.

Uniswap said on 2026年8月1日 that it has launched Earn in its web app and wallet, allowing users to earn yield on USDC, USDT and ETH without lockups. The feature is provided through Uniswap’s native protocol layer and does not require third-party integrations. Users can deposit and withdraw principal at any time while receiving yield in real time. The launch underscores Uniswap’s push beyond a trading-only protocol toward a broader DeFi yield platform, strengthening its protocol revenue model and token-economy loop.

Bitcoin Core developer Peter Todd issued a security warning following the theft of a Coldcard hardware wallet, arguing that any bitcoin stored under a single-signature (singlesig) setup faces a fundamental security weakness. He said the incident was not a software exploit but a physical theft, highlighting how fragile private-key custody can be in singlesig arrangements. While no stolen amount or addresses were disclosed, the warning targets the most common form of personal self-custody and could prompt users to consider multisig or threshold-signature alternatives.

About 4,000 bitcoins—worth roughly $40 million at the time—were stolen after 500 Coldcard hardware wallets were compromised, according to a news alert. Coldcard, an open-source Bitcoin cold-storage device widely considered trusted, was hit by a flaw that unexpectedly exposed users’ offline private keys. The stolen funds have been moved to an unknown address, and on-chain tracking is ongoing. The incident did not involve an exchange or custodial platform, prompting renewed scrutiny of hardware wallet firmware updates, physical side-channel protections, and seed-phrase backup procedures.