Coldcard Flaw Leads to Theft of 1,816 BTC from Hardware Wallet Users

A roundup of the week's most important developments in blockchain and crypto. Hardware wallets are widely seen as the gold standard for Bitcoin storage because they stay offline. This week underscored a hard lesson: offline alone is not enough. A weakness on Coldcard devices from Coinkite traced back to key generation. With the hardware random number generator disabled, the firmware fell back on weak entropy sources—the microcontroller's serial number, a system counter, and realtime clock registers. Because these inputs are not secret, the resulting private keys were far more predictable than they should have been. Seeds generated since March 2021 on models Mk2 through Q are affected. Attackers drained roughly 1,816 BTC (about USD 116 million) from more than 4,500 addresses across several waves. Coinkite released fixed firmware, stopped shipments, and destroyed vulnerable inventory. The incident has still shaken confidence in both the brand and hardware wallets more broadly. Coldcard vulnerability enables Bitcoin theft A Coldcard vulnerability made the Bitcoin keys of affected hardware wallets computable. Around 1,367 BTC have flowed out so far. US Senate pushes the crypto market bill into the fall The Digital Asset Market Clarity Act is not expected to reach a vote before the summer recess. Majority Leader John Thune has not scheduled a cloture vote, and the bill remains about ten votes short of the 60 needed. The House of Representatives passed the text in July 2025 by 294 to 134. Senate committees acted only in January and May 2026 after repeated delays. The proposal would give the CFTC primary authority over digital commodities, while the SEC would retain oversight of securities. Three issues are holding up the package: Senators Ruben Gallego and Thom Tillis want to bar federal officials and their spouses from holding their own tokens; Senator Catherine Cortez Masto argues the anti-money-laundering language is too weak; Cory Booker is also negotiating over the Agriculture Committee's text. Senate aides describe talks as stalled and point to September as a realistic next window. Until then, only interpretive guidance from the SEC and CFTC is in place, which could be withdrawn by a future administration. Clarity Act stalls in the Senate before the summer recess The Senate has scheduled no cloture vote on the Clarity Act before the summer recess. Ethics and money laundering concerns remain unresolved. Justin Drake proposes tapering Ethereum staking rewards toward zero issuance While US lawmakers debate oversight, Ethereum governance is weighing a protocol-level shift. Researchers around Justin Drake at the Ethereum Foundation are floating a plan to progressively burn staking rewards. The draft, called Tapered Issuance Burn, has been circulating since mid-July, with forum discussion active since early August. Under the proposal, net issuance would decline to zero once about 50% of ETH supply is staked—roughly 60.25 million ETH. About 40 million ETH is currently staked, and consensus-layer yield is around 2.62% annually. After an 18-month rollout, roughly 1.2% of today's level would remain. Coauthor Jérôme de Tychey argues delaying changes until after the threshold is crossed would require correcting a much larger imbalance. Critics across the industry say the Ethereum Foundation is overlooking knock-on effects in DeFi and that validators are already being asked to do more work for limited compensation at a 2.62% yield. Ethereum researchers want to burn staking rewards gradually An EIP draft would burn staking rewards on Ethereum and cut net issuance to zero once 60.25 million ETH sit in the validator set. Strategy supports balance-sheet restructuring with Bitcoin sales The largest public holder of Bitcoin continues to trim its position. Strategy (formerly MicroStrategy) sold 1,638 BTC for about USD 104.73 million in the week through early August, at an average price of USD 63,957 per Bitcoin. Holdings now total 842,138 BTC, valued at roughly USD 52.6 billion. The company acquired them for about USD 63.5 billion, implying an unrealized loss near USD 11 billion. Management is using proceeds to reshape the capital structure: Strategy lifted its dollar reserves to USD 4 billion and repurchased STRC preferred shares at an 11% discount to par. The actions are tied to the Digital Credit Capital Framework announced in June, totaling USD 2 billion. Pressure remains evident: the company posted a net loss of USD 8.22 billion in Q2, and the stock is down 75% over the past 12 months. CEO Phong Le framed the shift as moving from accumulation to ongoing capital structure management. Strategy sells USD 104 million in Bitcoin for capital restructuring Strategy sells Bitcoin worth around USD 104.73 million, issues 3.01 million new shares and buys back STRC preferred stock at a discount. Mastercard brings stablecoin settlement in-house Mastercard completed its acquisition of stablecoin payments provider BVNK in early August. The deal values BVNK at USD 1.5 billion, plus performance-based earnouts of up to USD 300 million, making it the largest acquisition in the segment so far, ahead of Stripe's USD 1.1 billion purchase of Bridge. BVNK was founded in London in 2021 and, as of end-2025, processed about USD 30 billion in annual payment volume across more than 130 countries. Customers include Worldpay, Deel and dLocal. Regulation is a key driver: BVNK brings an EU e-money license and MiCA authorization granted in February. Mastercard plans to integrate the technology across four areas, including B2B payments, remittances and corporate treasury flows. The acquisition builds on Mastercard's crypto partner program launched in March and its recent rollout of card settlement in USDC, PYUSD and RLUSD. Mastercard closes BVNK acquisition worth up to USD 1.8 billion The Mastercard BVNK acquisition, worth up to USD 1.8 billion, expands the card network's stablecoin infrastructure for B2B payments. Want this weekly review delivered to your inbox every Saturday? Subscribe to the CVJ.CH Newsletter. Email address: