News linked to this event type.
Galaxy Digital Head of Research Alex Thorn stated that based on new victim reports received following the incident, the number of attackers exploiting the Coldcard vulnerability has reached at least 15.Thorn noted that information provided by victims helped the research team uncover previously unidentified attack activity. Unlike thefts from centralized exchanges, correlations between the attackers in this vulnerability exploit require confirmation through on-chain analysis and victim feedback.He added that a single victim reporting less than 1 BTC stolen helped the team discover a previously unknown attack, which siphoned approximately 12 BTC from 126 addresses.According to Galaxy Research's earlier estimates, the Coldcard vulnerability has led to at least three rounds of attacks, with losses amounting to approximately $100 million in BTC. Additionally, Galaxy has identified a suspected fourth round of attacks, which could bring total losses to approximately $130 million.Meanwhile, the incident has also sparked discussions regarding the security of Bitcoin self-custody. Dragonfly Managing Partner Haseeb Qureshi stated that "AI security hardening costing around $2" could potentially have prevented this vulnerability, and noted that some AI models were able to rediscover related vulnerabilities within a relatively short timeframe. However, industry insiders pointed out that current claims about the speed of AI discovering vulnerabilities lack rigorous blind testing and verification.Researchers believe that as AI model capabilities improve, the costs of vulnerability discovery and attacks in the crypto industry may continue to decline, requiring wallet developers to further strengthen code audits and security protections. (Cointelegraph)
According to TechCrunch, Apple Inc. has formally applied for a preliminary injunction against OpenAI, requiring it to stop developing AI devices and related products based on Apple technology. Apple's latest investigation shows that, in addition to Senior Systems Engineer Chang Liu and Chief Hardware Officer Tang Yew Tan named in the previous complaint, another 11 former Apple employees may be involved in trade secret theft, with some having privately retained work equipment issued by Apple upon departure. Apple has simultaneously applied for an expedited discovery process, involving parties including OpenAI, its foundation, and the device startup io co-founded by Jony Ive. In response, OpenAI publicly stated that Apple's allegations are "based on misinformation and completely unnecessary," and counterclaimed that Apple has security procedure vulnerabilities, resulting in former employees still being able to access its internal systems.
Odaily News: Apple has limited the number of vulnerability reports a single researcher can submit at one time because its security team has received a large number of submissions generated by AI, many of which do not actually contain real flaws. Apple stated that researchers can request a higher limit at any time, and the company is also using AI internally to triage submissions.Bynario, a Milan-based cybersecurity startup, said it used OpenAI's ChatGPT to discover more than 50 vulnerabilities in the latest version of macOS within three weeks, including a privilege escalation chain that could give attackers full control of a Mac device.Bynario stated that it was unable to report this vulnerability because Apple had already rejected further submissions. Bynario CEO Alfredo Pesoli estimated the vulnerability's value on the criminal market at $100,000 to $200,000. Apple said it has reached out to the company and reviewed its work. In June, Apple added a submission cap and a 30-day cooldown period to its security portal. In a recent security update, Apple listed vulnerabilities discovered with the assistance of Anthropic and OpenAI software, with the number of fixes approximately five times that of a normal cycle. (Decrypt)
: Crypto infrastructure company BitGo will switch its exclusive cross-chain service provider for $7.3 billion worth of WBTC from LayerZero to Chainlink CCIP. Following the $292 million cross-chain bridge exploit at Kelp, multiple projects have announced migrations from LayerZero to Chainlink, with disclosed migration volumes totaling $14.5 billion. BitGo will use CCIP for future assets while retaining control over token contracts, rate limits, and transfer settings.
According to CoinDesk, the 30-day implied volatility index BVIV, which measures expected volatility in the Bitcoin options market, has continued to decline, now falling to 36%, the lowest level since May 31, significantly down from the high near 60% in early June. Recent influencing factors include the Coldcard wallet attack incident involving tens of millions of dollars, weak institutional demand, and uncertainty in the regulatory and macroeconomic environment, but there are no obvious signs of panic in the market. However, volatility has mean-reverting characteristics. When the indicator falls to historical lows, a rebound often follows. Currently, BVIV has approached levels that have previously formed support multiple times. If volatility rebounds quickly in the future, it may be accompanied by a significant directional move in Bitcoin; whether up or down, traders need to remain vigilant.
According to CNBC, the European Commission officially gained the power to investigate, restrict, and fine AI models this Sunday, marking the latest progress in the phased implementation of the 2024 EU AI Act. Under the new rules, the European Commission can require AI companies to submit assessments before publicly releasing models in Europe and has the authority to restrict their EU market access. Violating companies face fines of up to €15 million or 3% of annual turnover (whichever is higher). The new rules apply to all companies providing general-purpose AI models within the EU, regardless of their headquarters' location, and non-EU companies must designate an authorized representative within the EU. Anthropic, OpenAI, and Google are all covered by the new rules. Currently, the EU has been seeking access to Anthropic's Mythos model for several months and has entered into negotiations with OpenAI and Anthropic regarding cyber attack issues triggered by their AI models.
Odaily News: Hardware wallet manufacturers Trezor and Foundation have warned that following the disclosure of a Coldcard firmware vulnerability, phishing attempts targeting hardware wallet holders have increased, with attackers soliciting recovery phrases and luring victims into downloading malware. Security firm Proofpoint has detected phishing emails impersonating Coldcard, inviting users to complete a "hardware audit" with links to a cloned website. After clicking, users download a batch file hosted on GitHub that installs the remote access tool ScreenConnect. Proofpoint stated that the fraudulent website also features a customer service chat window, where real people guide victims through the installation process. This remote access tool can provide attackers with a pathway to steal data and funds, or further deploy malicious programs such as ransomware. Galaxy Research has confirmed three rounds of theft since July 30, with high-confidence losses of 1,596 BTC, exceeding $100 million; if a fourth round not yet confirmed with victims is included, total losses could reach $130 million.
Odaily News: OpenAI has issued a statement responding to Apple's previously filed trade secret lawsuit, calling Apple's allegations "hasty, aggressive, and factually flawed," and released email records as supporting evidence. OpenAI stated that Apple previously claimed it had contacted the company in February and received no response, but in reality, Apple's external counsel had sent the email to the wrong recipient due to a name mix-up. Additionally, Apple also acknowledged that it had not engaged in any relevant communication with OpenAI's General Counsel.Apple previously accused OpenAI of obtaining confidential information through former Apple employees Chang Liu and Tang Tan. OpenAI denied the allegations and stated that Apple employees proactively sought advice from Liu on documents and technical issues after his departure, because Apple had failed to promptly revoke the departed employees' system access. (Business Insider)
According to Onchain Lens monitoring, COLDCARD users have experienced another incident of stolen funds, with over 5,200 affected addresses seeing approximately 1,816 BTC stolen, worth around $114 million. The confirmed first to third waves involve 1,367.05 BTC, valued at approximately $88.6 million. The fourth wave, matching a pattern, involves 462 potential victims, adding 388.93 BTC. Onchain Lens is currently identifying associated clusters based on on-chain data. As of now, the attacker has not yet moved the stolen funds. The cluster remains active, with the latest transaction recorded just minutes ago.
According to CNN reports, U.S. Democratic Senators Warren and Blumenthal have requested the U.S. Securities and Exchange Commission (SEC) to investigate the "TRUMP" Meme coin issued by Trump to confirm whether the project involves fraud or improper profit. In a letter to SEC Chairman Paul Atkins, the two stated that the Trump Meme coin project "may constitute an illegal scam," and requested the regulatory agency to investigate whether the token involves "illegal fraudulent conduct or facilitates improper profit acquisition." Warren and Blumenthal focused in the letter on whether the project resembles a "Rug Pull" (exit scam) in the crypto industry. They believe that even if it is not a sudden divestiture-style rug pull in the traditional sense, it may still belong to a "soft rug pull" that causes investor losses by gradually withdrawing market support. The SEC should investigate whether the Trump Meme coin poses fraud risks and prevent investors from continuing to suffer losses. As of now, the SEC has not commented on this.
Binance founder Changpeng Zhao stated that from a statistical perspective, storing crypto assets on exchanges may be safer than self-custody, but provided that the relevant data is accurate. He pointed out that data regarding exchanges being hacked is easier to collect and publicize, while theft or loss incidents in self-custody scenarios are often not fully disclosed, therefore statistical results may be biased.
According to Chainalysis, Hexagate detected that the LpdFi protocol suffered an attack of approximately $700,000. The attacker first utilized approximately $44 million in flash loans to artificially inflate the price of LPD tokens on decentralized exchanges to approximately 71 times, subsequently using only approximately $2 million worth of tokens to forge approximately $140 million in deposit positions within the protocol.
Odaily News – On August 3 local time, U.S. President Trump answered reporters' questions at the White House, stating that negotiations with Iran are currently underway. Trump said that regarding talks with Iran, the first phase is the reopening of the Strait of Hormuz, and the second phase is denuclearization. Trump emphasized that the U.S. maintains a firm stance: Iran cannot possess nuclear weapons. Additionally, Trump disclosed progress in the negotiations concerning the reopening of the Strait of Hormuz. Trump stated that the Strait of Hormuz could potentially be reopened as soon as tomorrow. He also noted that the talks were initiated at Iran's request, with support from Saudi Arabia, the UAE, Qatar, and several other countries. He said that originally, "the U.S. was going to strike Iran with overwhelming force—more severe than any previous attack," but then Iran called, and Saudi Arabia, the UAE, and Qatar also called. Iran did not want to be hit, so it said it wanted to negotiate; they wanted to discuss the issue of the strait. Trump said, "This is Iran's last chance." Trump also said he would not allow Iran to charge fees for vessels passing through the Strait of Hormuz. (CCTV News)
Odaily News: FBI agent Patrick Yaroch was arrested last Friday for allegedly stealing approximately $1 million in crypto assets from a "hostile crypto account." According to an affidavit filed on August 1, Yaroch is suspected of transferring the assets starting around late 2024 or early 2025.Yaroch told investigators that he discovered certain keys that allowed him to transfer funds from digital wallets to himself. He claimed he was frustrated by his inability to further prevent individuals associated with "hostile nations" from using cryptocurrency, and conducted approximately a dozen transfers.Department of Justice documents show that Yaroch admitted to a DOJ employee that he had "made some very bad decisions" regarding crypto wallet issues. In another interview with federal agents, he also admitted that he had "screwed up."Yaroch previously served as a supervisory special agent in the FBI's Counterintelligence and Espionage Division at headquarters, and earlier worked at the FBI's Boston field office. The FBI terminated his employment on July 31.The investigation also alleges that Yaroch mixed personal funds with crypto assets and used ChatGPT to ask how to handle the funds, including how to spend or invest $1 million, and whether to leave the U.S. for a European country.
Odaily Planet Daily Report: Bitcoin hardware wallet manufacturer Coinkite disclosed in late July 2026 that a firmware build error introduced in March 2021 caused some Coldcard wallets to generate mnemonics from a smaller range, reducing the randomness of user private keys. Galaxy Research analysts stated that the Coldcard exploit occurred in multiple rounds, with observed Bitcoin losses rising from approximately $88 million to nearly $114 million within days. Researchers warned that other vulnerable addresses could still become targets, prompting many Coldcard users to move their Bitcoin. Coldcard is a Bitcoin-only wallet that supports offline signing via microSD card and optional QR codes. Launched in 2017, it has long been regarded as one of the security-focused Bitcoin hardware wallets.
Odaily News: Bitcoin News posted on X platform, stating that Boltzhq has indefinitely suspended its swap service after reporting an increase in AI-assisted attacks and multiple contained exploits. Due to its non-custodial design, user funds were never at risk, but wallets relying on Boltz for Lightning Network swaps, including AquaBitcoin and BULLBITCOIN, experienced service disruptions while alternative infrastructure is being deployed.
Bitcoin News posted on X platform, stating that MARA's Slipstream is now open as a permissionless public service, requiring no client software. This service is particularly important for users transferring funds from vulnerable COLDCARD wallets. Multi-signature spending exposes all public keys and spending conditions. If this transaction enters the public mempool, attackers can immediately match these keys against their pre-computed database of weak COLDCARD private keys, and if they control the majority of keys, broadcast a higher-fee double-spend transaction before the original transaction is confirmed. Slipstream submits transactions directly to miners, keeping them out of the public mempool until mined. MARA recommends using conservative fees to avoid transactions getting stuck. Aside from standard Bitcoin network fees, the service is currently free.
Odaily News: Bitcoin wallet service provider Nunchuk has issued an important update regarding the recent Coldcard security incident, recommending that users with multisig wallets containing Coldcard-generated keys migrate their funds as soon as possible.Nunchuk has categorized response levels based on the number of affected Coldcard keys in a multisig wallet: if the number of Coldcard-generated keys has reached the signing threshold, attackers could theoretically transfer funds directly, and such users should migrate immediately; if the wallet contains only 1 Coldcard-generated key and it is below the signing threshold, a single compromised key cannot move funds independently, making the risk relatively lower, but migration is still strongly recommended. If users cannot confirm the exact number of Coldcard keys in their wallet, they should treat it as a high-risk situation.Additionally, Nunchuk announced that an upcoming mobile update will automatically enable the Slipstream channel for paid users. At that point, any auxiliary multisig wallet transaction containing at least one Coldcard key will bypass the public mempool and be submitted via Slipstream, reducing the risk of transaction monitoring and replacement. For users who wish to act immediately or for free-tier users, Nunchuk offers a manual migration option: users need to create a migration transaction, complete multisig signing without broadcasting, and then submit the raw transaction data to the Slipstream platform.
According to Cointelegraph, Coinkite, the manufacturer of Coldcard hardware wallets, disclosed that its devices have contained a random number generator (RNG) vulnerability persisting for up to five years since March 2021. The vulnerability stemmed from a firmware upgrade that mistakenly routed wallet seed generation to a less secure MicroPython pseudo-random number generator (PRNG), rather than the originally designed true random number generator (TRNG). Since code reviews only verified the existence of TRNG code without confirming whether it was actually invoked, the vulnerability remained undetected for a long period. To date, over 4,500 addresses have been compromised, with nearly $90 million worth of Bitcoin stolen. Kraken Chief Security Officer Nick Percoco stated that this incident should serve as a "wake-up call" for the hardware wallet industry, calling for the introduction of independent third-party testing mechanisms to mandate verification of whether the entropy sources actually invoked by production firmware are certified. Coinkite has suspended all device shipments and destroyed affected inventory after confirming the vulnerability, and stated it will cooperate with law enforcement agencies across multiple countries to trace the responsible parties.
Odaily News: Galaxy Research Head Alex Thorn analyzed that a new wave of Bitcoin sweeping attacks targeting Coldcard wallet addresses is underway, and cumulative losses from vulnerabilities related to Coldcard hardware wallets could approach $114 million. This attack primarily affects single-signature wallets, with no multi-signature wallets found to be impacted so far. No direct victim reports have been received yet; the assessment is mainly based on on-chain transaction pattern analysis, with some attack transactions still in an unconfirmed state.