News linked to both this project and an event.
比特币开发者 Kevin Loaec 警告，若 BIP-110 相关分叉发生，在缺少重放保护的情况下，用户出售分叉链资产可能导致真实 BTC 被同步转移。
Odaily News: The proposed Bitcoin fork is associated with the controversial BIP-110 proposal and could generate duplicate balances on both chains, potentially prompting holders to attempt selling seemingly free fork coins. Since both chains initially accept the same transactions, selling fork coins could trigger a replay attack and simultaneously spend the seller's real Bitcoin on the main chain. Developers have stated that built-in replay protection will be lacking at least until early September, and non-professional users should avoid transferring Bitcoin during the potential fork period.
Odaily News: Bitcoin News stated on the X platform that BTCPay Server has reported a critical vulnerability being actively exploited, which could result in loss of funds. Users should immediately update to BTCPay Server v2.4.2; those who cannot update immediately should shut down their BTCPay Server until the update can be installed, to prevent unauthorized access.
Odaily News – According to monitoring by Galaxy's Head of Research, the median dormancy period for stolen coins is 3.5 years, with 88% of stolen coins being over one year old. By address, the median loss is 0.014 BTC and the average loss is 0.212 BTC; over 250 victim reports have been received. Based on victim reports, the median loss is 1.022 BTC and the average loss is 4.04 BTC, with reported losses ranging from 624 satoshis to 58.97 BTC.
Bitcoin News posted on X platform that a Trezor user claimed their life savings were stolen after clicking a Google-sponsored search result impersonating Trezor. The phishing page was hosted on Google Sites and allegedly tricked the victim into entering their wallet recovery seed. Trezor stated that it is upgrading its handling of the report, proceeding with the removal of the website, and reminding users to never enter wallet backups or mnemonic phrases on any website or online form. Google-sponsored phishing ads remain an ongoing attack vector for crypto users.
据 QCP Capital 8 月 7 日市场报告，BTC 本周从约 62,500 美元低点回升至 64,000 美元附近。尽管期间承压明显——Strategy 上周出售 1,638 枚 BTC（约 1.047 亿美元），Coldcard 安全事件波及约 5,000 个钱包、估计损失约 1,755 枚 BTC（约 1.1 亿美元）——市场并未出现持续性下跌。 期权市场同样未见恐慌情绪，7 日和 30 日平值隐含波动率分别为 28.8 和 32.6，处于近期区间低端；7 日 25-delta 风险逆转从 -7.39 快速收窄至 -2.10，显示短端下行偏斜明显缓解。 宏观层面，美国 7 月 ISM 制造业 PMI 升至 55.6（逾四年新高），但就业数据走软，ADP 私人就业仅新增 4.4 万人，市场等待当日晚些时候公布的非农数据（华尔街日报预期新增约 8.3 万人）。此外，霍尔木兹海峡局势仍未完全解除，布伦特原油重返 83 美元上方；日元干预及日本国债收益率走势持续牵动全球流动性预期。
Odaily News: DefiLlama data shows that hackers stole $247 million in crypto assets in July, making it the second-highest month since 2026, trailing only April's $644 million; this figure represents a significant increase from June's $75 million and May's $60 million. Galaxy Digital stated that the Coldcard vulnerability was the largest attack event of the month, confirming three rounds of attacks involving 7,300 wallets, with at least $100 million in Bitcoin stolen; the firm also identified a suspected fourth round of attacks, which could bring total losses to approximately $130 million. DefiLlama's hack tracker estimates losses related to this vulnerability at $115 million. Other attacks in July include a $9 million exploit on decentralized finance protocol Bonzo Lend, a $2.6 million theft from Cardano-based wallet SecondFi, a $24 million theft from Arbitrum-based perpetual trading platform AFX, and a $7.5 million theft from the Verus Ethereum Bridge.
Odaily News: Bitcoin Red Team, a volunteer security audit team composed of Bitcoin developers and security researchers, has released its latest audit findings. In approximately 30 hours, the team reviewed 391 Bitcoin-related codebases and identified a total of 4,962 security issues, of which 720 were rated as high-risk or critical vulnerabilities. Only one codebase was found to have no issues at all. Currently, only 147 vulnerabilities have been submitted to project maintainers for resolution.Bitcoin Red Team is a volunteer security audit team made up of Bitcoin developers and security researchers, initiated following the Coldcard hardware wallet vulnerability incident. Key contributors include Calle, a developer of the Cashu protocol, among others. (Beincrypto)
Odaily News: According to Lookonchain monitoring, the hacker who stole 2,055 BTC (valued at $130 million) from Coldcard is active again. An hour ago, the hacker transferred 30.185 BTC (worth $1.94 million) to a new wallet.
Odaily News – A long-dormant Bitcoin wallet moved nearly 50 BTC, worth approximately $3.2 million, on Thursday. The wallet received 49.97 BTC back in 2011, when Bitcoin was trading at around $10 per coin. The BTC was sent to a SegWit address that has previously transferred Bitcoin to institutional broker FalconX and received funds from wallets linked to Nexo and Prime Trust. The newly transferred BTC has not left this address. The transfer comes amid long-term holders rechecking their old storage setups following a major vulnerability exploit in Coldcard hardware wallets. There is currently no evidence linking the 2011 wallet to this vulnerability.
Bloomberg analyst Eric Balchunas says the Coldcard security vulnerability enhances the appeal of spot Bitcoin ETFs, with the incident involving approximately $88.6 million in losses.
According to Cointelegraph, Bitcoin Lightning Network self-custodial wallet Zeus Wallet voluntarily took its infrastructure offline following a cybersecurity attack on Wednesday and is currently conducting a comprehensive audit of the system, with services to be restored upon completion. Zeus founder Evan Kaloudis stated that the attack was contained within hours, no customer fund losses were found, and there was no evidence that the Lightning node software was affected; the scope of the incident was limited to Zeus's own infrastructure. For users forced to close LSP channels during this incident, Zeus promised to provide replacement channels after services are restored. The company has not yet disclosed the specific nature of the attack or a timeline for resuming operations. Zeus stated that this incident will further drive its security development on Trusted Execution Environment (TEE) and Validating Lightning Signer (VLS) projects.
According to CoinDesk, the S&P 500 index has risen 3.12% this month, adding approximately $2.1 trillion in market value (equivalent to the total market cap of the entire crypto market), reaching a record high total market cap of $70.5 trillion, but Bitcoin has only risen about 2% this month, hovering near $64,600. Analysts point out that this round of stock market rise is mainly driven by AI and semiconductor individual stock narratives, rather than a broad-based recovery in risk appetite at the macro level, and Bitcoin lacks direct beneficial exposure to this. Meanwhile, the crypto market also faces multiple internal pressures: the Coldcard platform suffered a $120 million exploit, the prospects of the "Clarity Act" remain uncertain, MicroStrategy has reduced its BTC holdings for three consecutive months, and stablecoin supply continues to shrink—USDT's market cap dropped from $190 billion in April to $183 billion, and USDC's dropped from $79.5 billion to $72 billion.
: Bitcoin News posted on the X platform stating that a security analysis revealed a repository distributed on GitHub, disguised as a proof-of-concept tool for a COLDCARD random number generator, is malicious in nature. The software claims to be a research tool that reproduces a flawed wallet random number generator to help recover Bitcoin wallets created with vulnerable seeds. According to the report, the tool contains a remote code execution backdoor that downloads an information-stealing program capable of collecting wallet mnemonic phrases, private keys, browser passwords, SSH keys, and other credentials, exfiltrating the data via Telegram while installing persistent malware on Windows, macOS, and Linux. Researchers stated that any user who has executed the code should treat the affected device as fully compromised, rotate credentials, transfer crypto assets to a newly generated wallet, and report the repository. The analysis also warned against running proof-of-concept code for vulnerabilities on devices containing wallets or sensitive data without independent verification.
: Bitcoin News posted on X platform stating that a new community honeypot test shows attackers are still prioritizing the most easily exploitable wallets affected by the Coldcard Mk3 RNG vulnerability. Researcher @ColeTU injected funds into 5 affected Mk3 wallets: 1 using only the vulnerable mnemonic seed, 3 protected respectively by 1-word, 2-word, and 3-word BIP39 passphrases, and 1 using a random account number. After 14 hours, only the unprotected wallet using just the mnemonic seed had its funds transferred out. Additionally, according to @jamesob's real-time tripwire dashboard, only 2 of the 17 honeypot wallets have been drained so far. Confirmed drained wallets all lacked added entropy, while all wallets protected by dice rolls, passphrases, multisig, or other complexity measures remain untouched. The test results show that attackers are currently focusing on wallets that are easiest to brute-force rather than investing resources in hardened targets—but affected users should still migrate funds immediately rather than relying on temporary protection.
According to reports from the Procuratorial Daily, an employee of a Shenzhen enterprise, under pressure from over 400,000 yuan in online loans, stole the company's core R&D data and disguised himself as an overseas hacker to demand a ransom of 0.88 Bitcoin and 90,000 USDT from the enterprise, and was ultimately sentenced to three years and three months for attempted extortion and fined 10,000 yuan.
据 Bitcoin Magazine 报道，在 Coldcard 硬件钱包漏洞事件引发行业关注后，由 Calle与 Anchorwatch 首席执行官 Rob Hamilton 推动的“比特币红队”已对 390 个比特币开源代码库展开 AI 驱动安全审计，累计提交 4,962 项问题，其中包括 85 项严重漏洞和 635 项高危问题。该项目已获得 OpenSats 支持，审计成本超过 4 万美元，并计划未来开源相关测试工具，以协助更多比特币企业和开发团队排查安全风险。
Odaily Odaily News: Bitcoin Red Team, a bitcoin security organization composed of 16 volunteers, stated that it identified nearly 5,000 potential issues during a rapid AI-assisted review of bitcoin ecosystem projects. The organization's members include AnchorWatch CEO Rob Hamilton and bitcoin developer Calle, among others. Calle stated that Bitcoin Red Team used AI tools combined with manual review to scan for vulnerabilities in open-source code repositories related to bitcoin, discovering an average of approximately 1 critical vulnerability per person per hour. Calle disclosed that within 29.8 hours of launch, the team had identified 4,962 potential issues across 390 projects, of which as many as 720 were classified as high-risk or critical. Currently, 21.4% of the findings have been reproduced. The security review initiative was launched just days after the Coldcard hardware wallet vulnerability incident, in which stolen bitcoin exceeded $100 million in value.
Odaily News: Bitcoin News stated on the X platform that ZEUS has temporarily taken its infrastructure offline following a cybersecurity incident over the past few hours. ZEUS said the attack has been mitigated and services will remain offline until it completes a full security audit and resumes operations. ZEUS stated that no customer funds have been lost, and no customer funds are currently at risk. Customers whose Lightning Service Provider channels were closed will receive replacement channels once services are restored. Based on the current investigation, ZEUS said the incident appears to be limited to its own infrastructure, with no evidence yet suggesting it was caused by a vulnerability in Lightning node software. ZEUS added that it has been strengthening its infrastructure using trusted execution environments and the Validating Lightning Signer project, noting that the project is designed to mitigate such attacks in its upcoming architecture. ZEUS said it will continue to provide updates as the investigation progresses.
Odaily News: According to Bitcoin News monitoring, Galaxy Research stated that the largest known COLDCARD theft incident involves 1,159 BTC, distributed across seven attacker addresses, which remain untouched to date, with 0 BTC cashed out or transferred through mixers. The relevant BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement agencies, exchanges, and blockchain analysis firms. Meanwhile, a smaller-scale attacker appears to have begun cleaning funds. On-chain analysts have tracked 64 BTC entering mixers, of which only about 10 BTC initially completed mixing, 54 BTC returned as change, and were subsequently split into outputs of approximately 7 BTC each for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this cleaning attempt relatively transparent.