News linked to both this project and an event.
Odaily News, Galaxy Research Head Alex Thorn stated on the X platform that attacks exploiting the Coldcard hardware wallet vulnerability have noticeably declined, but cumulative losses continue to rise as more victims come forward. The impact of this incident on the Bitcoin community is significant, as the victims are primarily long-term BTC holders who adhered to self-custody cold storage principles, rather than those who lost assets due to high-risk trading or DeFi activities.At a scale of $112 million, this incident ranks among the top 20 largest hacks in crypto history and is one of the most severe security breaches in the hardware wallet self-custody sector to date. Bitcoin culture may be entering a new phase—the era of relying solely on ideological advocacy and extreme self-custody promotion is coming to an end. The community needs to place greater emphasis on technical security, lower the barrier to entry for users, and avoid simply shifting the burden of security responsibility onto ordinary users. This crisis may ultimately drive the Bitcoin ecosystem to establish a more mature security framework.Galaxy Research has directly contacted 190 victims and has confirmed with high confidence that the exploit has led to the theft of 1,778.84 BTC (approximately $112.7 million) from over 8,600 addresses. This tally does not yet include certain moderately credible suspicious attack records, such as the unconfirmed "Wave 4." If these potential attack scopes are incorporated, total losses could expand to 2,417.35 BTC (approximately $153 million).Meanwhile, the incident is reshaping market perceptions of self-custody security. Galaxy noted that multisig wallets have emerged as the "winners" of this event, with no stolen transactions traced to multisig wallets so far. Multisig service providers including Casa, Unchained, Nunchuk, and Anchorwatch have all observed a notable increase in user registrations and BTC inflows.
Odaily讯 According to Cyvers Alert monitoring, an Address Poisoning attack incident has been detected, resulting in the victim losing approximately $100,000 in USDT. The attacker carried out the "address poisoning" against the victim's wallet about 66 days ago by sending a transaction to create a malicious address record resembling an address the victim normally interacts with. Today, the victim failed to verify the full wallet address and mistakenly transferred funds to the attacker's address.Following the incident, in order to avoid potential freezing risks, the attacker has converted the stolen USDT into ETH, and the wallet currently holds approximately 52.8 ETH.Cyvers reminds users to always fully verify wallet addresses when making on-chain transfers, and to avoid relying solely on address records from transaction history. Meanwhile, security agencies recommend adopting AI-based on-chain security tools for real-time detection of abnormal transaction behavior, in order to reduce risks such as address poisoning and phishing attacks. Address poisoning attacks have become one of the common fraud methods in the crypto asset space in recent years. Attackers typically exploit users' habit of copying addresses from historical transactions by forging similar-looking addresses to trick users into transferring assets mistakenly.
According to The Block, open-source Bitcoin payment processor BTCPay Server disclosed a critical security vulnerability being actively exploited last Friday and urgently requested users to upgrade to version 2.4.2. The vulnerability affects all versions prior to 2.4.2; attackers can use it to steal administrator macaroon authentication credentials of LND nodes, thereby fully controlling the connected Lightning Network wallets. Users such as Foundation and Citadel21 have confirmed that their Lightning node funds were drained, but BTCPay has not publicly disclosed the total amount stolen or the number of affected nodes. Currently, the official release version 2.4.2 has fixed this vulnerability, and on-chain hot wallets are not affected. The BTCPay Server Foundation has donated 0.21 BTC each to security researcher Craig Raw and Bitcoin Red Team to commend their responsible private disclosure of the vulnerability. Meanwhile, BTCPay supporters have promised to provide a bounty incentive of "10% of recovered funds," capped at 3 BTC.
According to CoinDesk, the S&P 500 index has risen 3.12% this month, adding approximately $2.1 trillion in market value (equivalent to the total market cap of the entire crypto market), reaching a record high total market cap of $70.5 trillion, but Bitcoin has only risen about 2% this month, hovering near $64,600. Analysts point out that this round of stock market rise is mainly driven by AI and semiconductor individual stock narratives, rather than a broad-based recovery in risk appetite at the macro level, and Bitcoin lacks direct beneficial exposure to this. Meanwhile, the crypto market also faces multiple internal pressures: the Coldcard platform suffered a $120 million exploit, the prospects of the "Clarity Act" remain uncertain, MicroStrategy has reduced its BTC holdings for three consecutive months, and stablecoin supply continues to shrink—USDT's market cap dropped from $190 billion in April to $183 billion, and USDC's dropped from $79.5 billion to $72 billion.
Odaily News: According to Bitcoin News monitoring, Galaxy Research stated that the largest known COLDCARD theft incident involves 1,159 BTC, distributed across seven attacker addresses, which remain untouched to date, with 0 BTC cashed out or transferred through mixers. The relevant BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement agencies, exchanges, and blockchain analysis firms. Meanwhile, a smaller-scale attacker appears to have begun cleaning funds. On-chain analysts have tracked 64 BTC entering mixers, of which only about 10 BTC initially completed mixing, 54 BTC returned as change, and were subsequently split into outputs of approximately 7 BTC each for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this cleaning attempt relatively transparent.
According to TechCrunch, the Open Safety AI Alliance (OSAA), led by Nvidia, has exceeded 120 member companies just one week after its establishment, including tech and financial giants such as Adobe, BlackRock, Cisco, Intel, Microsoft, and Visa. During the Black Hat Cybersecurity Conference held in Las Vegas this week, the alliance established a working group named "Shared AI Findings Exchange" (SAFE) and has submitted multiple proposals open for public comment, managed by the Linux Foundation. The proposals cover confidential reporting mechanisms for AI cybersecurity incidents, alert processes for affected parties, and no-fault attribution analysis frameworks. Meanwhile, member companies are also actively contributing open-source technologies: Nvidia open-sourced the LLM vulnerability scanning tool Garak, Amazon contributed the agent building tool Strands Agents and authorization language Cedar, and Okta and Red Hat are advancing agent identity authentication and governance technologies respectively. Notably, Anthropic, OpenAI, and Google have not yet joined the alliance, although OpenAI and Google previously co-signed the open letter that spurred the creation of the alliance.
Galaxy Digital Head of Research Alex Thorn stated that based on new victim reports received following the incident, the number of attackers exploiting the Coldcard vulnerability has reached at least 15.Thorn noted that information provided by victims helped the research team uncover previously unidentified attack activity. Unlike thefts from centralized exchanges, correlations between the attackers in this vulnerability exploit require confirmation through on-chain analysis and victim feedback.He added that a single victim reporting less than 1 BTC stolen helped the team discover a previously unknown attack, which siphoned approximately 12 BTC from 126 addresses.According to Galaxy Research's earlier estimates, the Coldcard vulnerability has led to at least three rounds of attacks, with losses amounting to approximately $100 million in BTC. Additionally, Galaxy has identified a suspected fourth round of attacks, which could bring total losses to approximately $130 million.Meanwhile, the incident has also sparked discussions regarding the security of Bitcoin self-custody. Dragonfly Managing Partner Haseeb Qureshi stated that "AI security hardening costing around $2" could potentially have prevented this vulnerability, and noted that some AI models were able to rediscover related vulnerabilities within a relatively short timeframe. However, industry insiders pointed out that current claims about the speed of AI discovering vulnerabilities lack rigorous blind testing and verification.Researchers believe that as AI model capabilities improve, the costs of vulnerability discovery and attacks in the crypto industry may continue to decline, requiring wallet developers to further strengthen code audits and security protections. (Cointelegraph)
Developers on Reddit used Claude Code to scan the Coldcard open-source firmware for vulnerabilities, pinpointing the core issue within 8 minutes: When generating private keys, the firmware invoked a software pseudo-random number generator instead of a hardware true random number generator, and it was this vulnerability that led to the theft of approximately $70 million in BTC from 1,196 wallets. Meanwhile, community users also reported that using Zhipu GLM 5.2 (trained on June 16, offline) for an independent scan similarly discovered this vulnerability. This bug has existed in the open-source wallet code for over five years.
According to CryptoQuant Head of Research Julio Moreno (@jjcmoreno), following the hack of Coldcard hardware wallets, users transferred Bitcoin on a large scale due to security concerns. On-chain data shows that Bitcoin daily active addresses surged from 645,000 on July 30 to nearly 1 million on July 31, marking the highest single-day level since December 10, 2024, with active sending addresses rising significantly while receiving addresses saw relatively limited growth. Meanwhile, daily exchange deposit volume for single transactions under 10 BTC soared to 7,300 BTC, the highest since February 6 this year.
According to Decrypt, Galaxy Digital has officially launched the "Bitcoin Quantum Readiness Initiative," with three core pillars including: providing up to $5 million in post-quantum cryptography research grants to developers, publishing specialized research reports through Galaxy Research, and establishing a quantum advisory committee composed of scholars from multiple top universities. The initiative targets "Q-Day"—the critical moment when quantum computers utilize Shor's algorithm to crack Bitcoin's elliptic curve encryption, forge signatures, and steal wallet assets. Project Eleven predicts that quantum computers capable of cryptographic threats may emerge as early as 2030, at which point approximately 6.9 million BTC will face exposure risks. The Coinbase Quantum Advisory Committee has also called on developers to immediately initiate migration work. Meanwhile, Trump has signed an executive order setting the deadline for the U.S. federal government to complete post-quantum cryptography migration to December 2031.
: According to monitoring by on-chain analyst Yu Jin, the hacker (0x18B...E66) who stole funds from a Coinbase user spent 7.378 million DAI early this morning to buy 4,049.7 ETH at a price of $1,822. Meanwhile, the address (0xa13...628) that received ETH from Tornado Cash last November had previously transferred out 4,978 ETH and exchanged them for 16.294 million DAI at a price of $3,273. Today, two hours ago, this address spent 4.34 million DAI to repurchase 2,405 ETH at a price of $1,804.
Odaily, Web3 security firm CertiK has released the "Hack3D: First Half of 2026 Report." The report shows that the Web3 ecosystem experienced 344 security incidents in the first half of 2026, with cumulative losses of approximately $1.32 billion. Although this figure represents a 46.8% decrease compared to the same period last year, excluding the impact of the $1.45 billion security incident involving Bybit, the scale of losses in the first half of this year actually increased by approximately 28% year-on-year, indicating that the overall security environment in the industry has not materially improved.The report points out that wallet theft has become the attack type causing the greatest financial loss, accounting for approximately $450 million in losses in the first half of the year. Meanwhile, although the number of phishing attacks fell by more than 50% year-on-year, the loss amount only decreased by approximately 10.8%, reflecting that attackers are shifting towards high-net-worth individuals and institutional targets, carrying out more targeted high-value attacks.Furthermore, code vulnerabilities remain the most frequent type of attack, with 204 related incidents. CertiK believes that attackers are increasingly targeting long-running legacy smart contracts that lack re-audits. The report also shows that mega-attacks continue to dominate industry losses, with the Kelp DAO and Drift Protocol incidents alone causing approximately $577 million in losses, accounting for 44% of the total losses in the first half of the year. Looking at the number of incidents, the impact of single attacks, and the changing attack patterns, the Web3 industry is facing more complex and continuously escalating security challenges.
U.S. President Trump’s newly released 927-page financial disclosure document reveals income including hundreds of millions of dollars in crypto-related earnings. Among these are millions of dollars in revenue linked to World Liberty Financial, the DeFi project launched by the Trump family in 2024. This disclosure has heightened the urgency of congressional negotiations over ethics provisions within the Clarity Act, the crypto market structure bill.Currently, bipartisan lawmakers are negotiating the Clarity Act, which aims to establish the first comprehensive federal crypto regulatory framework in the United States. A key focus of the negotiations is whether to include ethics restrictions preventing the President, Vice President, members of Congress, and other federal officials from profiting from digital assets while in office.Following the document's release, Democratic lawmakers reiterated that the bill must contain strict ethics clauses. Senator Angela Alsobrooks stated that such restrictions should apply to the President, Vice President, and all members of Congress. She noted that ordinary Americans should benefit from digital assets in a fair and honest manner, rather than allowing political figures to profit through corruption and institutional loopholes.Senator Kirsten Gillibrand also indicated that both parties are still advancing stringent ethics reforms, proposing to prohibit the President, Vice President, and lawmakers from using crypto assets for personal gain. Meanwhile, Elizabeth Warren argued that if the Clarity Act fails to prevent the President, members of Congress, and their families from profiting from the crypto industry, the bill would further fuel controversies surrounding Trump-related crypto corruption.Republicans, for their part, stated that ethics clauses remain part of the bipartisan negotiations. With the July window for advancing the Clarity Act approaching, the disclosure of Trump family crypto income could become a key variable influencing the final text of the bill and the level of Democratic support.
the U.S. Department of Commerce has made differentiated adjustments to export restrictions on frontier models from AI company Anthropic, signaling that global AI regulation has entered a new phase of "tiered liberalization." The policy shows that the official ban on exporting Claude Mythos 5 has been lifted, allowing specific compliant and controlled users to resume using this cybersecurity model. Meanwhile, another high-end model, Fable 5, remains under export restrictions, with related policy consultations still ongoing.Industry analysts indicate that this layered control model—loosening restrictions in some areas while tightening in others—reflects the U.S. balancing act between national security, data sovereignty, and international AI competition. As the global AI race continues to accelerate, specialized models capable of vulnerability exploitation are facing increasingly stringent scrutiny from various countries. Multiple nations have initiated discussions on establishing a unified cross-border regulatory framework for frontier AI capabilities. (Forbes)
as Anthropic faces export restrictions limiting the global availability of its advanced models, multiple Asian AI companies are accelerating efforts to fill the market gap. Chinese cybersecurity firm 360 Security Technology has reportedly launched an AI tool called "Tulongfeng," claiming it can directly compete with Anthropic's high-end model "Mythos." Meanwhile, its more restricted version, "Fable 5," also falls within the scope of relevant export controls.In the same week, Japanese AI startup Sakana AI released a new model named "Fugu," taken from the Japanese word for pufferfish. It is positioned as a frontier model designed for agents. The company stated that the model's capabilities are comparable to Fable 5 and Mythos Preview, and it supports coordinating multi-model calls via API to enable agent orchestration.Sakana AI emphasized that the timing of this release and the U.S. export restrictions are "purely coincidental," but the product's official website still clearly promotes "providing frontier capabilities without the risk of export controls." Company co-founder David Ha stated that future AI development will shift from competition among single large models to "model orchestration systems," adding that "access can disappear at any time, and distributed intelligence is a realistic hedge against the risks of centralization."On the other hand, Chinese 360 founder Zhou Hongyi views AI vulnerability detection capabilities as a "national strategic asset" and warns of the so-called "one-way transparency" risk, where certain entities may monopolize advanced security capabilities.According to reports, the U.S. export restrictions on Anthropic's advanced models have been in place for about two weeks. Against this backdrop, Asian manufacturers are accelerating the launch of local alternatives. Although some companies still emphasize the importance of American models in the Asian market, the trend of differentiation within the regional AI ecosystem has begun to emerge. (TechCrunch)
Ethereum Layer 2 project Taiko has released the latest update on a security incident, stating that this incident will not result in any user fund losses. Currently, bridged assets are under-collateralized, and the team will complete supplementary collateral for all assets before reopening the bridge, ensuring that each user's balance is supported on a 1:1 basis, identical to the state before the incident. Since the security incident occurred, cautious measures have been taken, including controlling the scope of impact, determining the root cause, and collaborating with the board to develop a plan to protect user assets.Furthermore, the CEO of Taiko has submitted a formal report to relevant authorities in Singapore, and the team will fully cooperate in tracing the responsible parties. Users are currently not required to take any action. The completed fix is now being tested, and Taiko will reopen the chain and bridge services as soon as it is deemed safe. Meanwhile, users are reminded to be vigilant against scams. The Taiko team will not proactively message users, and there are no claim or refund websites. Any links offering such services are fraudulent.
According to Crypto in America, the National District Attorneys Association, the National Association of Assistant U.S. Attorneys, the International Association of Chiefs of Police, and the National Sheriffs’ Association jointly sent a letter to Acting Attorney General Todd Blanche and Patrick Witt, Executive Director of the White House Crypto Council, expressing strong opposition to Section 604 of the “Clarity Act”—the Blockchain Regulatory Certainty Act (BRCA). Law enforcement groups argue that this provision could create regulatory loopholes exploitable by criminals for illicit activities including drug trafficking, fraud, child exploitation, sanctions evasion, and terrorist financing. Meanwhile, cryptocurrency-backed candidates achieved sweeping victories in primary elections across Maryland, New York, and Utah. Fairshake—a pro-crypto super PAC—has collectively spent over $7.6 million supporting these candidates, including $5.5 million backing Adrian Boafo, the candidate for Maryland’s 5th congressional district. Miller Whitehouse-Levine, founder of the Solana Policy Institute, warned that August 7, 2026, may be the final window for Congress to pass cryptocurrency market structure legislation. He stated that the industry is willing to make limited revisions to the BRCA provisions to address law enforcement concerns—but firmly opposes any fundamental changes that would weaken the core protections enshrined in the provision. Additionally, the House Financial Services Committee held a hearing on “The Future of Payments” the same day.
Odaily Taiko officially posted on X, stating: "We have identified the root cause of the attack and are currently developing a fix patch to restore the blockchain's online operation as soon as possible. Meanwhile, we are working closely with major exchanges and security partners to track and freeze the hacker's assets. The remaining funds in the cross-chain bridge are currently safe, and we will announce the next steps in an upcoming update. To focus on fixing the vulnerability and protecting user assets, we will pause updates for a few hours."Previously, Taiko's cross-chain bridge was attacked, with potential losses reaching up to $1.7 million.
the U.S. government's export controls and access restrictions on Anthropic's models, Fable 5 / Mythos 5, were partly driven by Amazon's cybersecurity research and AWS CEO Andy Jassy's communications with the White House.It is understood that research submitted by Amazon indicated that through a series of prompt tests, researchers could induce Fable 5 to output sensitive information potentially usable for cyberattacks, raising security concerns. Subsequently, Andy Jassy reported these findings to the U.S. government level, prompting the White House to implement further restrictions, including banning foreign users from accessing the model.Meanwhile, former U.S. Commerce Department official Kate Koren revealed that the White House's existing policy stance towards Anthropic may have also influenced this decision. This is because Anthropic has disagreements with the White House over the boundaries of AI safety, including refusing to use its models for mass surveillance or lethal autonomous weapons systems. Although the two sides had eased tensions and expanded cooperation earlier this year, this incident could reignite strained relations between them. (The Wall Street Journal)
Humility Protocol released a security incident update on the X platform, stating that its H token suffered a coordinated attack on the Ethereum and BSC chains yesterday, with confirmed losses exceeding $36 million in stolen and dumped assets.Preliminary investigations indicate the incident originated from a compromised employee computer, which led to the leakage of private keys for the multi-signature wallet controlling the Hyperlane Bridge ProxyAdmin. Specifically, the attacker obtained 3 out of 6 private keys of the Gnosis Safe wallet on the Ethereum chain, transferred ownership of the ProxyAdmin to a wallet under their control, upgraded the bridge contract to a malicious implementation, and subsequently transferred approximately 141.2 million H tokens in a single transaction.Simultaneously, the attacker also gained control of 3 out of 5 private keys of the Safe wallet on the BSC chain, took over the ProxyAdmin using the same method, deployed a malicious contract with unlimited minting functionality, and minted 200 million H tokens in two separate transactions to their own wallet.Humility stated that it has suspended all deposit and withdrawal operations on the affected bridge services and is collaborating with partners such as exchanges to mitigate losses. Meanwhile, it is cooperating with the police investigation and attempting to recover part of the stolen funds.