A Coldcard Hardware Wallet Bug Let Hackers Drain 594 BTC from 500 Wallets in 25 Minutes
A seed-generation vulnerability in Coldcard Mk3 hardware wallets was exploited to drain roughly 594 BTC worth $38 million from around 500 wallets in just 25 minutes. MiCA’s licensing deadline left 80% of previously registered crypto firms operating illegally or shut down. The MIM stablecoin collapsed 74% and fell 50% below its peg. JPMorgan, Citi, UBS and 25 other banks settled $1 million in tokenized money across six currencies in an average of 80 seconds. North Korea’s BlueNoroff group escalated phishing attacks using fake Zoom and Teams meetings to steal crypto wallet credentials. Here is a clear look at the most important crypto and tech stories making headlines.
A Hardware Wallet Bug Let Hackers Drain 594 BTC from 500 Wallets in 25 Minutes
A seed-generation vulnerability in Coinkite’s Coldcard Mk3 hardware wallets was exploited to sweep approximately 594 BTC worth around $38 million from roughly 500 wallets within a 25-minute window. The flaw allowed attackers to predict wallet seed phrases generated by affected devices.
A hardware wallet is supposed to be the safest place to hold crypto. The entire security model depends on the seed phrase being impossible to predict. A bug that makes seed phrases predictable does not just affect individual users, it invalidates the core promise of the device for everyone who owns one. 500 wallets drained in 25 minutes means this was automated, targeted, and fast. Anyone still holding funds on a Coldcard Mk3 needs to move them immediately.
MiCA Left 80% of Registered Crypto Firms Operating Illegally or Shut Down
MiCA’s licensing deadline passed and only 210 to 244 of over 1,200 previously registered crypto-asset service providers received authorization under the new regime. That means roughly 80% are now either operating without a valid license or have closed entirely.
MiCA was the most comprehensive crypto regulatory framework any major economy had attempted. The outcome so far is that it has eliminated most of the market participants it was designed to regulate. 80% non-compliance is not a sign that the framework is working. It is a sign that the compliance bar is too high for most firms to clear in the time given, and that the EU crypto market is now significantly smaller than it was before the rules arrived.
Coinbase posted second-quarter 2026 revenue of $1.22 billion alongside a net loss of $359.5 million, sending its stock down roughly 10% on the day of the announcement.
$1.22 billion in revenue in a single quarter is a substantial number. Losing $359.5 million at the same time means costs are growing faster than income. Coinbase is spending heavily on regulatory efforts, international expansion, and product development, and those costs are not yet reflected in the revenue line. A 10% single-day share drop shows investors expected more from a company operating in a market where Bitcoin has been trading above $60,000.
28 Global Banks Settled $1 Million in Tokenized Money Across Six Currencies in 80 Seconds
JPMorgan, Citi, UBS and 25 other banks completed a BIS-led pilot settling $1 million in tokenized money across six currencies, with the average transaction completing in 80 seconds.
Cross-border bank settlements currently take one to five business days and involve multiple correspondent banks, each taking a fee and adding time. 80 seconds across six currencies with 28 of the world’s largest banks participating is not a startup demo. It is the global banking system showing it can use blockchain infrastructure to do in seconds what currently takes days. The question is no longer whether tokenized settlement works. It is how fast the existing system gets replaced.
Bitcoin ETFs Lost $265.4 Million in a Single Day as Bitcoin Fell Below $63,000
US spot Bitcoin ETFs recorded $265.4 million in net outflows in a single day, the largest daily redemption since July 13, with BlackRock’s IBIT and Fidelity’s FBTC leading the exits as Bitcoin slid below $63,000.
$265.4 million leaving Bitcoin ETFs in one day is a significant institutional move. The fact that IBIT and FBTC led the redemptions matters because these are the two largest funds, and large funds move slowly when sentiment is merely cautious. When they lead outflows, it reflects something more decisive. Bitcoin dropping below $63,000 on the same day suggests the selling was not just profit-taking but a response to a price level breaking down.
The MIM Stablecoin Collapsed 74% and Fell 50% Below Its Dollar Peg
The MIM stablecoin issued by Abracadabra.money collapsed 74%, falling roughly 50% below its dollar peg and forcing the protocol to declare emergency measures.
A stablecoin trading at 50 cents instead of one dollar is not a stablecoin anymore. MIM was an algorithmic stablecoin backed by interest-bearing collateral, which means its stability depends on the value of assets that can themselves fall rapidly. When the collateral value drops fast enough, the peg breaks and the feedback loop accelerates. Emergency measures announced after a 74% collapse are damage control, not a solution. Users holding MIM at peg have already absorbed losses that cannot be recovered through protocol changes.
South Korea Is Moving to Finalize Its Digital Asset Basic Act by End of 2026
South Korea’s Financial Services Commission moved to merge competing crypto bills and establish stablecoin rules, with a target of finalizing the Digital Asset Basic Act before the end of 2026.
South Korea has one of the highest retail crypto participation rates of any country in the world, with millions of active traders. Operating without a comprehensive legal framework has created significant consumer protection gaps. Merging competing bills into a single act signals the government is prioritizing resolution over delay, and a year-end deadline is specific enough to hold regulators accountable for delivering it.
Morgan Stanley Launched Spot Ethereum and Solana ETPs Alongside Staking ETFs
Morgan Stanley launched spot exchange-traded products for both Ethereum and Solana, alongside staking-based ETF versions of each, giving investors multiple ways to access both assets through regulated brokerage accounts.
Launching spot ETPs and staking ETFs simultaneously doubles the product offering for each asset. Investors who want simple price exposure get the spot ETP. Investors who want yield get the staking version. Morgan Stanley putting both on the shelf at the same time signals they expect demand across both categories, and it puts significant competitive pressure on smaller issuers who have been building toward the same products.
The US Treasury Sanctioned Iranian Firms Using Bitcoin to Evade Sanctions
The US Treasury’s OFAC sanctioned two Iranian firms, including Hormuz Safe, which accepts Bitcoin and other digital assets as part of a sanctions-evasion operation.
Hormuz Safe accepting Bitcoin as part of a sanctions bypass operation is exactly the use case governments cite when arguing crypto enables financial crime. OFAC sanctioning the firm by name puts any global business that interacts with it on notice. It also continues a pattern of the US government treating crypto-enabled sanctions evasion with the same enforcement tools it applies to traditional financial crime, which means the consequences for facilitating these transactions are real and escalating.
North Korea’s BlueNoroff Group Is Targeting Crypto Wallets Through Fake Zoom and Teams Meetings
North Korea-linked hacking group BlueNoroff escalated a phishing campaign using fake Zoom and Microsoft Teams meeting invitations and hijacked Telegram accounts to gain access to crypto holders’ wallets.
BlueNoroff using fake video call invitations is more dangerous than typical phishing because people expect meeting links from colleagues and lower their guard. Hijacking Telegram accounts adds a second layer, since messages coming from a known contact are far more convincing than cold outreach. North Korea has stolen billions in crypto over the past several years. This campaign shows the methods are becoming more sophisticated, not less.
Wrapping Up
This week showed the industry getting hit from multiple directions at once. A hardware wallet bug drained $38 million in 25 minutes. MiCA left 80% of EU crypto firms unlicensed. A stablecoin fell 50% below its peg. Bitcoin ETFs lost $265 million in a single day. North Korea is running increasingly sophisticated phishing campaigns. At the same time, 28 global banks settled across six currencies in 80 seconds, Morgan Stanley launched Ethereum and Solana ETPs with staking, and South Korea is pushing toward a comprehensive legal framework by year-end. The infrastructure for institutional crypto keeps getting built. The security layer and regulatory clarity keep lagging behind.
Disclaimer: Do not invest unless you are prepared to lose all the money you invest. This is a high-risk investment, and you should not expect to be protected if something goes wrong.
Disclaimer: Don’t invest unless you’re prepared to lose all the money you invest. This is a high‑risk investment and you should not expect to be protected if something goes wrong. Take 2 mins to learn more at: https://go.payb.is/FCA-Info
