Hackers Drained $130 Million from Coldcard Hardware Wallets Using a Five-Year-Old Bug
Attackers exploited a five-year-old firmware flaw in Coldcard hardware wallets to drain more than $130 million in Bitcoin from over 5,200 addresses, making it the year’s third-largest crypto hack. Bybit filed a civil lawsuit against North Korea and the Lazarus Group over last year’s $1.5 billion theft and secured a US court injunction freezing identified assets. Circle named BlackRock, Visa, Mastercard and seven other institutions as founding validators for its Arc blockchain launching September 16. US spot Bitcoin ETFs logged more than $750 million in weekly inflows. Here is a clear look at the most important crypto and tech stories making headlines.
Hackers Drained $130 Million from Coldcard Wallets Using a Bug That Was Five Years Old
Attackers exploited a five-year-old firmware flaw in Coinkite’s Coldcard hardware wallets, draining more than $130 million in Bitcoin from over 5,200 addresses. It is the third-largest crypto hack of 2026 so far.
A vulnerability sitting undetected in a hardware wallet for five years means thousands of people were holding funds in devices they believed were secure while the attack surface existed the entire time. 5,200 addresses drained is not a targeted strike on a few large holders. It is a broad sweep across a large portion of the Coldcard user base. Galaxy Research has already identified 15 separate wallets behind the attack, which suggests investigators have a trail to follow, but the $130 million is almost certainly already moving through mixers.
Bybit Sued North Korea and the Lazarus Group Over the $1.5 Billion Hack and Froze Identified Assets
Bybit filed a civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over last year’s $1.5 billion hack, and secured a US court injunction freezing identified stolen assets.
Suing a nation-state for a crypto hack is not a legal strategy that ends with a settlement check. North Korea will not appear in a US court. What the lawsuit does accomplish is creating a legal mechanism to freeze any identified stolen assets the moment they touch a jurisdiction that recognizes the injunction. $1.5 billion is the largest single crypto theft in history. Bybit is using the US legal system to build a perimeter around wherever those funds eventually surface.
Circle Named BlackRock, Visa, Mastercard and Nine Other Institutions as Arc Blockchain Validators
Circle announced BlackRock, Visa, Mastercard, DTCC and seven other institutions as founding validators for its Arc blockchain, ahead of a September 16 mainnet launch.
A blockchain launching with BlackRock, Visa, Mastercard and DTCC as its founding validators is starting from a position most chains spend years trying to reach. DTCC alone clears tens of trillions in securities annually. If Arc integrates with that infrastructure from day one, it is not competing with other blockchains for adoption. It is embedding itself into the settlement layer of traditional finance before it even launches.
BitGo Moved $7.7 Billion in Wrapped Bitcoin from LayerZero to Chainlink
BitGo named Chainlink CCIP its exclusive cross-chain infrastructure provider, migrating more than $7.7 billion of Wrapped Bitcoin away from LayerZero in a single infrastructure decision.
$7.7 billion moving from one cross-chain provider to another is a significant vote of confidence for Chainlink and a significant blow to LayerZero. Wrapped Bitcoin is one of the most used assets in DeFi. When the custodian controlling that much WBTC switches its entire cross-chain infrastructure, other protocols pay attention. Chainlink now handles close to $15 billion in cross-chain assets after this move.
BNY Mellon Added Crypto Staking to Its Custody Platform Covering $62.6 Trillion in Assets
BNY Mellon partnered with Galaxy Digital to add crypto staking to its Digital Asset Custody platform, extending the service to institutional clients across its $62.6 trillion in assets under custody.
BNY Mellon is the world’s largest custody bank. Adding staking to a platform that already holds $62.6 trillion in assets means every institutional client that already trusts BNY with their holdings can now earn yield on crypto without changing custodian. That removes one of the last remaining friction points keeping large institutional allocators from treating crypto staking as a standard yield strategy alongside bonds and dividends.
The US and UK Aligned Stablecoin Reserve Standards, Opening Cross-Border Market Access
The US and UK issued a joint statement aligning stablecoin reserve and redemption standards, creating a potential path toward cross-border market access for issuers that comply with both frameworks.
Two of the world’s largest financial markets agreeing on stablecoin standards is the kind of regulatory coordination the industry has been asking for since stablecoins became systemically significant. A compliant issuer that meets both US and UK requirements could operate across both markets without separate licensing processes. That dramatically lowers the barrier to operating at scale and gives compliant issuers a meaningful advantage over those cutting corners on reserves.
The CLARITY Act Cloture Motion Was Filed but No Vote Will Happen Before August Recess
The US Senate filed a cloture motion on the CLARITY Act but confirmed no floor vote would occur before the August recess, pushing crypto market structure legislation into September at the earliest.
Filing a cloture motion is a procedural step that signals the bill has enough support to eventually move forward, but the August recess delay means another month passes without the regulatory clarity US crypto companies have been operating without for years. September is now the earliest realistic window. Every week that passes without a framework is another week where companies make compliance decisions based on uncertainty rather than law.
Brazil Mandated a 24-Hour Delay on Crypto Transfers Over $10,000 to Foreign Wallets
Brazil’s central bank published a rule requiring a 24-hour delay on crypto transfers exceeding $10,000 sent to foreign exchanges or self-custody wallets, effective 2027.
A mandatory 24-hour hold on large outbound crypto transfers is a capital control by another name. Brazil is one of the largest crypto markets in Latin America, with millions of active users. The rule targets the specific flow that regulators worry about most: large amounts leaving the domestic financial system. For individual users moving their own funds to cold storage abroad, this adds a full day of friction and uncertainty to every significant transfer.
Bitcoin ETFs Logged Over $750 Million in Weekly Inflows with BlackRock Adding $479 Million in Three Days
US spot Bitcoin ETFs recorded more than $750 million in net weekly inflows, with BlackRock’s IBIT alone accounting for $479 million across just three trading days.
$479 million into a single ETF in three days is a pace that would rank among the strongest inflow weeks in IBIT’s history. Combined with the broader $750 million weekly total, this reverses the outflow trend that had been building through most of July. Bitcoin climbing toward $65,000 on the back of a weaker jobs report added fuel. When macro conditions ease and ETF flows turn positive simultaneously, the price tends to move faster than either signal alone would suggest.
Bitcoin’s BIP-110 Soft Fork Failed with Only 2.53% Miner Support and Split the Chain
Bitcoin’s proposed BIP-110 soft fork failed to gain sufficient miner support, splitting off the main chain at block 961,632 with only 2.53% of miners backing the proposal.
2.53% miner support for a soft fork that splits the chain is a near-total rejection. Bitcoin protocol changes require overwhelming consensus because the network’s security model depends on miners, nodes, and users agreeing on the same rules. A fork backed by fewer than 3% of miners produces a minority chain with almost no security. BIP-110 is effectively dead, and the chain it produced will likely be abandoned as miners refuse to extend it.
Wrapping Up
This week had the Coldcard hack growing from $38 million to $130 million across 5,200 wallets, making it the year’s third-largest theft. Bybit took the unprecedented step of suing North Korea in a US court. Circle launched its Arc blockchain with some of the most powerful validators in traditional finance. BNY Mellon added staking to a platform holding $62.6 trillion. Bitcoin ETFs pulled in $750 million in a week. The CLARITY Act is delayed again. Brazil added a 24-hour hold on large crypto transfers. And a Bitcoin soft fork died with 2.53% support. The institutional infrastructure keeps strengthening while the security layer and regulatory timeline both keep slipping.
Disclaimer: Do not invest unless you are prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong.
Disclaimer: Don’t invest unless you’re prepared to lose all the money you invest. This is a high‑risk investment and you should not expect to be protected if something goes wrong. Take 2 mins to learn more at: https://go.payb.is/FCA-Info
