Attackers exploited a five-year-old firmware flaw in Coldcard hardware wallets to drain more than $130 million in Bitcoin from over 5,200 addresses, making it the year’s third-largest crypto hack. Bybit filed a civil lawsuit against North Korea and the Lazarus Group over last year’s $1.5 billion theft and secured a US court injunction freezing identified assets. Circle named BlackRock, Visa, Mastercard and seven other institutions as founding validators for its Arc blockchain launching September 16. US spot Bitcoin ETFs logged more than $750 million in weekly inflows. Here is a clear look at the most important crypto and tech stories making headlines.<\/p>\n\n\n\n
Attackers exploited a five-year-old firmware flaw<\/a> in Coinkite’s Coldcard hardware wallets, draining more than $130 million in Bitcoin from over 5,200 addresses. It is the third-largest crypto hack of 2026 so far.<\/p>\n\n\n\n A vulnerability sitting undetected in a hardware wallet for five years means thousands of people were holding funds in devices they believed were secure while the attack surface existed the entire time. 5,200 addresses drained is not a targeted strike on a few large holders. It is a broad sweep across a large portion of the Coldcard user base. Galaxy Research has already identified 15 separate wallets behind the attack, which suggests investigators have a trail to follow, but the $130 million is almost certainly already moving through mixers.<\/p>\n\n\n\n Bybit filed a civil lawsuit<\/a> against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over last year’s $1.5 billion hack, and secured a US court injunction freezing identified stolen assets.<\/p>\n\n\n\n Suing a nation-state for a crypto hack is not a legal strategy that ends with a settlement check. North Korea will not appear in a US court. What the lawsuit does accomplish is creating a legal mechanism to freeze any identified stolen assets the moment they touch a jurisdiction that recognizes the injunction. $1.5 billion is the largest single crypto theft in history. Bybit is using the US legal system to build a perimeter around wherever those funds eventually surface.<\/p>\n\n\n\n Circle announced BlackRock, Visa, Mastercard, DTCC and seven other institutions<\/a> as founding validators for its Arc blockchain, ahead of a September 16 mainnet launch.<\/p>\n\n\n\n A blockchain launching with BlackRock, Visa, Mastercard and DTCC as its founding validators is starting from a position most chains spend years trying to reach. DTCC alone clears tens of trillions in securities annually. If Arc integrates with that infrastructure from day one, it is not competing with other blockchains for adoption. It is embedding itself into the settlement layer of traditional finance before it even launches.<\/p>\n\n\n\n BitGo named Chainlink CCIP its exclusive cross-chain infrastructure provider<\/a>, migrating more than $7.7 billion of Wrapped Bitcoin away from LayerZero in a single infrastructure decision.<\/p>\n\n\n\n $7.7 billion moving from one cross-chain provider to another is a significant vote of confidence for Chainlink and a significant blow to LayerZero. Wrapped Bitcoin is one of the most used assets in DeFi. When the custodian controlling that much WBTC switches its entire cross-chain infrastructure, other protocols pay attention. Chainlink now handles close to $15 billion in cross-chain assets after this move.<\/p>\n\n\n\n BNY Mellon partnered with Galaxy Digital<\/a> to add crypto staking to its Digital Asset Custody platform, extending the service to institutional clients across its $62.6 trillion in assets under custody.<\/p>\n\n\n\n BNY Mellon is the world’s largest custody bank. Adding staking to a platform that already holds $62.6 trillion in assets means every institutional client that already trusts BNY with their holdings can now earn yield on crypto without changing custodian. That removes one of the last remaining friction points keeping large institutional allocators from treating crypto staking as a standard yield strategy alongside bonds and dividends.<\/p>\n\n\n\n The US and UK issued a joint statement<\/a> aligning stablecoin reserve and redemption standards, creating a potential path toward cross-border market access for issuers that comply with both frameworks.<\/p>\n\n\n\n Two of the world’s largest financial markets agreeing on stablecoin standards is the kind of regulatory coordination the industry has been asking for since stablecoins became systemically significant. A compliant issuer that meets both US and UK requirements could operate across both markets without separate licensing processes. That dramatically lowers the barrier to operating at scale and gives compliant issuers a meaningful advantage over those cutting corners on reserves.<\/p>\n\n\n\n The US Senate filed a cloture motion on the CLARITY Act<\/a> but confirmed no floor vote would occur before the August recess, pushing crypto market structure legislation into September at the earliest.<\/p>\n\n\n\n Filing a cloture motion is a procedural step that signals the bill has enough support to eventually move forward, but the August recess delay means another month passes without the regulatory clarity US crypto companies have been operating without for years. September is now the earliest realistic window. Every week that passes without a framework is another week where companies make compliance decisions based on uncertainty rather than law.<\/p>\n\n\n\n Brazil’s central bank published a rule<\/a> requiring a 24-hour delay on crypto transfers exceeding $10,000 sent to foreign exchanges or self-custody wallets, effective 2027.<\/p>\n\n\n\n A mandatory 24-hour hold on large outbound crypto transfers is a capital control by another name. Brazil is one of the largest crypto markets in Latin America, with millions of active users. The rule targets the specific flow that regulators worry about most: large amounts leaving the domestic financial system. For individual users moving their own funds to cold storage abroad, this adds a full day of friction and uncertainty to every significant transfer.<\/p>\n\n\n\nBybit Sued North Korea and the Lazarus Group Over the $1.5 Billion Hack and Froze Identified Assets<\/h2>\n\n\n\n
Circle Named BlackRock, Visa, Mastercard and Nine Other Institutions as Arc Blockchain Validators<\/h2>\n\n\n\n
BitGo Moved $7.7 Billion in Wrapped Bitcoin from LayerZero to Chainlink<\/h2>\n\n\n\n
BNY Mellon Added Crypto Staking to Its Custody Platform Covering $62.6 Trillion in Assets<\/h2>\n\n\n\n
The US and UK Aligned Stablecoin Reserve Standards, Opening Cross-Border Market Access<\/h2>\n\n\n\n
The CLARITY Act Cloture Motion Was Filed but No Vote Will Happen Before August Recess<\/h2>\n\n\n\n
Brazil Mandated a 24-Hour Delay on Crypto Transfers Over $10,000 to Foreign Wallets<\/h2>\n\n\n\n
Bitcoin ETFs Logged Over $750 Million in Weekly Inflows with BlackRock Adding $479 Million in Three Days<\/h2>\n\n\n\n