A Hardware Wallet Flaw Drains $38 Million, New York Sues Kalshi, and Traders Are Already Buying August Downside

A firmware flaw in Coldcard hardware wallets let an attacker drain 594 Bitcoin in under half an hour, which is about as bad as cold storage news gets.

Meanwhile, July is closing as crypto’s strongest month since last summer, and traders are celebrating by loading up on protection against a drop below $60,000.

Policy Impact (Sponsored)

Trump Admin to Pump $1 Billion into this "Off-the-Radar" AI Stock

The U.S. government pumped more than $1 billion into Intel.

The stock popped 128%. It pumped $400 million into MP Materials.

The stock popped 200%. It bought 10% of Trilogy Metals.

The stock popped 500%.

And now, Trump has chosen this AI stock for a $1 billion payday.

Click here for the full story and stock pick (free).

This ad is sent on behalf of InvestorPlace Media at 1125 N. Charles Street, Baltimore, Maryland 21201. If you're not interested in this opportunity, please click here.

Market-Moving News

Three things worth your time as the month closes. Attackers exploited a flaw in one of the most trusted hardware wallets in crypto and walked away with tens of millions in Bitcoin.

New York’s attorney general filed suit against Kalshi, calling its prediction markets unlicensed gambling, which puts the entire category on notice.

And the CoinDesk 20 is closing out its best month in a year while the options market quietly stacks bets on an August drop.

Good month, nervous traders. That gap is the story.

Regulation

New York Opens $36B Fight Against Kalshi

New York has sued Kalshi, alleging the prediction-market platform operates an unlicensed gambling business despite its federal derivatives registration.

The state wants Kalshi blocked without a gaming license, ordered to repay customers, and forced to surrender gains. It also seeks penalties worth three times those gains and $100,000 for every unauthorized sports-wagering offer.

The potential claim could reach at least $36 billion, pending a full accounting.

Federal Approval Meets State Law

Kalshi operates as a Commodity Futures Trading Commission-registered exchange and argues that states cannot override federal control of event contracts.

New York rejects that defense. Its filing says contracts tied to sports, elections, culture, and entertainment amount to gambling when users stake money on outcomes outside their control.

The state also alleges Kalshi accepts users aged 18 to 20, below New York’s minimum age of 21 for mobile sports betting.

One Case Could Reshape Prediction Markets

A federal court denied Kalshi’s request to stop New York from enforcing its gambling laws earlier this month. If New York wins, prediction platforms may need separate state licenses even under federal commodities oversight.

Kalshi has not been ordered to pay $36 billion, and the allegations remain unproven. Final exposure depends on the accounting, court rulings, and appeals.

Take: You are watching prediction markets collide with state rules they hoped federal registration would replace. Your clearest signal is whether courts treat event contracts as national derivatives or local gambling products.

Markets

Bitcoin Volume Hits 2023 Low as Volatility Squeezes

Bitcoin’s daily price swings have tightened to their narrowest level since January, leaving the market trapped in one of its quietest stretches of 2026.

The Bollinger bandwidth indicator has fallen to 5.66 points as Bitcoin trades mainly between $62,000 and $65,000. Average daily spot volume dropped to about $2.2 billion in July, putting activity at its weakest level since November 2023.

The Market Is Running Out of Force

Bitcoin’s compressed range shows buyers and sellers struggling to take control. Momentum traders have fewer clean moves to follow, while range traders are competing for smaller swings. Derivatives activity has also softened, leaving less capital positioned to force a decisive break.

The setup resembles January, when tight volatility eventually gave way to a sharp move. History does not reveal whether the next break will run higher or lower.

Calm Can Become a Trap

A quiet market can encourage traders to increase leverage because recent moves look manageable.

The danger arrives when liquidity returns and Bitcoin escapes the range. Thin activity can make the first large order carry more influence, forcing leveraged positions to close and accelerating the move.

No indicator can predict the timing or direction of the break. The squeeze only shows that the current calm is becoming harder to maintain.

Take: You are looking at a Bitcoin market with shrinking volume, tighter price action, and fewer easy trades. Your real risk begins when the calm ends and leverage turns an ordinary breakout into a violent repricing.

Inside Trump’s Investment (Sponsored)

Trump’s $25 Million Secret Investment

President Trump reportedly invested as much as $25 million in one unusual investment.

There was no major announcement.

Yet the investment may be paying him up to $250,000 a month, and until recently, most Americans could not access the assets behind it.

Now, Alexander Green believes this little-known fund could become one of the most talked-about investments in the country.

And today, it trades for less than $20.

See how to access Trump’s unusual investment for under $20.

This ad is sent on behalf of The Oxford Club, 105 W. Monument Street Baltimore, MD 21201. If you would like to opt out from receiving offers from The Oxford Club, please click here

Corporates

Circle Adds New York Charter to USDC Regulatory Stack

Circle has secured a limited-purpose trust charter from the New York Department of Financial Services, adding a state-regulated entity to its expanding U.S. stablecoin infrastructure.

The approval comes three weeks after federal regulators authorized Circle National Trust, a national trust bank. Circle now has separate state and federal entities supporting its digital-asset operations.

Circle first received a New York BitLicense in 2015, but trust status provides broader fiduciary powers than that license alone.

Two Regulators, Different Roles

Circle National Trust will begin by providing fiduciary digital-asset custody for Circle and its affiliates. The company says management of the USDC reserve may move into the federally supervised bank later.

The New York trust charter adds state banking oversight and permits fiduciary activity. Circle has not published a full timetable showing how USDC operations will be divided between the two entities.

Neither approval turns Circle into a conventional commercial bank taking ordinary deposits or issuing consumer loans.

Regulation Becomes Infrastructure

Stablecoin competition is moving beyond circulation and transaction volume. Issuers now need custody, reserve controls, compliance systems, and regulatory structures that financial institutions can accept.

Circle is placing those functions inside overlapping state and federal frameworks instead of relying on one license.

Take: Circle now gives you a clearer test of whether deeper regulation can strengthen a stablecoin business without slowing it down.

Your next signal arrives when the two-charter structure begins supporting live custody and reserve operations, not merely collecting approvals.

Free Briefing (Sponsored)

The Next AI Opportunity?

Marc Chaikin, the 60-Year Wall Street legend who called Nvidia before it soared 45,000%, says a dramatic shift in AI is unfolding right now behind locked doors in Silicon Valley.

As AI wakes up and gains free will, Marc has prepared a FREE investment playbook specifically for this moment in history - including a backdoor, pre-IPO way into Anthropic before they go public.

All the details are FREE right here...

Future Forward

August opens with the options market already positioned defensively, which sets the tone for the first two weeks. Beyond that, one bridge exploit deadline is worth marking.

Market Events:

📊 August options positioning heavily weighted toward downside protection below $60,000

📊 Month-end index rebalancing as the CoinDesk 20 closes its strongest month since last summer

Deadlines:

⏰ Wanchain white-hat settlement window for the Cardano bridge attacker closes in about a week

Active Airdrop Programs:

🎁 Hyperliquid Season 2 (Live through Q3)

🎁 GRVT Season 1 claims (Now open following the token generation event)

Crypto Know-How: What a Hardware Wallet Actually Protects You From, and What It Doesn’t

The Coldcard exploit is going to make a lot of people nervous about hardware wallets this week. Before you panic-move everything to an exchange, it’s worth understanding what these devices actually do.

A hardware wallet’s job is narrow and specific: keep your private key isolated from any internet-connected device.

When you want to send funds, your computer builds the transaction and passes it to the hardware wallet, the device signs it internally using a key that never leaves the chip, and it hands back a signed transaction.

Your key never touches your laptop, so malware on your laptop cannot steal it. That’s the entire value proposition.

What that model assumes is that the device itself is trustworthy. The firmware running on it, the chip it uses, the random number generator that created your key in the first place, and the supply chain that delivered it to your door all have to be sound.

Break any one of those and the isolation is worthless, because the attacker is now inside the layer you were trusting to be safe.

The randomness piece deserves special attention because it is what failed here. Your seed phrase is supposed to be drawn from a pool so unimaginably large that guessing is pointless.

The industry standard is 128 bits of entropy, which means roughly 340 undecillion possible combinations. Coldcard’s affected firmware produced seeds with closer to 40 bits, because instead of using the device’s dedicated hardware randomness chip, it fell back on the serial number and internal clock.

Both of those follow patterns. Forty bits is around a trillion combinations, which sounds enormous until you realize a determined attacker with modern computing power can work through that in a reasonable amount of time. The wallet was never random. It just looked random.

That’s why this kind of exploit stings so much more than a phishing loss. Phishing is a user error you can learn from. A firmware flaw is a failure in the thing you bought specifically so you wouldn’t have to trust yourself.

The practical response is not abandoning hardware wallets, which remain far safer than leaving coins on an exchange. It’s refusing to concentrate everything behind one vendor.

Split holdings across devices from different manufacturers, keep firmware current, and verify receiving addresses on the device screen rather than your computer screen every single time.

Most importantly, if a meaningful amount of your net worth sits in one wallet from one company, that is a single point of failure regardless of how good that company’s reputation is.

Everything Else

• The edge is identifying small companies before the big moves begin and a free report names a handful showing those real early growth signals today.

• Coinbase reported second-quarter revenue of $1.22 billion, down 19% year over year, as trading volumes contracted across the industry and the exchange leaned harder on subscription and services income to offset the decline. 

• South Korea’s Kospi index surged as much as 17% in a record single-day rebound led by Samsung and SK Hynix jumping more than 23% each, following the largest US chip stock rally in over a year, yet crypto barely registered one of the sharpest equity moves of 2026. 

• Wanchain confirmed its Cardano bridge was attacked in late July, causing losses in NIGHT tokens, and has offered the attacker a white-hat settlement with a deadline in early August before pursuing other options. 

• The CFTC proposed new rules addressing conflicts of interest among vertically integrated derivatives businesses, opening a public comment period on a principles-based framework that would apply to firms operating multiple parts of the trading stack. 

• Open USD confirmed plans to launch on Ethereum with more than 140 participating companies including Visa, Mastercard, Stripe, BlackRock, and BNY Mellon, expanding the consortium-backed stablecoin beyond its initial deployment.