Edition · 2026-08-04
More Top Stories
The Coldcard hardware wallet exploit drained more than 1,300 bitcoin, valued at roughly $83 million, from thousands of addresses in multiple waves. The vulnerability, introduced in 2021, reduced seed entropy and allowed attackers to brute‑force affected wallets without physical access. Researchers have identified up to a fourth wave of thefts, according to Galaxy Digital head of research Alex Thorn. Jameson Lopp, co‑founder of Casa, said the incident does not invalidate self‑custody but highlights limits of the "don't trust, verify" principle, noting that full verification of complex software and hardware is impractical for most users. He added that users inevitably rely on hardware vendors, software developers and security researchers, creating elements of trust. Lopp emphasized that self‑custody remains viable if users accept its responsibilities and avoid trusting any single component. Zach Herbert, CEO of the Coldcard foundation, described the exploit as dangerous and called for stronger security practices rather than concluding that self‑custody is dead. Lopp said advances in artificial intelligence have accelerated vulnerability discovery, increasing the speed of both attack identification and defensive code review. He noted that similar hardware failures have occurred before and raised industry security standards. The industry is urged to improve best practices while maintaining the value proposition of self‑custody.
Galaxy Research reported that confirmed losses from the Coldcard Bitcoin wallet incident have exceeded $100 million, with 1,596 BTC stolen from roughly 7,300 addresses across three major attack waves and 14 smaller incidents. The theft involved 73 identified victims who contacted the research team.
Coldcard is a hardware wallet that stores private keys offline. A vulnerability in its firmware allowed attackers to extract private keys and transfer funds.
Galaxy said the first three attacks were confirmed by victim reports, which helped investigators map smaller transaction footprints that may represent opportunistic exploitation of the flaw. A fourth wave is suspected and could raise total stolen BTC to 2,055, valued at about $130 million, though the group has not yet received confirmation from those victims. The research team assigned medium‑high confidence to the fourth wave, indicating it likely reflects attacker activity. Approximately 90 percent of the stolen Bitcoin has not been moved, including funds from the three confirmed incidents. Attacker and victim addresses have been shared with U.S. federal law enforcement, crypto exchanges, and cyber‑investigation firms. Galaxy updated its estimate from 1,367 BTC traced across 4,585 addresses to the current figure.
Galaxy warned that attacks remain ongoing and urged Coldcard users to migrate their funds to a secure address immediately.
Mastercard completed its $1.8 billion acquisition of BVNK, a stablecoin infrastructure provider, on Monday, finalizing a deal announced in March that includes $300 million in contingent payments. Mastercard said the transaction combines its global payments network with BVNK’s on‑chain platform to connect digital currencies with fiat, supporting stablecoin use in cross‑border payments, payouts, settlement and treasury flows. The company noted that the integration will help banks, fintechs and enterprises expand the use of stablecoins and tokenized assets. BVNK said its customers will continue to use the same teams, products and integrations, requiring no action from users, and that the tie‑up could enable banks to offer stablecoin payment services and allow customer accounts to connect to wallets. Payment providers may also gain the ability to enable round‑the‑clock merchant settlement. Mastercard’s global reach is expected to expand its card capabilities and international fund transfer services. The deal, which closed after a $2 billion transaction between Coinbase and BVNK was abandoned in November 2025, reflects increasing integration of stablecoins into traditional financial services.
By · 80d ago · Source: bbc
Twenty-Five U.S. states filed a lawsuit Monday against the Trump administration over new tariffs ranging from 10% to 12.5% on imports from roughly 60 countries. The tariffs, which took effect in July under Section 301 of the 1974 Trade Act, were imposed on major trading partners such as Japan, Brazil and Taiwan and cover 99.4% of U.S. imports, according to the Office of the U.S. Trade Representative. The coalition of states, led by Democratic attorneys general, argued that the tariffs were arbitrary, capricious and contrary to law, citing the statute’s requirement that any trade restriction address proven instances of forced labour. The legal complaint said the administration could not use alleged forced‑labour concerns as a pretext for sweeping duties that exceed the scope authorized by Congress. White House spokesman Kush Desai responded that the United States was exercising its lawful authority to address practices that burden American businesses, adding that countries failing to curb imports made with forced labour were acting unreasonably. New York Governor Kathy Hochul and Oregon Attorney General Dan Rayfield characterized the tariffs as a tax on working families and homegrown businesses, asserting that the measures were unlawful. Brazil and Japan’s governments described the measures as unjustified, while China’s foreign ministry said the tariffs served as an excuse for political manipulation. Analysts have questioned whether affected nations could substantiate forced‑labour claims required for the duties. The lawsuit represents the latest in a series of trade actions taken by the Trump administration since his return to office in January 2025. Earlier tariffs announced during “Liberation Day” in April 2024 were struck down by the Supreme Court, leading to a temporary 10% levy that expired in July. The administration is currently investigating 16 countries for possible manufacturing overcapacity, suggesting additional tariffs may be considered.
FBI counterintelligence agent Patrick Steven Yarmoch was arrested on July 31, 2026, and charged with allegedly stealing more than $1 million in cryptocurrency from individuals under investigation by the agency.
Yarmoch, a supervisory special agent with top‑secret clearance, served in the FBI’s counterintelligence division at headquarters in Washington and previously in a national‑security unit in Boston.
According to a filing submitted to the U.S. District Court for the Eastern District of Virginia, Yarmoch extracted crypto keys from FBI systems and transferred the assets to his own accounts using the exchanges Kraken and the decentralized finance platform Suilend on the Sui blockchain.
The filing noted that Yarmoch had been suspended for a short period before his arrest and that he traveled to Portugal, Germany and Grenada without reporting the trips, a violation of FBI policy. Travel plans for a family trip to Portugal scheduled for the following month were also identified. He had asked AI tools for advice on leaving the United States and becoming a resident of an EU country, and the tools recommended Portugal.
The court document did not include a statement from the FBI, and the case remains pending. Yarmoch was placed in detention in Alexandria, Virginia.
The arrest underscores the risk of insider threats within federal law‑enforcement agencies and raises questions about oversight of digital‑asset investigations.
Bitcoin fell 1.5% on August 3, 2026, to $62,595, and ether dropped about 2% to $1,842 as the Coldcard hardware wallet hack entered its fifth day. Analysts at Marex said the $114 million theft raised concerns and led some to move coins back to exchanges, contrary to the self‑custody model. Derivatives data showed mixed signals: BTC futures open interest rose to a one‑month high of 772,000 BTC, and the long‑short ratio indicated a slight bias toward short positions, with more than 52% of taker volume in shorts. Funding rates for BTC futures remained moderately positive at about 4% annualized. Options activity was concentrated on $68,000 and $70,000 call contracts, and 30‑day implied volatility held steady near 37%. NEAR Protocol reported lifetime volume of $24 billion for its Intents system and introduced quantum‑safe signing, dynamic resharding and AI compute staking. Its native token traded around $1.72. Bitcoin’s 200‑week simple moving average stayed above $63,000, prompting Strategy’s Michael Saylor to note the firm’s continued tracking of the level.
Mastercard finalized its purchase of BVNK, a stablecoin infrastructure provider, for up to $1.8 billion, including $300 million in contingent payments, as announced in March. The deal gives Mastercard direct control over technology that lets businesses move value between fiat and blockchain networks. BVNK offers APIs for stablecoin payments, cross‑border transfers, payouts, settlements and treasury operations and operates from London and San Francisco while holding licenses in multiple jurisdictions. Mastercard said the integration will enable a single payment system that connects fiat rails with blockchain rails, supporting stablecoins for cross‑border B2B payments, remittances, payouts and treasury flows. Jorn Lambert, Mastercard chief product officer, noted that stablecoins are increasingly meeting real‑world payment needs. He added that the company expects fiat currencies, stablecoins, tokenized deposits and other forms of value to coexist within a connected system. The acquisition follows Mastercard’s participation in the Open Standard consortium, which is developing the Open USD stablecoin, and its launch of Agent Pay for Machines, a service for automated high‑volume, low‑value transactions using cards and stablecoins. Other investors in BVNK include Concentric, Tiger Global, Haun Ventures, Visa Ventures, Citi Ventures, Coinbase Ventures and others. Kjartan Rist, co‑founder of Concentric, said that when the firm first invested, stablecoins were not yet mainstream and viewed the technology as a way to rebuild global payment infrastructure. Mastercard must now integrate BVNK’s technology, licenses and relationships into its network; it has not disclosed a rollout schedule or whether BVNK will retain its brand. The transaction adds Mastercard to a competitive field that includes Visa and other firms building services that link regulated financial institutions with blockchain settlement systems under clearer U.S. regulations. Mastercard’s shares closed at $570.97, a 0.4% decline, indicating limited immediate market reaction. The integration timeline and branding decisions remain undisclosed, leaving the impact of the acquisition on Mastercard’s stablecoin strategy uncertain.
EU Council Regulation (EU) 2026/1848 adds HTX (HUOBI GLOBAL SA) to a sanctions list, effective August 23, 2026, prohibiting direct and indirect transactions with the exchange within EU jurisdiction. The regulation extends the prohibition to entities acting for or at the direction of HTX and to firms providing services as mirrors or successors. It applies to any person or entity subject to EU law, including member‑state nationals, companies formed under member‑state law, and any business conducted partly in the Union. After the cutoff date, individuals seeking to withdraw funds or close accounts must either complete transactions before August 23, 2026, or obtain a discretionary authorization from a competent authority of an EU, EEA, or Swiss member state. The authorization is limited to transactions strictly necessary to exit the account, requires termination of all agreements with HTX, and is valid for no more than three months. The provision covers natural persons holding residence permits in the EU, EEA, or Switzerland, but does not extend to corporate customers. Requests must be filed within three months of the ban’s start, and authorized transfers must be sent to a credit or financial institution formed under EU member‑state law or to a third‑country institution owned or controlled by an EU member state; self‑custody wallets are not specified as eligible destinations. HTX’s user agreement already bars residents of EU member states from using its services, so the new rule does not broaden restrictions to the existing EU resident user base. Potential residual exposure includes remaining accounts, EU nationals abroad, and counterparties, though the size of these groups has not been quantified. HTX previously stated that Huobi Global SA is distinct from its online exchange, but the EU regulation names the two entities together, leaving the company’s specific response unclear. The restriction creates a deadline for exiting positions with HTX, and eligible users must seek authority approval or risk being unable to withdraw after August 23, 2026.
Beast of Reincarnation is an action role-playing game developed by Game Freak and published by Fictions, Inc. for PC, PlayStation 5, and Xbox Series X/S. The game's storyline is set in the year 4026, portraying a world where a spreading blight named the Beast of Reincarnation threatens humanity. In this setting, some humans have transferred their souls into immortal machine Golems, while others remain in flesh and fear contamination. The world's fauna have been transformed into monstrous Malefacts. The main character, Emma, is a Purifier who can absorb the blight to use its powers against enemies. She is accompanied by Koo, a large dog with similar abilities and a mysterious connection to Emma. The game includes exploration of several zone maps, combat that incorporates parrying and a variety of abilities for both Emma and Koo, and equipment upgrades that affect their stats. Visuals were shown in Quality Mode on a base PlayStation 5, with reported occasional asset streaming issues and UI challenges regarding item management. A review code for the PlayStation 5 was provided to the reviewer. The review assigned an overall grade of A‑, with scores for graphics (A‑), sound/music (B+), gameplay (A), and presentation (B+).
A screening of Spider-Man: Brand New Day in Cartagena, Colombia, on August 2 was halted as audience members evacuated due to a foul odor from a viewer's flatulence. The incident occurred at the Cine Colombia multiplex inside Plaza Bocagrande shopping center around midday, according to reports. Security personnel escorted the crowd out while the film continued playing, and the theater did not issue a public statement. Social media clips showed attendees leaving into the hallway, including a person in a Spider-Man costume on a phone call. Online users posted jokes about the event, but no culprit has been identified. The movie opened with a domestic gross of $360 million, surpassing the previous record set by Avengers: Endgame, and has earned $932 million worldwide, ranking second among 2026 releases. IMAX screenings began on August 7, and the film is projected to exceed $1 billion in total revenue. The incident remains unexplained, and the film's continued success will be watched as it approaches the $1 billion milestone.
This edition was assembled from neutral, agent-rewritten summaries of the day's aggregated news.
Why it matters: Every article was reviewed for loaded language, partisan framing, and missing attribution before publication.