Coldcard Exploit Drains $90M as Clarity Act Stalls and Crypto Earnings Disappoint
A Coldcard wallet exploit drained $90M in Bitcoin, driving small holders to exchanges as the attack continues. Meanwhile, the Clarity Act faces a likely no-vote with days left, and crypto giants Coinbase and Strategy posted dismal Q2 earnings, deepening market gloom.
Quick Take
Coldcard exploit stolen $90M BTC via flawed seed generation; attack ongoing.
Bitcoin transfers under 1 BTC hit 39,600, highest since 2022 FTX collapse.
Clarity Act likely dead as clock runs out; partisan ethics battles persist.
Coinbase lost $359M, Strategy lost $8.22B on unrealized Bitcoin holdings.
Market Impact Analysis
BearishThe Coldcard exploit erodes trust in hardware wallets and may cause selling pressure; political uncertainty and weak earnings add to bearish sentiment.
Speculation Analysis
Key Takeaways
- Coldcard exploit drained $90M in Bitcoin via flawed seed generation, with attacks still ongoing.
- Small Bitcoin transfers surged to 39,600 BTC, the highest since FTX’s collapse, as users fled to exchanges.
- The Clarity Act faces near-zero odds of passing with days left, stalled by partisan ethics disputes.
- Coinbase and Strategy posted dismal quarterly results, fanning bearish flames.
What Happened
Coldcard hardware wallet users lost $90 million in Bitcoin after attackers exploited a flaw in the device’s seed generation. The exploit used a non-random number generator to compromise wallets, with at least three waves of theft. Galaxy Research reported 1,367 BTC ($88.6M) stolen from 4,585 addresses in the latest wave over the weekend.
Panic spread: small holders rushed to centralized exchanges. Bitcoin transfers below 1 BTC hit 39,600 BTC on Friday—the most since November 2022, days after FTX collapsed. Alex Thorn of Galaxy warned the attack is ongoing, urging immediate fund movement.
Separately, the Clarity Act—a bill to regulate crypto conflicts—appears doomed as the Senate runs out of time. Partisan bickering over enforcement and Trump’s crypto profits stalled progress. Meanwhile, crypto earnings disappointed. Coinbase reported a $359 million quarterly net loss, while Strategy posted an $8.22 billion loss tied to Bitcoin’s price slump.
The Numbers
Coldcard losses totaled $90M across all attacks. The third wave alone netted $88.6M from thousands of addresses. On-chain data showed 39,600 BTC in sub-1 BTC transfers on Friday, just 300 BTC shy of the post-FTX record. Coinbase’s $359M net loss widened from Q1, while Strategy’s $8.22B loss reflected Bitcoin’s decline and its aggressive buying near highs.
Why It Happened
The Coldcard flaw stems from insecure randomness in seed generation, a fundamental failure for a hardware wallet. Unlike previous wallet exploits, this didn’t require phishing—just a predictable seed. For the Clarity Act, partisan divides over enforcement (DoJ vs. state AGs) and Trump’s $1.4B crypto profits created a legislative impasse. On earnings, Bitcoin’s double-digit drop crimped revenue and magnified unrealized losses for firms like Strategy, which doubled down at peak prices.
Broader Impact
The Coldcard incident shatters trust in hardware wallets, a cornerstone of self-custody. The shift to exchanges, while temporary, signals panic—any further attacks could accelerate outflows. The Clarity Act’s failure leaves U.S. crypto rules in limbo, delaying clarity for issuers and developers. Disappointing earnings may weigh on crypto stocks and dampen institutional sentiment.
What to Watch Next
- Coldcard fund safety: if the exploit continues, expect more exchange inflows and potential BTC sell pressure.
- Legislative developments: any last-minute push on the Clarity Act or alternative bills could swing sentiment.
- Earnings season: watch for more firms reporting weak results, potentially dragging sector valuations.
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
