Coldcard losses pass $114 million. Strategy monetizes 1,690 BTC. BIP-110 stalls after two blocks.
The largest hardware wallet exploit on record climbs past $114 million, spot ETFs post their strongest week since April, Strategy sells 1,690 BTC to repurchase STRC, the Clarity Act slips to September, and BIP-110’s minority chain dies after two blocks.
Welcome to the seventh edition of The Consolidation. The past two weeks were dominated by the Coldcard seed-generation flaw, now the largest hardware wallet exploit on record, and by its second-order effects: renewed spot ETF demand as some holders rotate into regulated vehicles, and fresh scrutiny of entropy practices across the hardware wallet sector. Elsewhere Strategy monetized 1,690 BTC to repurchase STRC and lift its USD reserve to $4.65 billion, the Clarity Act slipped past the August recess, and BIP-110’s minority chain stalled after two blocks while the main chain ran on undisturbed. We also published Dan Hillery’s first credit note, Buried in Collateral, on what actually drove the STRC recovery. As always, we welcome your feedback as we refine future editions.
Seven headlines shaping the Bitcoin landscape over the past two weeks.
Coldcard seed-generation flaw drives Bitcoin losses past $114 million
Why it matters: A firmware bug dating to March 2021 caused Coldcard devices to generate weak seeds via a software PRNG instead of the hardware RNG, enabling offline brute-force of private keys. Losses have climbed past $114 million, with estimates now near $130 million across more than 7,000 addresses, in multiple waves since July 30. Coinkite has halted shipments and destroyed vulnerable inventory. Security researchers and Galaxy Research tracking the waves describe it as the largest hardware wallet exploit on record; community reaction mixes urgency on migration with broader questions about open-source audit practices.
U.S. spot Bitcoin ETFs take in roughly $750 million over four August sessions
Why it matters: U.S. spot Bitcoin ETFs recorded roughly $750–760 million in net inflows over the first four trading days of August, the strongest weekly pace since April, with BlackRock’s IBIT leading most sessions. Some analysts link the flows to holders rotating out of self-custody and into regulated vehicles following the Coldcard events. The pattern is worth watching for what it says about where displaced self-custody balances land rather than for the headline number alone.
Strategy sells 1,690 BTC, raises $653M from shares, lifts USD reserve to $4.65 billion
Why it matters: Between August 3 and 9 Strategy sold 1,690 BTC for $108.6 million at an average of $64,262 and used the proceeds to repurchase 1.15 million STRC preferred shares. Separately it sold 6.59 million MSTR shares for $653.1 million, directing $650 million into the USD reserve, which now stands at $4.65 billion. Bitcoin holdings fell to 840,447 BTC at an average cost of $75,385. Market reaction has been measured: the sales read as balance-sheet management under the company’s formal monetization and capital framework rather than a shift away from the long-term treasury thesis.
UTXO publishes “Buried in Collateral” on what actually drove the STRC recovery
Why it matters: Dan Hillery’s first credit note for UTXO argues that STRC’s recovery from a $73 June low to roughly $95 was driven less by Bitcoin’s price than by the collateral construction of Strategy’s balance sheet. Rebuilding the USD reserve to two full years of dividend coverage bottomed the security, and $106.2 million of buybacks between July 20 and August 2, just 5% and 14% of weekly dollar volume, lifted it out of a locked $85 to $90 range. The note positions STRF as the senior-most reference point, with the smallest drawdown of the June stress at -16.9% against MSTR’s -58.0%, and flags STRK as the most likely next buyback candidate.
Dan Hillery joins UTXO Management as VP of Credit
Why it matters: Hillery will lead credit research and market coverage across digital credit and help shape fixed income strategies at the firm. Digital credit, the category of perpetual preferred equities issued by Bitcoin treasury companies, has grown to roughly $16 billion outstanding since early 2025, with Strategy and Strive among the key issuers. Hillery previously founded Stravera Capital, served as Head of Treasury at Buck, and is a founding member of True North at Strive, where he publishes credit research on Bitcoin structured products.
Clarity Act floor vote delayed until September
Why it matters: Senate Majority Leader John Thune confirmed the long-awaited Clarity Act will not receive a floor vote before the August recess. Democrats insisted on no vote, and the bill is now queued for September. President Trump criticized the ethics demands, noted rising everyday Bitcoin payments, and said the U.S. must lead China on crypto and AI. Republicans place the delay on Democratic resistance; institutional support from firms such as Goldman Sachs and Fidelity remains intact.
BIP-110 minority chain stalls after two blocks as consensus functions as designed
Why it matters: BIP-110, a temporary soft-fork proposal to restrict non-financial data such as Ordinals inscriptions, entered its mandatory signaling window at block 961,632 over the weekend. Nodes enforcing the rules rejected non-signaling blocks and followed a minority chain, which produced only two blocks (mined via Ocean by Roughnecks) before stalling. Miner signaling in the preceding period stood at just 2.53 percent, far below the 55 percent threshold, and the main chain continued uninterrupted and rapidly pulled ahead. Market and developer reaction treated the episode as confirmation that user-activated proposals lacking broad support cannot override network consensus.
The Coldcard vulnerability: the clearest self-custody stress test of 2026.
A single build-flag error in 2021 firmware produced the largest hardware wallet exploit on record.
Our view on macro and the Bitcoin market.
Consolidating near $64,300 as ETF demand returns and larger wallets absorb retail supply.
Bitcoin traded in a $62,000 to $65,000 range across the two-week window and closed the period near $64,300. Spot ETF flows flipped decisively positive in early August after a weak July, adding roughly $750 million in four sessions and providing the main demand support.1 Whale and shark cohorts, meaning wallets holding 10 to 10,000 BTC, accumulated more than 20,000 BTC since late July while smaller retail balances continued to contract: a classic absorption pattern.
Regulatory progress on the Clarity Act remains stalled at the ethics language stage and now faces a September timeline after the August recess. Treasury companies showed mixed activity. Strategy continues its capital markets program and added employee benefits aligned with the new Trump Accounts framework; Metaplanet paused accumulation while building its licensed distribution platform; MARA’s production growth was offset by mark-to-market losses.
Our read: on-chain signals remain constructive for the medium term. Long-term holders are not distributing aggressively, and the Coldcard migrations appear to be storage rotations rather than outright exits. Price is consolidating; the next decisive move will likely track either sustained ETF demand or clarity on the market-structure bill.
The Coldcard Vulnerability
UTXO Management · Security Note
Our assessment of the July 2026 Coldcard seed-generation flaw: how a weak RNG let attackers sweep 1,082 BTC from 1,196 addresses in 41 minutes, why UTXO holdings were never exposed, migration guidance for potentially affected setups, and what the incident means for self-custody in the age of AI.
Open the Report →Get The Consolidation every other Monday.
Institutional Bitcoin intelligence in your inbox. Questions or a topic for the next issue? Forward this to a colleague who would find it useful.
A single build-flag error in firmware 4.0.1 (March 2021) caused seed generation to fall back to a weak software PRNG on Mk2 and Mk3 devices, roughly 40 bits of entropy, and left residual weakness on later models. Attackers reconstructed private keys offline, scanned the chain for matching addresses, and executed rapid sweeps: one wave moved over 1,000 BTC in under an hour. Confirmed losses sit above $114 million, with estimates approaching $130 million across thousands of addresses, many of them long dormant.1
Coinkite has released fixed firmware, destroyed remaining vulnerable inventory, and halted shipments. Firmware updates do not repair seeds generated under the flawed code; the only remedy is new seed generation on a clean device followed by fund migration. The episode has already produced secondary effects: elevated ETF inflows as some holders rotate into regulated vehicles, and renewed scrutiny of open-source entropy practices across the hardware wallet sector.
Our read: entropy quality is the one part of a hardware wallet a holder cannot verify after the fact. A signature can be checked and a firmware hash can be compared, but a seed that looks random and is not gives no signal at all until the coins are gone. That asymmetry, more than the specific bug, is what deserves attention: audit practices across the sector need to cover the code paths that never surface a visible error. Self-custody remains the right default for long-term holdings, and this incident argues for better verification tooling rather than a retreat to third-party custody.