Market SitRep · CW32 2026 · Monday
A Coldcard entropy flaw is driving multi-wallet Bitcoin sweeps, US spot BTC ETFs flipped from a strong creation day into heavy month-end redemptions, and CLARITY advanced on paper while 2026 enactment odds sat near 28% as the recess clock tightened.
by Fenris | Market Intelligence
GM!
A Coldcard entropy flaw is driving multi-wallet Bitcoin sweeps, US spot BTC ETFs flipped from a strong creation day into heavy month-end redemptions, and CLARITY advanced on paper while 2026 enactment odds sat near 28% as the recess clock tightened.
Market snapshot (CoinGecko, live vs ~7d, as-of 3 August 2026 04:58 UTC): BTC $62,781 (-3.87%) · ETH $1,855.02 (-4.96%) · SOL $72.83 (-4.93%). Source: Bitcoin, Ethereum, Solana on CoinGecko.
Coldcard entropy flaw drives multi-wallet BTC sweeps
Coinkite warned on 30 July (updated 1 August) that a March 2021 Coldcard firmware path generated seeds with a weak software random-number generator. Attackers offline-enumerated those seeds and swept air-gapped Bitcoin without physical access. Galaxy Research maps about 1,367 BTC (~$88.6M at report time) across 4,585 addresses after three observed waves, as of 1-2 August.
Why it matters: a firmware update does not repair old seeds. Affected users need full seed migration. In absolute terms the loss is local next to major exchange failures, but the public narrative is that self-custody itself has been hit. Opponents of crypto will use that perception to steer people into bank and other custodial arrangements. We still recommend self-custody: losses at centralized custodians and unregulated exchanges have historically been far larger, often with little or no recourse for the customer. Prefer proven entropy and process over brand trust.
Sources
- Coinkite: Coldcard seed generation warning (30 Jul, upd 1 Aug)
- Coinkite entropy technical backgrounder
- Block Engineering: predictable RNG fallback in Coldcard firmware
- The Hacker News: Coldcard flaw linked to BTC sweeps (1 Aug)
- Galaxy Research: third-wave total ~1,367 BTC (X, ~1-2 Aug)
- CoinDesk: losses near $89M / ~4,500 addresses (2 Aug)
- Coldcard upgrade docs
US spot BTC ETFs flip from +$233M to -$265M into month-end
Farside shows US spot Bitcoin ETFs took in $233.1M on 30 July, then redeemed $265.4M on 31 July, led by BlackRock's IBIT at -$122.7M. July finished only modestly net positive at about +$173M after prior outflow months.
Why it matters: ETF flow is the main regulated spot bid. Month-end left July weak into thinner August liquidity. One redemption day is not a structural exit. Watch the next three sessions and whether cumulative inflows rebuild above $500M.
Sources
CLARITY recess risk: merged text up, 2026 odds near 28%
Since last Monday's SitRep, process moved on paper and odds did not. Paul Hastings reports a 22 July updated merged Senate CLARITY text with a White House ethics title. Leader Thune doubted a pre-recess floor path on 23 July. Polymarket priced 2026 enactment near 28% Yes at retrieval: crowd odds then, not a forecast.
Why it matters: CLARITY would clarify which US regulators cover exchanges and tokens. A merged draft is not passage. Watch a floor vote path before recess.
Sources
- Paul Hastings: updated CLARITY Act text (27 Jul)
- Polymarket: CLARITY Act signed into law in 2026
- Congress.gov: H.R.3633 (119th)
- Lummis: updated CLARITY Act text
Conclusion
From these points we conclude:
Coldcard is local loss, public trust hit
~1,367 BTC (~$88.6M) across 4,585 addresses after three waves as of 1-2 August. Absolute loss is local vs exchange failures, but the public narrative is that self-custody has been hit and can be used to push bank/custodial arrangements. We still recommend self-custody: historical custodian and unregulated-exchange losses have been far larger, often with little or no consumer recourse. Prefer proven entropy and process over brand trust. Affected firmware needs full seed migration; a patch does not heal old entropy.
Spot BTC ETF demand flipped soft at month-end
+$233M creation then -$265M redemptions left July weak into thinner August liquidity; one redemption day is not a structural exit.
CLARITY text advanced; odds and calendar did not
Merged draft plus ethics title is progress; 2026 enactment near 28% Yes is crowd odds, and recess arrives without a floor path unless that clears.
GM.
Software and engineering services. Not financial, tax, or investment advice.