Bitcoin's Rough Week: A $130M Wallet Hack Collides With Washington's Crypto Deadline
A firmware flaw has drained over $130 million from "secure" Coldcard wallets, while the CLARITY Act — Congress's flagship crypto regulation bill — stalls just days before the Senate's August recess. Here's what both mean for U.S. bitcoin holders.
5 min read
Bitcoin's Rough Week: A $130M Wallet Hack Collides With Washington's Crypto Deadline
A Cold Storage Nightmare Widens
What was supposed to be the safest way to hold bitcoin has become the industry's newest cautionary tale. A firmware vulnerability in Coldcard hardware wallets, made by Canadian manufacturer Coinkite, has now been linked to the theft of more than 2,000 BTC — worth roughly $130 million — from over 7,700 addresses since attacks began on July 30. The flaw traces back to a March 2021 firmware update that mistakenly routed seed-phrase generation through a weak software-based random number generator instead of the device's dedicated hardware chip, leaving years of wallet seeds far easier to guess than the industry standard.
What began as a handful of coordinated sweeps has since fractured into a free-for-all. Galaxy Research now estimates at least 15 separate attackers are racing to drain the remaining vulnerable wallets before owners can move their funds. Notably, the stolen coins had sat untouched for an average of over three years, meaning many victims were long-term holders who believed cold storage made their bitcoin untouchable.
The incident has reopened a broader debate about self-custody. Some analysts argue it exposes a risk that hardware wallet marketing has long downplayed: swapping counterparty risk, like an exchange collapse, for supply-chain and firmware risk that's nearly impossible for an everyday user to verify.
Washington's Crypto Bill Runs Out the Clock
While bitcoin holders grapple with the fallout from the hack, U.S. lawmakers are facing their own deadline. The Digital Asset Market CLARITY Act — legislation meant to finally divide oversight of crypto markets between the SEC and CFTC — remains stuck without a scheduled Senate floor vote, just days before Congress leaves for its August recess.
The bill has already cleared the House by a wide margin and advanced through the Senate Banking Committee on a bipartisan 15-9 vote. But a floor vote requires 60 votes to overcome a filibuster, and with Republicans holding 53 seats, at least seven Democratic votes are still needed. Talks have repeatedly snagged on an ethics provision meant to limit how senior government officials can be involved in crypto ventures.
Senate Majority Leader John Thune has signaled the chamber is unlikely to deliver a final vote before the break, though leadership may still try to formally begin the floor process to keep momentum alive into the fall. If the window closes without action, the bill's fate would likely slide into 2027, an election-shadowed year that could complicate its path further.
What It Means for Investors
Together, the two stories capture a market caught between two very different kinds of risk: the technical vulnerabilities that can undermine even "gold standard" security practices, and the regulatory uncertainty that continues to hang over the industry's long-term structure. Bitcoin has largely shrugged off both developments in price terms, trading just below $64,000, but the Crypto Fear & Greed Index remains in "Extreme Fear" territory — a sign that confidence, more than price, is what's taking the hit this week.
For now, Coldcard users on affected firmware are being urged to migrate funds immediately, while crypto policy watchers turn their attention to whether Congress revives the CLARITY Act after Labor Day.