$114M Gone From Wallets That Did Everything Right

gm, Defiers!

These were the biggest crypto and DeFi stories today:

A firmware bug that shipped in 2021 has now cost Coldcard owners about $114 million in bitcoin.

Attackers opened a fourth wave of sweeps on Monday, and more than 1,800 BTC has moved since Thursday. The flaw made seeds generated on affected firmware guessable, so the standard defenses did nothing. Jonathan Goodman kept 18.25 BTC on a device that never touched the internet, seed stamped on steel in a safety deposit box, and watched every wallet empty between 9:36 and 9:43 pm on July 29.

Self-custody moves risk from a custodian to the owner and to the code the owner runs. Coldcard's users did what the playbook asks and lost anyway, because the failure sat in firmware written five years before the theft. Boltz reached the same place from the other direction on Monday, pulling its bitcoin swap service offline after months of automated attacks outran its ability to patch.

WATCH

The $114 Trillion Question: How DTCC Is Tokenizing the Entire U.S. Market

DTCC settles $114 trillion in assets. On July 15 it pushed tokenized versions of those assets through real production systems and converted them back, and Camila Russo walks through what the test actually proved.

SECURITY

Coldcard Thefts Near $114 Million as Fourth Attack Wave Hits

Attackers began a fourth round of sweeps against Coldcard-held bitcoin on Monday, taking estimated losses since Thursday to roughly $114 million, or more than 1,800 BTC. The root cause is a firmware bug that shipped in 2021 and made seed phrases generated on affected versions guessable. Monday's transactions were still replaceable in the mempool when they landed, which gives some owners a narrow window to outbid the thief and move their coins first.

Coldcard Thefts Near $114 Million as Fourth Attack Wave HitsAttackers began a fourth wave of sweeps against bitcoin held in Coldcard hardware wallets on Monday, pushing estimated losses to roughly $114 million since Thursday.thedefiant.io

Why this matters: Coldcard's firmware is open source, and the bad commit sat in public for five years before anyone caught it. Open code buys you nothing without someone actually reading it.

HACKS

'I Did Everything Right': Coldcard Victims Recount Losing Life Savings

Jonathan Goodman's 18.25 BTC sat on a Coldcard that had never connected to the internet, with the seed stamped on a steel plate in a safety deposit box. Every wallet he controlled emptied between 9:36 and 9:43 pm on July 29, about C$1.6 million in seven minutes. Other owners describe the same sequence: air-gapped signing and offline backups, then a sweep they could only watch confirm.

Why this matters: These owners followed the guidance the industry gives. The failure sits in vendor engineering, and no amount of user education would have changed the outcome.

DEFI

Bitcoin Bridge Boltz Halts Swaps Indefinitely, Citing AI-Assisted Attacks

Boltz disabled its non-custodial swap service indefinitely on Monday, saying months of automated, AI-assisted probing of its infrastructure had outpaced the speed at which its team could ship fixes. The service routed swaps between bitcoin's mainchain, the Lightning Network and Liquid, and the shutdown leaves wallets including Aqua and Bull Bitcoin scrambling to restore that routing elsewhere.

Why this matters: Attack tooling now scales faster than small protocol teams can respond, which pushes bitcoin's swap routing toward operators large enough to staff continuous security work.

DEFI

DEX Spot Volume Hit a Record 24% of CEX Volume in July

Decentralized exchanges handled spot volume equal to 24% of centralized exchange volume in July, the highest ratio since The Block began tracking the series in 2019. The ratio climbed while absolute volumes fell: overall spot trading sank to a two-year low, so DEXs gained share as the market shrank.

Why this matters: DEX share held up through a volume drawdown, which suggests the flow moving on-chain is structural and survives the conditions that usually send traders back to centralized venues.

MARKETS

RWAs Topped Half of Hyperliquid's Volume for Two Straight Weeks in July

Perpetual futures tied to stocks, indexes and commodities took more than half of Hyperliquid's trading volume for two straight weeks in July, the first time non-crypto markets out-traded crypto pairs on the largest perps DEX. Builder-deployed markets went live less than a year ago, and the equity and commodity books they opened now carry the majority of the venue's flow.

Why this matters: Hyperliquid's growth now comes from traders who want leveraged equity exposure without a broker, which puts it in competition with offshore CFD shops as much as with other perps DEXs.