Weekly Recap: Self-Custody's Worst Week

gm, Defiers!

Self-custody had its worst week in memory. A firmware bug that shipped in 2021 made Coldcard seeds guessable, and attackers drained about $114 million from wallets whose owners had followed every best practice, then BTCPay Server operators closed the week racing a live exploit that swept Lightning nodes.

In Washington, the CLARITY Act slid toward 2027 after the Senate skipped a key filing, and Ethereum spent the week fighting over a proposal to burn validator rewards.

Enjoy!

Top Stories This Week

Coldcard Thefts Near $114 Million as Attackers Sweep Wallets That Did Everything Right

A March 2021 firmware change routed Coldcard's seed generation to a predictable software randomizer, and five years later attackers drained roughly $114 million across four waves — about 1,816 BTC from more than 5,200 addresses. Victims recounted losing life savings from air-gapped devices and safety deposit boxes: one watched 18.25 BTC vanish in seven minutes. Maker Coinkite halted shipments, destroyed affected stock, and shipped emergency firmware for every model; the fourth wave opted into replace-by-fee, giving alert victims a brief window to outbid the thief in the mempool.

Lightning Nodes Drained as BTCPay Server Users Race to Patch

BTCPay Server told operators to install version 2.4.2 or turn their servers off as a critical vulnerability was exploited in the wild — hardware wallet maker Foundation and the Bitcoin zine Citadel21 said their nodes were swept, in some cases hours before the public alert. Days earlier, non-custodial bridge Boltz halted swaps indefinitely, saying months of AI-assisted attacks now iterate faster than its team can patch.

Ethereum Weighs Burning Validator Rewards to Cap Staking

A new proposal, EIP-8361, would deduct a rising share of every validator's rewards as the staking ratio climbs, cancelling consensus issuance outright at 50% staked. Aave's Stani Kulechov and ether.fi's Mike Silagadze led two days of opposition, and SharpLink's Joseph Chalom warned the draft would strip the base rate out from under roughly $35 billion in liquid staking collateral and could push institutions to sell ETH as they unstake.

Banks Fighting the CLARITY Act Keep Stablecoin Yield Alive, a16z Says

a16z crypto policy head Miles Jennings argued that banks blocking the market-structure bill are "accelerating their own obsolescence": if CLARITY dies, crypto intermediaries keep paying interest-like rewards on stablecoin deposits under GENIUS — the exact payment six banking trade groups want stopped. The market took the point: after Majority Leader John Thune skipped a cloture filing, traders pushed the Act's enactment odds into 2027, with Kalshi's 2026 contract falling to 22 cents.

Uniswap Ships a Memecoin Launchpad on Robinhood Chain

Uniswap Labs opened Pools.trade, a no-fee memecoin launchpad on Robinhood Chain, hours behind its own countdown — topped by FRONG, a frog memecoin minted six days early by the same contracts, at a $12.1 million valuation. Day one delivered: the venue created 10,506 tokens against incumbent Pons' 7,210, and PONS ended the week down 49%.

Other Stories

Circle Names BlackRock, Visa, ICE and DTCC Among 11 Founding Arc Validators — the stablecoin issuer unveiled a permissioned validator set for its Arc chain ahead of the Sept. 16 mainnet, with its own disclaimer noting the network has been reviewed by no regulator.

Cloudflare Launches Stablecoin Wallets for AI Agents — account owners hold stablecoins and issue capped Virtual Wallets their agents spend over x402 to pay for APIs and MCP tools; cloudflare.pay handle reservations are open, funding arrives in the coming months.

ether.fi Removes Restaking From weETH, Nearing a Full EigenLayer Exit — restaking exposure moved into weETHs, a separate Symbiotic-based token, leaving under 1% of assets with EigenLayer; CEO Mike Silagadze: "End of an era. Sad."

Wells Fargo to Launch Tokenized Deposits for Corporate Clients This Fall — the bank starts with a limited dollar-to-pound corridor and widens it through 2027, while naming neither the blockchain it will use nor whether the ledger is permissioned.

Western Union and Rain Launch Stablecoin Card in 37 Markets — Stablecard holds remittances as USDPT, the Anchorage-issued Solana token Western Union launched in May, and spends the balance anywhere Visa is accepted.

RWAs Topped Half of Hyperliquid's Volume for Two Straight Weeks in July — perps tied to stocks, indexes and commodities out-traded crypto pairs on the largest perps DEX for the first time, less than a year after builder-deployed markets went live.

DEX Spot Volume Hit a Record 24% of CEX Volume in July — decentralized exchanges took their largest share of spot trading since tracking began in 2019, in a month when overall volumes sank to a two-year low.

Trending on The Defiant

• Lightning Nodes Drained As BTCPay Server Users Race To Patch
• Uniswap's New Launchpad Out-Launched Pons On Its First Day On Robinhood Chain
• ether.fi Removes Restaking From weETH, Nearing A Full EigenLayer Exit
• Solana Perp DEX Flash Trade to Wind Down Unless It Finds a Buyer
• SharpLink Opposes Ethereum Proposal to Burn a Growing Share of Validator Rewards
• Rarible Launches Solana NFT Marketplace With Claynosaurz as First Collection
• Uniswap Ships A Memecoin Launchpad On Robinhood Chain, Topped By $FRONG Token Minted Six Days Early

That's it for today — have a great weekend! If you enjoyed this newsletter, tell your friends!