Weekly Research Brief: Coldcard Hacked; Bitcoin Price Resilient; Ethereum, Solana Reconsider Inflation Schedules

Welcome to Galaxy Research's Weekly Research Brief. Subscribe to get this newsletter delivered to your inbox every Friday morning.

In this week's edition, Jianing Wu shares early takeaways from the Coldcard fiasco; Jianing and Marc Hochstein consider bitcoin’s price resilience in the face of a FUD storm; and Lucas Tcheyan reviews inflation schedule proposals for Solana and Ethereum.

Our head of firmwide research, Alex Thorn, has been tracking the onchain movement of coins stolen in the Coldcard hardware wallet exploit and working with Bitcoin community members to gather intel that might help authorities catch the thieves and recover victims' BTC. If your Coldcard device was hacked, DM @intangiblecoins on X. More than 200 victims have reached out, but Alex's AI agent is triaging messages, and he will eventually reply to all.

Got feedback on this newsletter? Email [email protected]. We’d love to hear from you.

🔓 Your Keys, Not Your Coins: Coldcard Wallets Hacked for $130m and Counting

Starting July 30, attackers have drained wallets hosted on Coldcard devices across multiple escalating waves: roughly 1,082 BTC by Aug. 1, then approximately 284 BTC in the next two waves, with a fourth wave possibly underway. Galaxy Research now estimates at least 15 separate attackers are exploiting the bug independently, up from the handful of coordinated operators we initially identified, with total losses tracked near $130 million as of Aug. 4.

The vulnerability originated in Coldcard’s seed-generation process. Normally, the device would draw entropy (a measure of randomness) for a new seed phrase from a dedicated hardware random-number generator embedded in its chip. A firmware bug introduced in a March 2021 (yes, five years ago) release instead routed part of that process through a software fallback. That fallback was seeded only by the device’s fixed information and its timer/clock registers, rather than a strong source of new randomness.

As a result, affected seeds that should have contained approximately 128 bits of randomness may have had an effective entropy of only around 40 bits for affected Mk2 and Mk3 devices and 72 bits for newer Mk4, Q, and Mk5 devices. At that level, an attacker with an approximate understanding of the device identifier and seed-generation timing could generate candidate seeds offline and compare the corresponding addresses against the public blockchain. Physical access to the wallet was not required.

Coinkite, the Canadian manufacturer of Coldcard, released emergency firmware updates, but the remediation is prospective rather than retroactive. The patches can protect seeds generated after installation, but they cannot strengthen a seed that was already created using vulnerable firmware. Those seeds remain permanently susceptible to brute-force recovery. Affected users have therefore been advised to generate an entirely new seed on patched hardware and migrate their assets to new wallets.

Our take

Self-custody is often presented as the cleanest way to eliminate counterparty risk: investors hold their own private keys and are therefore insulated from the failure of an exchange, custodian, or other intermediary. The Coldcard exploit exposes the other side of that trade-off. Removing a third-party custodian does not remove custody risk; it transfers that risk to the hardware, software, and key-generation processes on which the holder depends.

The incident complicates one of the central assumptions behind self-custody. The maxim of “not your keys, not your coins” frames control of the private key as the primary safeguard against theft or confiscation. In this case, however, the hardware wallet itself introduced the vulnerability at the point of key creation. One user said he kept a Coldcard in a bank safe-deposit box, never connected it to the internet, and nevertheless lost 18.25 BTC in seven minutes. As this victim mused, “Perhaps the hardest part about this is that I did everything right.” The failure occurred before standard operational-security practices could offer any protection.

Institutional-grade custodians, such as Coinbase Custody and Fidelity Digital Assets, typically employ controls including offline key generation, multisignature authorization, geographically distributed key material, and segregated cold-storage accounts. These measures do not eliminate custody risk, but they are designed to prevent the failure of a single device or location from resulting in a total loss. In effect, they apply the same risk-distribution principle as multisignature self-custody, but embed it in a regulated and operationally controlled custodial framework.

The more durable lesson is narrower but still significant: possession of a private key is only as secure as the process and infrastructure used to create it. – Jianing Wu

📈 BTC Price Shrugs Off Coldcard Debacle, Strategy Sale, CLARITY Struggles

The historically volatile bitcoin price has had every reason to tank this week, yet it traded sideways.

The ongoing Coldcard hardware wallet fiasco shook hardcore Bitcoiners’ faith in self-custody. Strategy sold another chunk of BTC. Passage of the CLARITY Act remained a longshot.

But as of Thursday afternoon in New York, the original and still most valuable cryptocurrency was trading $64,452.01, essentially flat on a 24-hour and 7-day basis and up about 1.2% from a month earlier. What gives?

Our take

Though tragic, the Coldcard exploit affected a small amount of bitcoin – about $130 million worth, compared to a $1.2 trillion market cap – and a self-selected minority of hobbyist users. Self-sovereign HODLERs may be living up to the cypherpunk ideal, but they’re outliers. Bitcoin, for better or worse, has institutionalized, and institutional investors prefer exchange-traded products over direct ownership; the ones that do trade actual coins without paper wrappers typically keep them at third-party custodians.

So as shocking and saddening as it was to see hackers drain so many individuals’ life savings, market participants quite understandably treated the incident as a product-specific implementation failure.

Zooming out, crypto just finished its best month in 2026 so far, seemingly decoupling from the turbulence in equities during the same period. Bitcoin rose roughly 7% in July, its second-best monthly gain of the year, and ETH climbed about 18%, its best month this year. Spot bitcoin ETFs, which logged their worst month on record in June, turned to net inflows in July with $194 million. The Crypto Fear & Greed Index held in "fear" territory for much of last month despite the price gains but is turning toward “neutral.”

BTC spent most of July range-bound between the high-$50,000 and mid-$60,000 range. The price repeatedly tested its 200-week moving average from both sides as Iran headlines, chip-sector risk-off spillover, and shifting ETF flows pushed it in and out of range, before closing the month firmer near $64,000.

All that happened even though Strategy was a net seller through most of July following broader pressure from the preferred-stock stress that forced a capital-structure overhaul in late June. Michael Saylor’s company sold 3,588 BTC (~$216 million) in early July – its largest single sale ever – to fund preferred-stock dividends, then raised roughly $466.7 million and $263.5 million in back-to-back weeks by selling MSTR common stock rather than touching its BTC holdings.

So, by Monday morning, when Strategy disclosed a further sale of 1,638 BTC (~$105 million), investors may well have grown used to it.

July was also the month we at Galaxy Research cut our odds of the CLARITY Act passing in 2026 passage odds to 30%, from a coin-flip in June. Yet the crypto market didn’t wobble on the bearish CLARITY developments that led us to change our probability assessment. Bitcoin finished July well above where it traded back when CLARITY's odds stood at 60%.

As we’ve stated before, a CLARITY failure wouldn't leave the industry empty-handed, because regulators can still deliver most of what it wants through agency guidance over the next few years, just without statute permanence.

Supporting that view, institutional building continues. It’s possible the market is pricing CLARITY as one lever among several rather than the sole gate to institutional adoption.

Perhaps it’s too soon to say the bottom is in. But this resilience is remarkable. – Jianing Wu and Marc Hochstein

🪙 High on Their Own Supply? Ethereum, Solana Reconsider Inflation Schedules

Ethereum and Solana developers advanced new initiatives this week that would adjust the blockchains’ inflation schedules.

Six researchers, including the Ethereum Foundation's Justin Drake, submitted EIP-8361 (Tapered Issuance Burn). This Ethereum improvement proposal would burn a rising share of validator rewards as more ETH is staked, reaching 100% once half the supply is staked and thereby removing any issuance incentive to stake beyond that point. At today's ratio of roughly one-third of supply, consensus-layer yield would fall from about 2.6% to 1.2%. Maximal extractable value (MEV) and priority fees would remain untouched. If approved, the reduction would phase in over 18 months. Combined with normal fork lead time, stakers would have close to two years to adjust. The EIP is still a draft, and nothing has been scheduled or voted on. It is being considered for inclusion in Hegotá (Ethereum’s next major upgrade after Glamsterdam, which is scheduled for this fall). Selection is expected to continue into November, and if approved, the upgrade is unlikely to ship before well into 2027.

Meanwhile, two Solana governance proposals are moving in parallel through the network's new onchain governance system, the first real test of the process. SGP-0002 carries a Solana improvement document, SIMD-0550 (from Helius engineers lostintime101 and 0xIchigo), which would double the annual disinflation rate to 30%. This in turn would pull the 1.5% terminal inflation floor forward to 2029 from 2032 and remove an estimated 18.9 million SOL of future emissions. SGP-0003 carries SIMD-0553 (from Temporal's cavemanloverboy), which would replace Solana's flat per-signature fee with a resource-based fee that scales with the compute each transaction requests and is burned in full. Estimates put the potential increase in daily SOL burns from roughly 650 to between 7,500 and 9,000. Each SGP secured the required 15% support from active stake to move to a discussion phase, which will take place over the coming 16 days, followed by a fixed 11-epoch (roughly 22-day) process of discussion, stake snapshot, and voting. Passage requires two-thirds of decisive stake to pass.

Our Take

Ethereum and Solana are posing the same fundamental question to their stakeholders: how much security budget is required to secure their chains, and are the tradeoffs worth adjusting those parameters? The proposals differ in design and process but emerge in a similar market environment where both tokens have suffered large drawdowns and consistently underperformed.

The Ethereum proposal is the more contentious of the two. It seeks to reform a mature issuance curve that was already altered once during the 2022 transition from proof of work to proof of stake. Proponents argue the current model creates an open-ended incentive for staking rates to trend toward 100% (the authors project roughly 55% by 2028), raising the risk of concentration among liquid staking providers and large operators. Their design seeks to remove that permanent yield floor, limit dilution, and strengthen ETH's monetary properties. Critics, including a number of high-profile voices across DeFi, staking, and the broader developer community, warn that the resulting yield compression could pressure solo stakers, gut Ethereum's DeFi ecosystem, and dampen institutional demand. They also question the compressed timeline for a material monetary policy change.

Solana's changes are narrower and more explicitly focused on scarcity. Accelerating the path to the terminal inflation rate would primarily benefit long-term holders by removing a meaningful amount of future supply with the cost falling on current stakers and validators through faster yield compression. The resource-based fee burn (SIMD-0553) would strengthen the link between network usage and token value accrual, again favoring holders by raising costs for more complex transactions. Both Solana proposals appear less controversial than Ethereum's, in part because similar ideas have been debated across multiple iterations over the past year and a half.

Inflation successfully bootstrapped both networks. It paid validators to secure chains that had almost nothing running on them and bought the runway that produced the ecosystems both now enjoy. That subsidy has an expiry date. The healthier long-term state is one in which validating is a thin-margin utility attached to a profitable onchain business or is funded by blockspace demand rather than emissions. Supply-side adjustments can help at the margin and may generate useful narratives, but they are not the binding constraint on either chain. Demand is what ultimately reprices these assets and earns them the legitimacy to move from emerging settlement layers to infrastructure used globally for large-scale finance and retail activity.

Both ecosystems have spent this cycle improving their technology stacks, advancing institutional adoption, and expanding retail products. That work should remain the priority. The security concerns that the Ethereum proposal raises may prove valid over a longer horizon, because neither chain is worth much if it cannot be distinguished from a centralized alternative. But, given current levels of adoption, they should not consume the oxygen the demand-side efforts still need. -Lucas Tcheyan

Other News

• 🏦 Wells Fargo to roll out tokenized deposits on ‘proprietary blockchain’

• 🔮 Polymarket said to seek >$20b valuation in funding round

• 🐎 Texas governor pauses data center grid connections pending audit

• 🦑 Kraken affiliate, Broadridge give xStocks tokenholders voice in proxy voting

• 🤖 Sui blockchain’s co-founder and CTO is leaving to join Anthropic

• 🗳️ Crypto PAC Fairshake scores primary wins in Mich., Wash. but one big loss

• 🥊 Late Ondo Finance founder’s mother moves to oust CEO of RWA issuer

• 🫆 FBI agent accused of stealing $1m in crypto tied to 'adversarial nation'

• 🗞️🤡🙄WSJ CLARITY editorial likens crypto networks to ... eBay? C’mon

Chart of the Week: Open-Weight Models Win Tokens, Closed Ones Keep Cash

Chinese open-weight AI models have turned inference into a commodity, calling into question the sustainability of the frontier labs’ 60%-80% markups. Yet the walls may not be closing in on OpenAI and Anthropic as quickly as benchmarks and public sentiment suggest.

Jesse Zhang, co-founder of Decagon, a maker of customer-service chatbots, recently argued that running open models requires technical finesse many corporations would rather pay to avoid. As the old adage goes, “no one gets fired for buying IBM.” Most enterprises could build the infrastructure in-house, but it's far easier to hand off the problem to Anthropic or OpenAI.

Data from OpenRouter, a single API endpoint that unifies inference providers from both open- and closed-weight models, supports this hypothesis. Since mid-May, open-weight models’ share of token usage has climbed nearly one-third to 75%. However, in terms of estimated dollars spent on the platform, closed-source models still crush open-weights. – Taj Singh