Three things pushed Bitcoin down today. A hardware wallet failure, a bond market running hot, and a stalled crypto law.
The Cold Card wallet drain
A well-known Bitcoin cold wallet maker, Cold Card, is having wallets emptied. So far 600 Bitcoin, worth $38 million, has been stolen from dormant single-signature wallets. Cold Card is a niche tool built by hardcore Bitcoin fans (Bitcoin maxis) for a community of the same. In that group it was treated as a top pick, a blue chip, the most recommended way to store Bitcoin. People who called it the safest choice are now losing their life savings over one stupid mistake.
Not every Cold Card is at risk. You are probably at risk if you made a single-key wallet on Cold Card between 2021 and 2023 and did not use multisig, did not add a passphrase, and did not roll dice. If that is you, move your funds right away.
The cause is called an entropy bug. It traces to a 2021 firmware rewrite that changed how seed phrases get made. In plain words: the code had a safety check meant to confirm that real randomness was being used. But the check only asked whether a setting existed, not whether it was turned on. That setting was off. So the wallets built keys and seed phrases from fake randomness, and fake randomness can be guessed. This hits only Cold Card. It does not affect Ledger, Trezor, or any other hardware wallet.
You could have dodged this by rolling the dice. Cold Card lets you build a seed phrase using dice rolls for randomness. On the Coin Kite website you can buy small bags of dice, roll a bunch at once, and feed those rolls in. Each roll changes the seed phrase, and you can repeat the process and prove the randomness actually worked. If you took the time to roll 100 dice, or one die 100 times, your Bitcoin is safe. That the only real defense was rolling 100 dice says Bitcoin self-custody is not ready for regular people.
This attack is strange because there is no clean way to warn people. Normal software bugs get patched quietly in the background while users upgrade. Here, upgrading does nothing. The flaw is baked into the moment the seed was created, so a new firmware version cannot fix a seed that already exists.
Warning customers is nearly impossible too. Many buyers gave fake contact details. Some records were deleted for privacy. Often the company cannot know which XPub or wallet came from which buyer. There is no way to know when a seed was made or with which firmware. Cold Card kept no user data and had no email list to alert anyone.
Even if Cold Card had found the bug first, fixing it looks like a trap. Patching the firmware would not repair the weak seeds. The moment they emailed customers or shipped a patched version, hackers would notice the flaw and start draining wallets. About the only safe path would have been telling a white hat group before any public word, letting them grab the vulnerable coins first, then asking owners to prove ownership without cryptographic proof. That would be a mess, would draw huge lawsuits, and would mostly be impossible unless someone had bought their coins through a KYC exchange, where a link could maybe be traced.
The first attacker seems fairly unskilled, likely found the bug with the help of AI, and is not sweeping every coin. Now that the exploit is public, skilled attackers will move in fast and clean out wallets. There is no time. Move your coins now. Set up multisig if you have the gear and time. If not, send them to an exchange for now, even though that stings.
This is a dark day for Bitcoin self-custody. It will be hard to recommend, and hard for newcomers to pick self-custody after this. A large share of the OG Bitcoin believers appear to be hit. Even so, the hack likely has only a small effect on today's price, because the industry has been drifting away from self-custody since about 2024.
The bond market
The most obvious reason Bitcoin fell today is the bond market. The US 30-year yield is now 5.27%, its highest since June 2007. With no rate hikes or Fed guidance, the market itself is pushing rates higher, which is how the Fed Chair wants it to run.
The Clarity Act and crypto regulation
Despite hard pushes from the TradFi side, the Clarity Act looks essentially dead in the water right now. There is still a sliver of hope. Anthony Scaramucci wrote that Senators Tillis and Gallego worked out a strong bipartisan ethics provision; if the president signs off, which he expects, few will block it, and any Democrats or Republicans in the pocket of the bank lobby who stand in the way will regret it in November.
The Stablecoin Genius Act passed a little over a year ago, and clear rules are already paying off. Circle got a limited-purpose trust charter from the New York Department of Financial Services for Circle New York Trust. CEO Jeremy Allaire said the approval puts USDC inside a strong, respected framework, which is exactly where crypto should sit.
Banks are starting to admit the Clarity Act is good for them. Former Barclays CEO Bob Diamond, who sees both sides through Hyperliquid Strategies and his old bank role, said this helps banks over time. Banks had been angry, arguing that because they are heavily regulated they should get first rights at some of these new advantages. Diamond's answer: no one is investing more in innovation than JP Morgan, Morgan Stanley, Goldman Sachs, and Bank of New York, and the largest, most successful banks will benefit. The gains he named are 24/7 trading, instant settlement, and blockchain as a permanent record of every transaction, all at a fraction of the cost with deeper liquidity. He said the banks that have invested will be big winners, and so will infrastructure firms like Circle in stablecoins and Hyperliquid in blockchain.
On Fox Business, the Abra CEO called the Clarity Act plain common sense. He argued the future is really about tokenization, not just holding Bitcoin. The financial system is moving toward an always-on, borderless setup, and the US should lead it. Investment advisory systems and broker-dealers are all shifting to tokenized, always-on systems built on crypto and smart contract rails, which will open services consumers cannot get today. Asked what single policy change matters most, he said two things are happening. First, the SEC and CFTC have done a strong job undoing the last administration's damage, are communicating for the first time in a long while, and are writing rules that make sense and pave the way for prediction markets and always-on perpetual futures on crypto rails. Second, these rules now need to be locked in as law to give startups clear federal guidelines for licenses and registrations, which is what the Clarity Act does. Without that, the next administration could see things differently and create a seesaw of rule changes that confuses markets.
Price outlook
If Bitcoin can pop back above the 21-day and 50-day moving averages, expect a rally toward 73,000 and possibly 83,000 in August.
