Coldcard Got Burned, Coinbase Froze [FP Weekly 32]

1. Major News

[Tech] Coldcard’s Random Number Generation Vulnerability and the Reassessment of Trust in Bitcoin Self-Custody

What Happened?

In the early hours of July 30, wallets generated on devices made by Coinkite, the Canadian manufacturer of the Bitcoin-only hardware wallet Coldcard, were compromised on a large scale. According to a fund-flow analysis by Galaxy Research, a single attacker stole 1,082.65 BTC, worth approximately $70.2 million, from 1,196 addresses over a period of about 41 minutes between 01:10 and 01:51 UTC. The attack did not result from remote hacking or the physical theft of devices. Instead, it originated from a flaw in the way Coldcard generated wallet seeds.

The root of the problem lay in the firmware v4.0.0 update released in March 2021. At the time, Coinkite migrated its elliptic curve operations to libsecp256k1, the same library used by Bitcoin Core. In the process, it replaced MicroCopy’s default cryptographic random number generator with its own cryptographic library called libngu. Coldcard also set the parameter MICROPY_HW_ENABLE_RNG to 0 in order to use its own hardware random number generator.

The most serious problem, however, was that the parameter check tested only whether the parameter was defined, rather than what value it contained. Because the parameter was still defined with a value of 0, it passed the check as written. Libngu was bound to MicroPython’s rng_get(), but MicroPython saw that the value was 0 and compiled a software fallback called Yasmarang instead of the hardware path. Because both implementations shared the same function signature, the build succeeded without any warnings. The random number generator that Coinkite believed it had replaced with its own implementation had, in reality, continued using MicroPython’s software fallback for the entire five-year period.

Yasmarang is a pseudorandom number generator, not a cryptographically secure random number generator. On its first call, it is initialized using only three values: the lower 32 bits of the chip UID, the RTC time register, and the RTC subsecond counter. It does not collect any additional entropy afterward. None of these three values is secret. They are either fixed device identifiers or values that can be observed and reconstructed. Once the initial state and call history are known, the entire output stream can be reproduced deterministically.

As a result, device-specific entropy collapsed. On the older Mk2 and Mk3 models, seed generation became effectively deterministic once the timer state was known. Although the Mk3 was advertised as providing 128 bits of entropy, its actual entropy was only about 40 bits. Newer models, including the Mk4, Q, and Mk5, add entropy from a secure element during boot. Even with that additional entropy, however, the possible outputs were narrowed to a seed pool of at most 2^32 possibilities, or only a few billion seeds.

The attack was therefore carried out through offline brute-forcing. An attacker could constrain the UID, timer values, and call history to construct candidate seeds, then use a publicly known address or extended public key, or xpub, as an oracle to test candidate keys until a match was found.

The response was swift, but its limitations were clear. After receiving reports from affected users, Block’s Bitcoin engineering team identified the cause and published its analysis on the same day. Coinkite, the manufacturer, also released emergency firmware updates for all models on July 31, the day after the attack. However, because the initial attack began approximately 30 hours before the firmware update was released, many victims had already lost their funds before they had any opportunity to see the warning.

The greatest limitation is that seeds already generated under the vulnerable firmware cannot be repaired. Users must generate entirely new seeds using patched firmware and transfer their funds to the new wallets. By contrast, users who added extra entropy or used a BIP39 passphrase when generating their seeds may have avoided this attack path. Multisignature setups also offered no protection if every participant used a vulnerable device. A sufficient signing quorum of secure devices was required.

Researcher’s Comment

In my view, the greatest significance of this incident is that it has once again exposed one of the most fundamental weaknesses that crypto self-custody has postponed confronting for years.

This is not the first incident in which weak randomness produced predictable keys and led to the theft of the funds secured by those keys. In 2013, a flaw in Android’s SecureRandom implementation led to the large-scale theft of Bitcoin from wallets generated using it. The underlying cause belonged to the same category as the present case, often described as squandered entropy. Such flaws are particularly dangerous because they cannot necessarily be detected simply by reading the source code. Unless the bits actually being generated are measured and statistically validated, a critical weakness can remain hidden in plain sight for months or even years. The Coldcard incident may likewise have been difficult to detect for this reason.

However, the fact that such a flaw emerged in a hardware wallet, which has long been regarded as the safest form of self-custody, and specifically in a wallet operated as an open-source project, significantly undermines confidence in self-custody. If a vulnerability introduced in an update five years ago ultimately caused this incident, can the safety of more recent updates be guaranteed? Is there any assurance that another open-source wallet will not experience an incident of comparable severity?

I also believe that the largely passive behavior of hardware wallet users, particularly those who use them for Bitcoin self-custody, is one reason real-time responses to vulnerabilities are so difficult. A seed generated under vulnerable firmware cannot be restored through a patch. Users must create a new seed and transfer all of their funds to it. Yet many users are long-term holders who keep their wallets offline after depositing their assets. It is likely that a substantial number of users had their Bitcoin stolen without even realizing that such an incident had occurred.

The Bitcoin community must be made fully aware that funds can be stolen through this type of vulnerability even when a hardware wallet remains offline. This incident may also change the views of some users who have consistently insisted on self-custody and could encourage a shift toward alternative methods of holding Bitcoin, including Bitcoin ETFs.

[Investment] Coinbase’s Q2 Earnings

What Happened?

Coinbase reported revenue of $1.22 billion and a net loss of $359.5 million for the second quarter of 2026. Revenue declined 19% year over year and 14% quarter over quarter, while the company posted a loss per share of $1.36, which was weaker than market expectations. On an adjusted basis, Coinbase still recorded a net loss of $105 million, although adjusted EBITDA remained positive at $208 million, marking the company’s 14th consecutive quarter of positive adjusted EBITDA. Coinbase explained that declining crypto prices, lower spot trading volumes, and market volatility falling to its lowest level in years weighed on its results.

The core trading business was directly affected by the market downturn. Transaction revenue for the second quarter was $599 million, down 21% year over year, while consumer transaction revenue and institutional transaction revenue declined 20% and 26% quarter over quarter, respectively. With total crypto spot trading volume falling by more than 20%, Coinbase’s consumer spot trading volume also declined 24% quarter over quarter. As overall market trading activity contracted rapidly, Coinbase was unable to avoid an absolute decline in revenue even though it performed relatively better than its competitors.

In contrast, Coinbase’s trading volume market share reached an all-time high of 10.3%, rising for the third consecutive quarter. The company expanded its share in both spot and derivatives trading and emphasized that its own trading volume remained relatively stable even as the broader derivatives market contracted. However, a higher market share does not necessarily mean higher trading volume. Coinbase’s volume simply declined less than that of its competitors as the overall market shrank, making this a quarter in which a positive signal of stronger market position appeared alongside weaker financial performance.

Coinbase also showed some progress in its “Everything Exchange” strategy. Prediction market contract volumes and revenue more than doubled quarter over quarter, while daily traders and revenue from its crypto binaries product grew rapidly. As Coinbase expanded its trading products into equities, derivatives, and prediction markets, revenue excluding Bitcoin spot trading rose to 88% of total net revenue. However, prediction markets carry margins of approximately 50%, meaning partner costs remain significant, while derivatives market share increased even though actual trading volume declined. This suggests that the new businesses have not yet reached a stage where they can fully offset the decline in traditional trading revenue.

Subscription and services revenue was $555 million, accounting for approximately 48% of total net revenue, but it came in slightly below the company’s guidance range. Stablecoin revenue accounted for $292 million of that total, while average USDC held in Coinbase products reached an all-time high of $20 billion. However, some USDC acquisition agreements were reflected later than expected, while lower crypto prices and declining staking reward rates pressured blockchain rewards revenue. Coinbase also guided for third-quarter subscription and services revenue of $500 million to $580 million, which implies a level similar to the second quarter at the midpoint.

Coinbase is strengthening cost controls in response to weak market conditions. Second-quarter adjusted expenses declined 9% quarter over quarter to $1 billion, and the company lowered its full-year 2026 adjusted expense guidance to between $4.2 billion and $4.45 billion, reflecting the impact of workforce reductions and lower technology and administrative costs. Coinbase holds $8.6 billion in cash and cash equivalents and has repurchased approximately $1.2 billion of its own shares so far this year. Overall, the quarter showed that despite medium- to long-term progress in market share expansion, USDC growth, and revenue diversification, weaker crypto trading activity and a larger-than-expected net loss continued to dominate the company’s results. Coinbase shares fell more than 5% in after-hours trading following the earnings release, and the decline widened during the following regular trading session.

Researcher’s Comment

Coinbase’s share price decline reflected investors’ greater focus on weak near-term financial performance than on the company’s expanding market share. Second-quarter revenue fell 19% year over year to $1.22 billion, below the market estimate of $1.29 billion. On a GAAP basis, Coinbase reported a net loss of $359.5 million and a loss per share of $1.36, far wider than the market expectation of a $0.44 loss per share. Following the earnings announcement, the stock declined approximately 5% to 6% in after-hours trading, and the decline expanded into the double digits during the next day’s regular session.

The company emphasized its 14th consecutive quarter of positive adjusted EBITDA and a record-high trading volume market share of 10.3%, but the market reacted more strongly to actual revenue and accounting losses than to adjusted metrics. The net loss included approximately $209.5 million in mark-to-market losses on crypto assets held for investment, while stock-based compensation and restructuring costs also weighed on profitability. The increase in market share was also largely the result of Coinbase’s trading volume declining less than that of its competitors as the broader crypto market contracted. Total crypto market capitalization fell by approximately 11% during the second quarter, while spot trading volume declined by about 25%. As a result, even with a higher market share, Coinbase could not avoid a decline in absolute transaction revenue.

Revenue diversification has also not yet fully offset weakness in the traditional trading business. Subscription and services revenue reached $555 million and has grown significantly over the long term, but it missed expectations this quarter, while third-quarter guidance of $500 million to $580 million did not indicate a clear acceleration in growth. Coinbase’s efforts to reduce its dependence on Bitcoin spot trading through stablecoins, derivatives, and prediction markets are directionally positive, but investors wanted to see how quickly the expansion of these business areas could translate into actual revenue and profit growth. The stock price decline ultimately showed that the market’s expectations for near-term performance and guidance were higher than its willingness to rely on the company’s long-term growth narrative.

Coinbase is in a difficult position. Market conditions are extremely weak, causing transaction fees, its primary source of revenue, to decline. At the same time, businesses that Coinbase presents as future growth drivers, such as tokenization and agentic payments, are still at a very early stage and generate little to no revenue. Other businesses, including Base, prediction markets, and crypto cards, either remain small in terms of revenue or have relatively high cost structures. Ultimately, even if Coinbase continues to promote the narratives of the Everything Exchange and the AI agentic economy, one of the few realistic ways to improve its current situation is for sentiment in the crypto market to recover. In the meantime, Coinbase needs to rapidly build the foundations for Base, prediction markets, and tokenization over the medium term, and for the agentic payments business over the long term.

In the past, Coinbase stood at the forefront of the industry as a pioneer that developed new technologies, regulatory frameworks, and services. More recently, however, it has appeared less like a market leader and more like a company rapidly adopting a wide range of businesses after those markets have already become somewhat established, in an effort to catch up with competitors. This may be unavoidable as the company has grown larger and now has more stakeholders to consider. Even so, it would be encouraging to see Coinbase return to its original spirit and once again demonstrate that it can lead innovation across the industry.

Others

Crypto

• STORJ token falls 20% as decentralized storage firm files for Chapter 11 bankruptcy amid crypto shutdown wave
• Ondo launches new execution network, calling it 'evolution' of Ondo Chain
• MoonPay launches PayBox, an AI payment vault for ChatGPT and Claude
• Uniswap launches 'Earn' with Morpho to let users earn yield on idle crypto assets

Institution

• Securitize expands regulated platform with SEC adviser license
• Morgan Stanley debuts Ethereum and Solana ETFs with market's lowest fee, staking rewards
• Tether’s GENIUS-compliant USAT stablecoin launches on Celo, marking first expansion beyond Ethereum

Tech

• Lido begins consolidating $16 billion worth of staked ETH as Curated Module v2 rolls out

Investment

• Kraken parent Payward acquires Magic Labs' embedded wallet business
• Axis Robotics raised $12M Funding to Build the compounding data engine accelerating physical AI
• Coinbase shares slip after Q2 results despite prediction markets doubling and record trading market share

Asia

• South Korea's KB Kookmin Bank to launch cross-border payment service on JPMorgan's Kinexys

2. Four Pillars Weekly

: : Tokenized Stock Paradox: When Greater Access Fragments Liquidity (Link)

• Although growth in the RWA sector has slowed somewhat over the past few months, tokenized stocks have continued to grow at an exceptionally rapid pace. The tokenized stock sector is currently expanding through three main channels: 1) Linked Security tokenized stocks offered by companies such as Ondo, xStocks, and Robinhood, 2) Issuer-Sponsored Tokenized Securities offered by companies such as Securitize, Figure, and Superstate, and 3) the growth of perpetual futures exchanges, which are not technically a form of tokenization.
• Although the tokenized stock sector is growing overall, liquidity fragmentation has begun to emerge as a side effect. Even when the underlying stock is the same, liquidity is being fragmented both 1) vertically across different tokenization structures and 2) horizontally across different tokenization providers using the same structure.
• From a more positive perspective, particularly in terms of improved accessibility, this phenomenon may not necessarily represent the fragmentation of existing liquidity. Instead, tokenized stocks may have attracted liquidity from investors who previously lacked access to US stock market liquidity, with fragmentation emerging as a byproduct.
• Regardless, liquidity fragmentation in tokenized stocks is a real problem. Potential solutions may include 1) the emergence of orchestration or clearing platforms similar to those found in the stablecoin sector, or 2) industry consolidation into an oligopolistic or monopolistic structure driven by economies of scale.

: : The Endgame for Wallets is Open Money (Link)

• The balance in a banking app is not money you directly hold but a claim recorded on the bank's ledger. This closed money is permissioned, intermediated, and fragmented, and its friction surfaces the moment money crosses systems or borders.
• Open money shifts the center of money from institutional accounts to user wallets. A wallet is not a box that stores assets but a key that moves them, and with self custody as the foundation, money becomes programmable and composable.
• MetaMask shows the wallet evolving into an operating system for money by stacking mUSD, the card, and agentic payments on top of it. Storage, spending, payment, and even agent delegation converge into a single wallet, which is why the endgame for wallets is open money.

Comments

• Ethereum in 2030, explained for everyone
• Centralized Responsibility Is All x402 Needs
• Why Trade Finance Blockchains Keep Failing
• The Last Job Left to the Ethereum Foundation

3. Macro & Onchain Metrics

Some of the charts below are powered by CryptoQuant. For those interested in exploring the underlying data in greater detail, CryptoQuant provides access to a comprehensive suite of onchain and market analytics used by institutional participants.