KuCoin Ventures Weekly Report: Unpacking the Coldcard Hardware Flaw, ETFs and Stablecoin Infra Absorb Funds Amid Macro Cooling
2026/08/11 11:17:00
1. Weekly Market Highlights
Coldcard’s Large-Scale Vulnerability Shakes Confidence in Self-Custody: Hardware Wallet Security Shifts from “Offline Isolation” to Key-Generation Auditing
Last week, the Coldcard hardware wallet vulnerability continued to unfold, becoming one of the more significant personal self-custody security incidents of the year. Coldcard is a Bitcoin-only hardware wallet launched in 2017 by Canadian Bitcoin security company Coinkite. It primarily targets advanced self-custody and security-conscious users, with physical isolation for signing, verifiable firmware, and stricter offline key management as key selling points. Compared with mass-market brands such as Ledger and Trezor, Coldcard does not rank among the largest hardware wallet providers by market share, and there are no publicly verifiable figures for its sales or market share. However, it has long built its reputation within the Bitcoin-native community around security and a relatively limited attack surface. The impact of this vulnerability therefore extends beyond the direct financial losses: a specialist hardware wallet built around a “security-first” proposition contained a long-undetected flaw at the most fundamental stage of key generation.
Unlike exchange hacks, smart contract exploits, or user-side private key leaks, this incident originated from insufficient randomness during wallet seed generation. A firmware update released in March 2021 introduced an integration error that caused some Coldcard devices to fail to obtain sufficient randomness from the hardware Random Number Generator (RNG) as intended, instead falling onto a predictable software-based random number path. According to Block Engineering, the effective randomness of seeds generated on some affected devices may have fallen from the expected level of roughly 128 bits to as little as around 40 bits. This allowed attackers to computationally enumerate potential seeds and match them against publicly visible Bitcoin addresses without ever accessing the physical device, obtaining a backup, or bringing the wallet online.
The vulnerability remained latent for more than five years before being exploited at scale beginning on July 30. Estimates of the total losses still vary across blockchain intelligence firms. As of August 5, TRM Labs had tracked approximately 1,816 BTC stolen from more than 5,200 addresses, worth around $116 million at the time. On August 7, Galaxy Research raised its estimate of cumulative losses to approximately $130 million and assessed that more than ten independent attackers had participated in multiple waves of fund transfers.
More importantly, some affected users had followed the standard model of offline cold storage, with the devices themselves never connected to the internet. The attackers did not circumvent the wallets’ physical isolation; rather, the wallet seeds controlling the assets lacked sufficient randomness from the moment they were created. Hardware wallets generally reduce the risk of private keys being exposed to networked environments through physical isolation, Secure Elements, and offline signing. But all of these protections rest on a more fundamental assumption: the randomness used to generate the wallet seed must itself be sufficiently unpredictable. Once that assumption fails, even a private key that never leaves the device cannot be protected by subsequent network isolation.
Data Source: Block Bitcoin Engineering
Following the incident, Coinkite, the developer of Coldcard, released a security advisory and patched firmware. However, a firmware upgrade can only prevent newly generated wallet seeds from being affected by the same issue; it cannot strengthen weak seeds that were generated previously. Affected users therefore still need to generate new wallet seeds in a patched environment and migrate their assets. Coinkite also noted that users who had added sufficient independent physical dice entropy when generating their seeds, or who had used a strong BIP-39 passphrase, may face substantially lower risk.
The Coldcard incident also raises a broader question: can larger hardware wallet manufacturers avoid this type of failure? Compared with Coldcard, leading vendors such as Ledger and Trezor have larger user bases and greater development resources, but scale alone cannot eliminate fundamental security risks. Coldcard itself is not a simplistic or low-end product. Its Bitcoin-only architecture, publicly available firmware code, and support for physically isolated operation are all intended to reduce its attack surface. Yet the random-number-generation flaw remained in publicly available code for years and only attracted widespread attention after real funds were stolen. This suggests that hardware wallet security cannot be judged solely by brand scale, the presence of a Secure Element, or whether the device operates offline. It also depends on whether critical code is subject to continuous independent auditing and whether underlying assumptions around random-number generation, entropy generation and propagation, firmware dependencies, and the build process are continuously validated.
From a broader industry perspective, the incident does not invalidate the self-custody model, but it does redefine the boundaries of “self-custody security.” The industry has traditionally focused on whether users control their own private keys. Coldcard introduces an even more fundamental question: “Was the private key generated in a trustworthy way in the first place?” Self-custody reduces counterparty risk associated with exchanges or third-party custodians, but it also shifts part of that risk to hardware design, firmware code, key generation, backup and recovery processes, and the user’s own security practices.
For individuals and institutions holding large amounts of assets over long periods, reliance on a single device, a single manufacturer, or a single source of seed randomness may itself create concentration risk. The importance of multisignature setups, combining devices from different manufacturers, and using independent sources of randomness therefore increases. For institutional asset management in particular, security assessments of self-custody solutions may need to expand beyond the traditional focus on whether private keys remain offline and instead cover the entire key lifecycle, including seed generation, signing, backup, recovery, and firmware upgrades.
Going forward, the market will need to monitor the final number of affected Coldcard addresses, the ultimate loss estimate, the movement of stolen funds, and whether similar random-number-generation or firmware dependency risks exist in other hardware wallets. The core lesson from the Coldcard incident is not that “cold wallets are unsafe,” but that hardware wallet security models cannot stop at “the device is offline and the private key never leaves it.” As the amount of assets held under personal and institutional self-custody continues to grow, the entire key lifecycle — from seed generation to transaction signing, backup, and recovery — needs to become a verifiable security boundary.
2. Weekly Selected Market Signals
Marginal Easing of Tightening Expectations: Crypto Funds Concentrate in ETFs and Stablecoin Infrastructure
1) Traditional Market Changes, Important Events, and Brief Analysis
The core variable in the US market has shifted from corporate earnings back to macroeconomic data. US July non-farm payrolls unexpectedly turned negative, with data from the previous two months revised downward, reinforcing the judgment that the labor market is cooling. However, the unemployment rate simultaneously dropped, primarily influenced by a decline in the labor force participation rate. Therefore, the current job market is closer to a state where "hiring activities are significantly cooling" rather than a recession dominated by massive layoffs.
Data Source: TradingView
From a financial market perspective, the primary trade is the reduced pressure for further rate hikes. The significant cooling of the labor market has weakened the Federal Reserve's momentum for short-term rate hikes; short-term US Treasury yields fell, and the S&P 500 reached a new high.
Meanwhile, energy prices remain an uncertainty on the inflation front: by the end of the week, Brent crude rebounded to approximately $84/barrel, and the navigation arrangements in the Strait of Hormuz have not yet been fully settled. China is leaning towards utilizing capital markets to provide funding support for technology and AI industries.
The Bank of Japan noted in its July meeting summary that upside risks to inflation are increasing; committee members indicated that if potential CPI inflation continues to approach 2%, the pace of policy interest rate hikes could be faster than market expectations.
Data Source: CME FedWatchTool
This point is clearly visible from the latest CME FedWatch pricing. As of August 10, the market expects for the September 16 meeting:
-
53.9% probability of maintaining the rate at 3.50%–3.75%;
-
46.1% probability of a 25bp hike to 3.75%–4.00%;
-
Rate cut probability remains near 0.
Therefore, this week's macro environment is difficult to simply follow a "weak employment → monetary easing" logic. The underlying logic is closer to: cooling employment has reduced the urgency for the Fed to continue short-term tightening, but energy prices and core inflation still limit the room for a policy pivot.
BTC ETF Buying Improves, but BTC Remains Oscillating Around $65,000
Data Source: SoSoValue
As of press time, Bitcoin has approached $65,000 again but has not yet formed a clear trend breakout; Ethereum has rebounded to approximately $1,919. Recent open market data shows that BTC continues to fluctuate around the $64,000–$65,000 range, while ETH has shown relatively stronger performance.
Institutional capital is one of the clearest positive signals in the Crypto market this week. According to weekly data as of August 7, there has been a relatively obvious weekly capital reflow recently. From late May to late June, the market experienced consecutive weeks of massive net outflows, with some single-week outflows exceeding $1 billion. Entering July, outflows significantly narrowed, and the first week of August saw a net inflow approaching $900 million. Notably, although the size of the ETH ETF is much smaller than that of BTC, it has maintained a slight positive inflow for consecutive weeks, showing a significantly improved capital trend compared to May and June.
BTC received over $850 million in net inflows in a single week yet remains fluctuating around $65,000; ETH presents a similar pattern. This implies that the ETF buying pressure currently acts more to absorb existing market selling pressure, and a distinct supply-demand imbalance has not yet formed.
Total Market Cap Drops Slightly, Mainstream On-Chain USD Contracts Synchronously
Data Source: DeFiLlama
Data shows the total stablecoin market cap is approximately $300.61 billion, increasing by $644.42 million over the past 7 days, a growth rate of about 0.21%. USDT remains absolutely dominant, capturing a market share of 60.91%. The stablecoin market has not significantly contracted, but a broad expansion has yet to appear. The TradFi allocated funds represented by ETFs have significantly improved, while Crypto-native USD liquidity remains largely flat; the divergence between the two persists.
Important Financial/Macro Events to Watch Next Week
Next week's focus events are concentrated in the US:
-
August 12: US July CPI. Against the backdrop of weakening employment data, this inflation data may become one of the core indicators determining the Fed's policy direction in September.
-
August 13: US July PPI.
-
August 14: US July Retail Sales.
-
Continue to monitor the navigation situation in the Strait of Hormuz and Brent crude oil prices.
-
Continue to monitor Fed officials' re-evaluations of the policy risk balance following the July employment data.
The rationale is that FedWatch is currently in an almost 50/50 "pause/hike" state. If the CPI continues to fall, the weakening July employment and improving inflation can form a unidirectional signal, potentially further reducing the probability of a rate hike. Conversely, if the CPI rebounds, the marginal weakening of employment might not be sufficient to stop the Fed from continuing to tighten liquidity.
Crypto Primary Market Events ：
Data Source: CryptoRank
Recently, primary market capital has continued to gravitate towards two core narratives: "Connecting the Real World (RWA/Payments)" and "Compliance Infrastructure." Financing for generic pure-application or protocols without cash flow support has become significantly more difficult. Capital is focusing on enterprise-level service providers capable of truly breaking down the barriers between TradFi and DeFi, possessing scalability potential, and demonstrating revenue-generating capabilities.
The two largest public funding rounds this week were highly correlated with payments/stablecoins: Yellow Card, Africa's largest cryptocurrency exchange and compliant fiat on/off ramp, completed a $40 million strategic funding round. Japanese compliant stablecoin JPYC completed a $38 million Series B2 round.
This large-scale funding carries a strong industry bellwether significance. Investors include traditional bank-backed capital like SC Ventures (Standard Chartered), industry capital like Sony Innovation Fund, and crypto funds like Polychain Capital and Blockchain Capital. Following this round, Yellow Card's cumulative equity financing exceeds $120 million. More noteworthy than the funding amount is its investor structure: the simultaneous entry of traditional banking capital, industry capital, and Crypto VCs reflects that stablecoin infrastructure is gradually becoming a crossover focus for both traditional finance and crypto capital.
In its early days, Yellow Card primarily solved the gateway problem for African users buying and selling Bitcoin and digital assets, but its business positioning has shifted significantly over the past few years. In 2025, the company officially halted its retail app business to focus on B2B and institutional-grade stablecoin infrastructure. This funding round will also be mainly used to expand its global USD account business and continue expanding into Latin America and the Asia-Pacific markets.
Through Yellow Card's solutions, enterprises can hold USD and stablecoins in a single account, conduct stablecoin treasury management, and send/receive payments across 50+ countries via local payment networks. The company disclosed that its network has processed over $10 billion in transaction volume and has established partnerships with institutions like Visa, Mastercard, PayPal, and Coinbase.
This "Compliance Channel + Stablecoin Payment Implementation" business model not only possesses clear profitability expectations but also perfectly aligns with institutional capital's current investment preference for mass real-world adoption, representing one of the core evolutionary directions for Web3 infrastructure in the next phase.
Overall, capital remains willing to support projects with regulatory gateways, real-world asset cash flows, or clear B2B clients, but continues to maintain caution towards general protocols and homogeneous applications lacking revenue validation.
About KuCoin Ventures
KuCoin Ventures, is the leading investment arm of KuCoin Exchange, which is a leading global crypto platform built on trust, serving over 40 million users across 200+ countries and regions. Aiming to invest in the most disruptive crypto and blockchain projects of the Web 3.0 era, KuCoin Ventures supports crypto and Web 3.0 builders both financially and strategically with deep insights and global resources.
As a community-friendly and research-driven investor, KuCoin Ventures works closely with portfolio projects throughout the entire life cycle, with a focus on Web3.0 infrastructures, AI, Consumer App, DeFi and PayFi.
Disclaimer This general market information, possibly from third-party, commercial, or sponsored sources, is not legal, compliance, financial, or investment advice, an offer, solicitation, or guarantee. We make no express or implied representations or warranties regarding its accuracy, completeness, or reliability, and disclaim liability for any resulting losses. Investments/trading are risky; past performance doesn't guarantee future results. Users should research, judge prudently, and take full responsibility. Please consult professional legal, tax, or financial advisors if necessary.