KuCoin Ventures said in its latest weekly report that the Coldcard hardware wallet flaw has grown into one of the year’s larger personal self-custody security incidents, with the real damage extending beyond direct losses to the credibility of a wallet brand that had long sold itself on a security-first design.
Coldcard flaw traced to seed-generation randomness
The report describes Coldcard as a Bitcoin-only hardware wallet launched in 2017 by Canadian bitcoin security company Coinkite. It is aimed at advanced self-custody users and security-conscious holders, with air-gapped signing, verifiable firmware and stricter offline key management as core features. Unlike Ledger and Trezor, which serve a broader retail market, Coldcard is not presented as a market-share leader, and the report noted that there is no publicly verifiable sales or market-share dataset.
That context matters because the issue was not framed as a routine wallet exploit. KuCoin Ventures said the vulnerability hit the most basic stage of wallet security: seed generation.
Citing analysis referenced in the report, a firmware update in March 2021 introduced an integration error that caused some Coldcard devices to miss the intended level of entropy from the hardware random number generator and fall back to a predictable software randomness path. Block Engineering found that the effective entropy of wallet seeds on some affected devices may have dropped from roughly 128 bits to as low as 40 bits. Under those conditions, an attacker would not need physical access to the device, a backup copy, or a network connection from the wallet. The attacker could compute and enumerate possible seeds, then match them against public bitcoin addresses.
KuCoin Ventures said the flaw remained dormant from 2021 for more than five years and began to be exploited in a concentrated way on July 30 this year. Loss estimates still differ across tracking firms. TRM Labs had tracked about 1,816 BTC stolen from more than 5,200 addresses as of Aug. 5, worth about $116 million at the time. Galaxy Research raised its cumulative estimate to around $130 million on Aug. 7 and said at least more than ten independent attackers had taken part in multiple rounds of fund movements.
Offline storage was not breached, but the seed was weak from the start
The report stressed that some affected users had used the classic form of offline cold storage, with the device itself never connected to the internet. The attack did not break the physical isolation model. The weakness was present at the moment the wallet seed was created.
Hardware wallets typically reduce exposure by using air gaps, secure elements and offline signing, but those protections depend on a more basic condition: the randomness used to generate the wallet seed must be unpredictable. If that assumption fails, network isolation later in the process cannot repair the gap left at key generation.
Coinkite has released a security notice and patched firmware, according to the report. Still, the fix only protects seeds created in the future from the same issue. It does not strengthen previously generated weak seeds. Affected users therefore still need to create a new seed in a patched environment and move assets.
The report added that Coinkite said the real risk may be materially lower for users who had added sufficient independent physical dice entropy during seed generation or set a strong BIP-39 passphrase.
Security review moves beyond brand size and offline claims
KuCoin Ventures said the bigger question raised by the Coldcard case is whether larger wallet makers can avoid similar failures. Ledger and Trezor have greater user scale and deeper development resources, the report said, but company size alone does not remove low-level security risk.
Coldcard itself is not a stripped-down budget product. Its Bitcoin-only approach, open firmware code and support for air-gapped operation were all meant to reduce the attack surface. Yet a random-number-generation defect still remained in public code for years and only drew broad attention after real funds were stolen.
That leads the report to a narrower definition of what wallet security should be measured against. Brand size, secure elements and offline design are not enough on their own. The more important questions are whether critical code receives ongoing independent audits and whether low-level assumptions around random-number generation, entropy flow, firmware dependencies and build processes can be continuously verified.
KuCoin Ventures did not treat the episode as proof that self-custody has failed. Instead, it said the event redraws the boundary of self-custody security. The industry has long focused on whether the private key remains in the owner’s hands. The Coldcard case pushes the question one step earlier: was that key generated in a trustworthy way?
In the report’s view, self-custody reduces counterparty risk tied to exchanges and third-party custodians, while shifting part of the risk to hardware design, firmware code, key generation, backup and recovery procedures, and the user’s own operational security system.
For individuals and institutions holding large balances over the long term, relying on a single device, a single vendor and a single seed source can itself become concentrated risk. KuCoin Ventures said that makes multisig setups, combinations of hardware from different vendors and independent entropy sources more important. For institutional asset managers in particular, the review of a self-custody stack may need to cover the full key lifecycle, from seed generation and signing to backup, recovery and firmware upgrades.
The report said the next points to watch are the final count of affected addresses, the ultimate loss total, the path of stolen funds, and whether other hardware wallets carry similar risks tied to randomness generation or firmware dependencies. Its core takeaway was not that cold wallets are unsafe. It was that the security model for hardware wallets cannot stop at the claim that the device is offline and the private key never leaves it.
U.S. labor cooling shifts attention back to inflation and rates
On the macro side, the report said the key driver in U.S. markets last week moved away from earnings and back to economic data. July nonfarm payrolls unexpectedly turned negative, and the prior two months were revised lower, reinforcing the view that the labor market is cooling.
At the same time, the unemployment rate fell because labor-force participation also declined. KuCoin Ventures said that leaves the labor market closer to a picture of slower hiring than a recession driven by mass layoffs.
In market terms, the first trade was lower pressure for additional tightening. The report said weaker labor data reduced the Federal Reserve’s urgency to keep raising rates in the near term, pushing down short-end Treasury yields while the S&P 500 hit a new high.
Inflation uncertainty has not gone away. Brent crude had climbed back to about $84 a barrel by the weekend, and shipping arrangements through the Strait of Hormuz had still not been fully settled, the report said. It also noted that China is leaning toward using capital markets to fund technology and artificial intelligence industries, while the Bank of Japan said in its July meeting summary that upside inflation risks are increasing. One policymaker said the pace of rate hikes could exceed market expectations if underlying CPI inflation stays close to 2%.
KuCoin Ventures argued that this week’s macro setup cannot be reduced to a simple weak-jobs-equals-easier-policy line. Its framing was tighter: cooling employment lowers the urgency for fresh Fed tightening, but energy prices and underlying inflation still limit room for any policy turn.
Based on a CME FedWatch snapshot dated Aug. 10, markets were pricing the Sept. 16 meeting as follows:
- 53.9% probability of no change at 3.50%–3.75%;
- 46.1% probability of a 25 bp hike to 3.75%–4.00%;
- Probability of a rate cut still near 0.
The report said July employment data has pulled the market back from stronger hike expectations, but the debate remains whether the Fed hikes again, not when cuts begin.
ETF inflows improved, but BTC stayed near $65,000
In the secondary crypto market, KuCoin Ventures said bitcoin had moved back toward $65,000 at the time of writing but still had not broken into a clear trend. Ether had recovered to about $1,919. Public market data also showed BTC repeatedly trading around the $64,000 to $65,000 range, while ETH was relatively stronger.
Institutional flows were described as one of the clearest positive signals of the week. Using weekly data from SoSoValue through Aug. 7, the report said this was one of the more visible weekly reversals in recent months. From late May to late June, there had been several consecutive weeks of heavy net outflows, with some weeks exceeding $1 billion in outflows. The pace of outflows narrowed in July, and the first week of August then posted close to $900 million in net inflows.
The report added that ETH ETFs, while much smaller than BTC ETFs, have logged consecutive weeks of modest positive inflows and showed a clearer improvement than in May and June.
Even so, BTC took in more than $850 million of net inflows in a single week and still hovered around $65,000. ETH showed a similar pattern. KuCoin Ventures said that suggests ETF buying is still absorbing existing selling pressure rather than producing a clear supply-demand imbalance.
Stablecoin market cap at about $300.609 billion
For stablecoins, the report cited DeFiLlama data showing total market capitalization at about $300.609 billion, up $644 million over the past seven days, or roughly 0.21%. USDT remained dominant with a 60.91% market share.
KuCoin Ventures said the stablecoin market is not in clear contraction, but broad-based expansion has not appeared either. In its reading, ETF flows reflect a visible improvement in traditional-finance allocation to crypto products, while crypto-native dollar liquidity remains mostly flat on-chain.
Market calendar centers on CPI, PPI, retail sales and oil
The report listed the week’s key events as U.S.-focused:
- Aug. 12: U.S. July CPI;
- Aug. 13: U.S. July PPI;
- Aug. 14: U.S. July retail sales;
- Ongoing attention on shipping through the Strait of Hormuz and Brent crude prices;
- Continued monitoring of how Fed officials rebalance policy risk after the July labor data.
The reason, KuCoin Ventures said, is that FedWatch is almost exactly split between pause and hike. If CPI keeps easing, weaker employment and softer inflation would align and lower the odds of another hike. If CPI reaccelerates, the softer labor data may still not be enough to stop the Fed from tightening liquidity further.
Primary funding continues to cluster around payments, RWA and compliance
On venture funding, the report said private-market capital is still moving toward two core narratives: linking crypto with the real world and building compliant infrastructure. RWA and payments are central to that shift, while broad application projects or protocols without cash-flow support are finding it much harder to raise capital.
The two largest publicly disclosed deals of the week were both closely tied to payments or stablecoins. Yellow Card, described in the report as Africa’s largest cryptocurrency exchange and a compliant fiat on- and off-ramp, completed a $40 million strategic financing. Japan’s regulated stablecoin JPYC completed a $38 million Series B2 round.
KuCoin Ventures said the Yellow Card deal carries notable signaling value for the industry. Backers included Standard Chartered’s SC Ventures, Sony Innovation Fund, and crypto-focused funds such as Polychain Capital and Blockchain Capital. With the new round, Yellow Card’s cumulative equity financing has exceeded $120 million.
The investor mix mattered as much as the amount. Bank-affiliated capital, industrial capital and crypto venture investors all joined the same round, a sign that stablecoin infrastructure is becoming a shared focus for both traditional finance and crypto capital.
The report said Yellow Card originally focused on giving African users a way to buy and sell bitcoin and digital assets, but its positioning has shifted clearly over the past few years. In 2025, the company formally ended its retail app business and moved to a B2B and institutional stablecoin infrastructure model. The latest financing will mainly be used to expand its global dollar account business and continue its push into Latin America and Asia-Pacific.
According to company disclosures cited in the report, businesses using Yellow Card can hold dollars and stablecoins in a single account, manage stablecoin treasury functions and send or receive payments through local payment rails in more than 50 countries. The company said its network has processed more than $10 billion in cumulative transaction volume and has partnerships with Visa, Mastercard, PayPal and Coinbase.
KuCoin Ventures said the business model of combining compliant rails with real-world stablecoin payments offers a clearer path to monetization and fits institutional demand for scalable, practical adoption. Its broader conclusion was straightforward: capital is still willing to back projects with regulatory access, real-world cash flow or clearly defined B2B customers, while remaining cautious on generic protocols and highly substitutable applications that lack revenue validation.
About KuCoin Ventures and the disclaimer
The report describes KuCoin Ventures as the main investment arm of KuCoin, which it called a global cryptocurrency exchange trusted by more than 40 million users across over 200 countries and regions. KuCoin Ventures said it invests in disruptive crypto and blockchain projects for the Web 3.0 era and supports builders financially and strategically, with a focus on Web3.0 infrastructure, artificial intelligence, consumer applications, decentralized finance and payment finance.
The report also included a disclaimer saying the material is provided for general market information only and may include information from third-party, commercial or sponsored sources. It said the content does not constitute legal or compliance advice, nor financial or investment advice, an offer or a solicitation, and should not be treated as a guarantee. It also warned that investing and trading involve risk and that past performance does not represent future results.