Brazil will mandate that regulated banks and exchanges report cryptocurrency transfers of $10,000 or more involving self-custody wallets beginning October 1, 2026, expanding anti-money laundering oversight across the country's $252.5 billion crypto market.
Coinbase is building post-quantum custody infrastructure to protect digital assets against future quantum computing threats, with Head of Cryptography Yehuda Lindell outlining plans to support multiple signature schemes beyond traditional Multi-Party Computation methods.
White-hat researchers transferred 52.37 Bitcoin linked to the July Coldcard wallet exploit into an address controlled by the Crypto Recovery Trust. The move is intended to facilitate the return of rescued Bitcoin to verified owners of the compromised wallets.
South Korean cybersecurity company DCENT issued a critical security notice on September 16 telling users to transfer assets from its App Wallet immediately after detecting abnormal asset transfers. Initial findings indicate the security issue is limited to the App Wallet product.
Bitcoin Core 32.0 entered final testing on September 14 with a scheduled release date of October 10. The major update includes improvements to fee estimates, faster block processing, and changes to default wallet protocols that may temporarily disrupt some popular applications.
Hardware wallet maker Trezor disclosed that attackers compromised its third-party email service provider, enabling them to send phishing emails from Trezor's legitimate domain. The fraudulent emails falsely claimed a security flaw in STM32 hardware had weakened recovery phrases on some devices.
Hardware wallet maker Trezor disclosed that attackers compromised its third-party email provider Brevo, enabling phishing emails to be sent from Trezor's legitimate domain to approximately 347,000 newsletter subscribers.
Jack Dorsey's financial technology company Block has submitted an application to the Office of the Comptroller of the Currency to establish Builders Bank & Trust, a federally regulated national trust bank that would provide custody and fiduciary services for Bitcoin and stablecoins.
The Royal Government of Bhutan has moved approximately 400 Bitcoin, worth around $30.62 million, to an unidentified external address according to blockchain analytics firm Lookonchain. The transfer reduces Bhutan's sovereign Bitcoin holdings to 518 BTC.
Hardware wallet manufacturers Ledger and Trezor are jointly urging the cryptocurrency industry to adopt more responsible disclosure practices for security vulnerabilities, with concerns mounting about AI-enabled threats. The rare collaboration between competitors aims to improve security standards across the hardware wallet sector.
The attacker behind the third wave of Coldcard hardware wallet exploits has moved approximately 97.09 BTC (about $7.7-7.8 million), representing 45% of funds stolen in that wave. The hacker routed the Bitcoin through THORChain and CoinJoin mixing services to obscure the trail, according to Galaxy Research.
Blockstream's Liquid Network disabled its bridge nodes after approximately 4,000 BTC ($320 million) were withdrawn from the federation wallet to a single address. The withdrawer left an on-chain message stating "we are whitehats."
Hardware wallet manufacturer Trezor disclosed that an additional 67,000 U.S. customers were affected by a data breach at shipping partner ShipMonk, bringing the total to over 80,000 exposed customer records. The breach involved personal information including names, email addresses, phone numbers, and shipping addresses from orders dating back to 2019, despite Trezor's belief that ShipMonk had deleted the data as certified.
Hardware wallet manufacturer Trezor disclosed on September 4 that an additional 67,000 US customers were affected by the ShipMonk shipping partner data breach, bringing the total to approximately 80,700. The breach exposed names, addresses, and phone numbers of customers who ordered between November 2019 and August 2021.
Crypto wallet maker Ledger has been hit with a $500 million class action lawsuit alleging the company failed to prevent multiple data breaches and adequately protect customers. Plaintiff Douglas Kim claims he lost $1.9 million after attackers exploited compromised customer data from a December 2023 breach, with a former employee's lingering access enabling malicious code injection.
Coinkite released new firmware for Coldcard hardware wallets following a randomness vulnerability that enabled attackers to steal $114 million in Bitcoin, adding user-supplied entropy and stricter transaction checks.
Coinkite released firmware updates 5.6.1 and 1.5.1Q for Coldcard hardware wallets following disclosure of a seed-generation vulnerability that resulted in an $88.6 million Bitcoin theft. Users with affected seed phrases must create new wallets and transfer their Bitcoin.
Bitcoin hardware wallet manufacturer BitBox released firmware version 9.26.5 to address severe security vulnerabilities discovered during internal security reviews that utilized AI models. The company confirmed no funds were stolen but urged users to update their devices.
Binance-backed cryptocurrency wallet provider SafePal disclosed that a flaw in an order-tracking plugin exposed names, phone numbers, and shipping addresses of 39,798 customers over 14 months. The stolen records are now being advertised on cybercrime forums, raising concerns about phishing and physical security risks for affected users.
A security flaw in Coldcard hardware wallets has led to the theft of over $115 million in Bitcoin, with 1,778.58 BTC swept from 8,680 addresses since July 30. Galaxy Research has been tracking the incident and supporting over 200 victims.
Hardware wallet manufacturer Trezor disclosed that approximately 14,000 customers across seven countries had their names, email addresses, and shipping information exposed after unauthorized access to systems at ShipMonk, its third-party fulfillment partner. The company emphasized that customer wallets and funds remain secure.
A security exploit in Coldcard's offline cryptocurrency storage devices led to approximately $130 million in losses, triggering a sharp increase in new Bitcoin addresses as users rushed to move funds to secure wallets. New Bitcoin addresses jumped from 260,000 to over 330,000 last week, reversing months of declining trends.
Following a firmware vulnerability in Coldcard hardware wallets that affected seed generation, attackers have begun laundering stolen cryptocurrency, with 64 BTC ($4.17M) and 200 ETH ($380K) routed through mixers. At least 15 separate attackers are exploiting the vulnerability, with the largest controlling 1,159 BTC that remains unmoved, in what's being called the biggest hardware wallet exploit in crypto history with losses exceeding $30 million.
A volunteer group of 16 security researchers used AI tools to audit 390 Bitcoin-related open-source projects, discovering 4,962 potential vulnerabilities in approximately 30 hours, including 85 critical and 635 high-severity issues. The rapid security sweep was prompted by a recent $100 million Coldcard wallet exploit.
Zeus Wallet, a self-custodial Bitcoin Lightning Network wallet, shut down its infrastructure on Wednesday after experiencing a cybersecurity incident and is conducting a security audit before restoring services.
Eric Halem, a former Los Angeles Police Department reserve officer, received a life sentence plus 15 years in state prison for his role in a December 2024 armed home invasion in Koreatown, where he and accomplices posed as police to rob a 17-year-old of a hard drive containing approximately $350,000 in Bitcoin.
A security vulnerability in Coldcard cryptocurrency hardware wallets allowed hackers to steal over $130 million in July, contributing to total monthly crypto losses of $247 million—the second-worst month of 2026. Additional incidents included a $7.9 million theft from Coinsbuy.
A security flaw in Coldcard's Mk3 hardware wallet, introduced in firmware version 4.0.0 in March 2021, enabled attackers to steal between $38-70 million worth of bitcoin from hundreds of wallets by exploiting predictable key generation. The vulnerability affected wallets that used the device to generate seed phrases, prompting urgent warnings for users to move funds to newly generated wallets.
A security flaw in Coldcard's Mk3 hardware wallet, introduced in firmware version 4.0.0 in March 2021, enabled attackers to steal between $38-70 million worth of bitcoin from hundreds of wallets by exploiting predictable key generation. The vulnerability affected wallets that used the device to generate seed phrases, prompting urgent warnings for users to move funds to newly generated wallets.
Annamite Capital, founded by Tom Geary and Lucas Gaylord, has launched an institutional Bitcoin treasury management platform offering separately managed accounts through which clients retain legal ownership of their Bitcoin while assets remain with qualified custodians or in approved tri-party arrangements. The platform seeks to generate Bitcoin-denominated returns through market-neutral investment strategies while maintaining institutional governance and risk-management standards.
Quantum security startup Project Eleven has funded a proof that allows wallet owners to reclaim Bitcoin after quantum computers can forge signatures, using the wallet's key-derivation path as ownership proof. The tool runs in 243 milliseconds on a laptop.
Ledger has released Ledger Agent Stack, an open-source toolkit that allows AI agents to read wallet balances and prepare cryptocurrency transactions while requiring human approval via hardware for any fund movements, keeping private keys out of AI control.
Ledger has released Ledger Agent Stack, an open-source toolkit that allows AI agents to read wallet balances and prepare cryptocurrency transactions while requiring human approval via hardware for any fund movements, keeping private keys out of AI control.
A Bitcoin wallet that had been inactive since the 2017 market peak transferred its entire holdings of 5,908 BTC, worth approximately $383 million, to a new address on July 16, 2026. The coins were originally acquired near Bitcoin's 2017 peak at around $16,000 each and have gained roughly 284% since then.
A court in Qingdao, China sentenced a man surnamed Zhang to 10 years and nine months in prison for stealing 107 Bitcoin from victim Feng after memorizing most of the 12-word wallet recovery phrase. The ruling establishes legal precedent by treating Bitcoin as property under Chinese law.
A Bitcoin wallet dormant since March 2011 transferred 15 BTC on June 2, 2026, months after receiving a legal notice via blockchain demanding proof of ownership in a $285 billion lawsuit. The wallet retained 20.55 BTC as change.
A New York judge temporarily halted a lawsuit over 39,000 dormant Satoshi-era Bitcoin wallets worth approximately $285 billion, where plaintiffs claim ownership under lost-property laws. The case involves wallets that have been inactive for over 14 years, with at least one address receiving legal notice via Bitcoin's OP_RETURN field demanding proof of ownership.
Strategy executives, including Michael Saylor, announced the company may sell Bitcoin to fund dividend payments or other corporate needs, reversing years of hardline 'never sell' rhetoric as the firm reported its third consecutive quarterly loss.
Block Inc. revealed it holds 28,355 BTC ($2.2 billion) including $1.5 billion in customer Bitcoin and $692 million in corporate treasury, adding 114 BTC in Q1 and committing to regular third-party audited reports.
The CEO of troubled Polish exchange Zonda revealed a Bitcoin wallet holding approximately 4,500 BTC (worth over $330 million) is inaccessible because private keys were never transferred during a company handover.
The U.S. SEC issued new guidance indicating that certain user-facing interfaces used in crypto securities trading may not need to register as broker-dealers if they allow users to transact using their own wallets without intermediation.
American musician Garrett Dutton (G. Love) lost 5.9 Bitcoin ($420,000) after entering his seed phrase into a fraudulent Ledger app that appeared on Apple's App Store. The funds were quickly sent to KuCoin deposit addresses.
Lightning Labs CTO Olaoluwa Osuntokun published a working prototype on April 8, 2026, that lets Bitcoin wallet owners prove ownership via a zero-knowledge proof of their seed phrase, without revealing it, providing an escape hatch if an emergency quantum-defense upgrade ever locks users out of their funds. Running on a consumer MacBook, the tool generates a verifiable proof in 55 seconds with a 1.7 MB output, closing a gap that had existed only in theory: how to protect Bitcoin from a quantum threat without freezing ordinary users out.
Circle has unveiled plans to make its Arc layer-1 blockchain quantum-resistant from day one, allowing users to create wallets that can withstand future quantum computer attacks. The move comes amid growing concerns that 'Q-Day' may arrive sooner than anticipated.
