A firmware bug shipped in March 2021 has become the largest self-custody failure in Bitcoin's history. Galaxy Research now tracks roughly 1,367 BTC — nearly $89 million — drained from 4,585 addresses across three waves, with the opening July 30 sweep taking 1,083 bitcoin from 1,196 addresses in 41 minutes. The flaw sat in seed generation: instead of routing entropy through the hardware random number generator, affected Coldcard builds pushed it through a software RNG, making keys mathematically reconstructible offline without ever touching the device.

The attacker profile is what should worry you. Galaxy's Alex Thorn described the sweeps as deliberate and likely LLM-orchestrated, warning that every single-sig Coldcard address created after the flawed firmware will eventually be drained — and the stolen coins had averaged 3.18 years of dormancy, meaning the victims were long-term holders. Coinkite's CEO confirmed that new firmware protects new seeds but does nothing for seeds already generated.

The second-order effect is the actual trade. CryptoQuant's Julio Moreno flagged that daily exchange deposits under 10 BTC spiked to 7,300 BTC on Friday, the highest since February 6, while total exchange-held bitcoin rose to 2.715 million from 2.704 million. This is the FTX reflex in reverse. Every on-chain supply metric you read this month is contaminated.

Trump Media moved another 2,628 BTC worth roughly $165 million on Sunday, deepening losses on a treasury assembled near record prices. Lookonchain puts cumulative sales at 7,281 BTC against an original 11,542 BTC bought for about $1.37 billion at an average of $118,522 a coin — exits averaging $74,855, with a combined realized and paper shortfall near $555 million.

The timing is the tell. The disposal landed as the company switched on Truth API, an institutional feed priced up to $100,000 a month and falling to $60,000 on a three-year commitment — against first-quarter revenue of just $871,200, meaning a single list-price subscription would roughly double the top line. Warren and Schiff have already asked the SEC to probe the product.

Zoom out and this is the treasury-company model unwinding in public. Bitcoin treasury vehicles have bled roughly $49 billion since their 2025 highs. Strategy posted an $8.22 billion Q2 net loss driven by an $8.32 billion unrealized markdown, and now holds 843,775 BTC at an average cost of $75,476 — a level that had MSTR down more than 8% on Friday with bitcoin under $63,000.

The FOMC voted 9-3 to hold at 3.50%–3.75%, with three dissents calling for an increase. Warsh was blunt afterward: "There is only a target, and it is 2 percent." CME FedWatch now assigns a 61.4% probability to a 25-basis-point hike to 3.75%–4.00% on September 16, up from 50.6% a month earlier — while odds of a 50bp move collapsed to zero and a cut carries no probability at all.

The mechanism is energy. Oil and bond yields have been grinding higher as hostilities continue between the United States and Iran, and crude topping $100 a barrel is exactly the kind of supply-side shock that keeps headline inflation sticky. Warsh has also gutted forward guidance — the July statement ran 166 words, roughly a third the length of Powell's last one. Less guidance means more repricing risk per data point.

Watch this week: ISM lands today with consensus at 54.0 for July, prices-paid the line that matters, and July CPI on August 12 effectively settles September. Meanwhile 85% of the ~300 S&P 500 companies reported so far have beaten estimates — a market pricing growth into a tightening cycle.

The CLARITY Act has cleared the House and a Senate committee but still has no floor vote, no cloture motion, and no date on the calendar, with Thune saying he doesn't expect it to reach the floor before recess begins around August 7. He prioritized federal nominations and a Russia sanctions bill instead.

The blocker is ethics, not market structure. Seven Senate Democrats led by Murphy, Van Hollen and Merkley formally rejected the latest version on July 22 and 23, citing insufficient restrictions on federal officials' crypto holdings — leaving Republicans needing at least seven Democratic votes to break a filibuster. Polymarket priced 2026 passage at 28% on July 30, down from a February peak of 82%, while Galaxy cut its own estimate to 30%.

Prices already reflect the loss. Marex analysts framed the delay as the removal of the market's one crypto-specific support, with the catalyst meant to unlock institutional buying now parked. Missing recess pushes the bill into a September session crowded by appropriations fights and the November midterms, and Lummis has warned that failure in 2026 could delay comparable legislation to 2030 or beyond.

Tokenomist counts more than $1.28 billion of scheduled token unlocks over the next month, with one-time releases including HYPE, YZY, PROVE, KAITO, ENA, ZRO, CONX and AVAX, plus linear unlocks across RAIN, SOL, TRUMP, DOGE, WLD, ASTER, ZEC, MORPHO, TAO and PUMP.

The standout is Wednesday. Succinct unlocks 312.49 million PROVE on August 5 — 31.25% of maximum supply against a circulating float of roughly 195 million, meaning the release exceeds everything already trading. Cliff unlocks of that ratio don't get absorbed; they get front-run, and the sell pressure typically arrives days before the date rather than on it.

Context matters for how badly this lands. Total crypto market capitalization sits near $2.25 trillion on $38 billion of daily volume, with bitcoin dominance at 56.3% and sentiment still reading fear despite a 1.2% daily gain. The Fear & Greed Index prints 27. Thin volume plus fresh supply plus no regulatory catalyst is the setup that produces August's reputation — historically bitcoin's worst calendar month, with a median 7% loss.