Where security actually gets decided was this weekend’s story. A randomness bug written into cold wallet firmware in 2021 handed attackers 1,367 Bitcoin five years later, and the rest of the day lands on the same nerve: the quiet design choices underneath a product decide what it can survive.
- 4,585 addresses drained, and the five-year-old key flaw behind it is still paying out
- The CLARITY Act is missing from the Senate calendar with a week left before recess
- Bank of Italy priced 200 stablecoin transfers and found the cost sitting in the conversion steps at either end
- Two XRP Ledger features return after security researchers broke them
Every one of these turns on something built long before it made news. A firmware decision from 2021, a bill drafted for a chamber that has not scheduled it, the conversion step at both ends of a transfer, and an amendment rewritten after somebody found the hole in it.
A five-year-old key flaw has emptied 4,585 Bitcoin wallets
Source: Decrypt
Galaxy Research says roughly $88.6 million in Bitcoin has now been drained from wallets created with Coldcard firmware released in March 2021, which generated seed phrases with too little randomness and left the resulting private keys guessable. The count stands at 1,367 BTC across 4,585 addresses in three waves, the most recent taking 207.73 BTC.
Alex Thorn, who leads the team tracking it, describes the sweeps as deliberate and programmatic, and has flagged around 600 suspected attacker addresses to federal investigators and compliance firms. The coins sat untouched for an average of 3.18 years before they moved. Thorn’s instruction to anyone still holding Bitcoin on an affected address is to move it immediately.
Zypto take: Randomness at the moment a wallet is created sits upstream of every protection layered on afterwards, which is what makes this one so hard to defend against in hindsight. Ask how your keys were generated, and keep asking it of any self-custody wallet you trust with them.
The CLARITY Act is missing from the Senate’s calendar
Source: CryptoSlate
The Digital Asset Market Clarity Act, which cleared the House as H.R. 3633, does not appear on the Senate floor schedule for Monday, which lists a spending-bill vote and nothing else. No cloture filing had been entered in the Senate ledger through July 31.
The arithmetic is tight. A cloture filing by Wednesday could support a vote on Friday, and the Senate goes into recess on August 10.
Seven Democratic negotiators said the current draft fell short while committing to keep talking, Senator Elizabeth Warren opposes the revised text, and Majority Leader Thune has said a procedural vote happens before recess only if enough Democratic support appears.
Zypto take: Market-structure rules land hardest on businesses deciding whether to take crypto at the till, and the ones already doing it stopped waiting for a bill. Zypto Pay settles merchant payments in fiat or 100+ cryptocurrencies today, with 0% merchant-side processing fees.
Bank of Italy priced 200 stablecoin transfers
Source: CoinDesk
Bank of Italy researchers sent 200 USDC transfers across ten two-way corridors linking Italy with Brazil, Argentina, Japan, the UAE and South Africa, and found costs ranging from 0.3% to almost 9%. That beats the World Bank’s 6.65% global average, though stablecoins came out ahead of Wise in only three of the seven corridors where both could be compared.
The cost was concentrated at the edges. Exchange and currency-conversion fees made up most of it while blockchain fees were a small share. Transfers settled in under 20 minutes wherever an instant payment system existed, and took one to two business days where one did not.
The researchers added the line worth reading twice: if stablecoins could be spent directly on goods, rent or school fees without being converted back into local currency, the economic advantage would be substantially higher.
Zypto take: That last line describes a product rather than a hypothetical. Paying bills with crypto reaches 87,000+ billers across 126 countries straight from a wallet, with no bank account and no manual off-ramp in the middle.
Two XRP Ledger features return after researchers broke them
Source: CoinDesk
Version 3.3.0 of xrpld is expected this week carrying five proposed amendments, each of which needs 80% validator approval for two consecutive weeks. Two are returning after being pulled over security bugs.
Batch lets up to eight cross-account transactions execute atomically, so either all of them land or none do. Validators rejected it and an emergency release marked it unsupported after Pranamya Keshkamat and the firm Cantina found a signature-validation flaw in February 2026 that would have let an attacker execute transactions from any account without holding its keys.
Permission Delegation, which grants narrowly scoped signing authority without handing over full control, was disabled after a September 2025 disclosure showed one account could charge fees to another and potentially drain its balance. Confidential MPT, Sponsored Fees and Reserves, and Dynamic MPT fill out the ballot.
Zypto take: A chain willing to withdraw its own feature, sit with the problem, and put it back rewritten is doing the unglamorous part of the job properly. XRP is one of 20+ chains in Zypto App, and delegated signing is exactly the sort of primitive that makes business payment flows work without anyone surrendering their keys.
Key Takeaways
- Security is settled at the moment of creation. Everything after that measures the damage rather than preventing it.
- Legislative timetables move slower than adoption, and the businesses accepting crypto have already stopped waiting on one.
- Moving money onchain has largely stopped being a chain cost and become a conversion cost.
- The chains earning trust are the ones willing to pull a feature, fix it, and try again in public.
- Watch the conversion step. Whoever removes it from everyday spending collects the savings these studies keep finding at the edges.
