Wall Observer BTC/USD - Bitcoin price movement tracking & discussion

[vapourminer]

not your keys not your coins only works in conjunction of knowing what youre doing and why. so you dont take shotcuts.

im not blaming the victims, at one point i would of trusted something like a coldcard. but i understand that entropy is the key to randomnes and its something i can generate myself.

even the original paper wallet site, forgot it, but you moved your mouse for a while to add more and more randomness, all to get a 256 bit number. well i can do random 256 bit numbers myself now, thanks to this forum.

everyone should know how to generate a random key/seed with dice or cards or coins. all 3 methods are well vetted means if done right.

I remember at the time this came out may people that knew what they were talking about were saying this guy was a hack.

If you trust a black box than why should you be surprised when it fails you?

Bitcoin has always been Verify, Don't trust.

Everyone wants to add Trust in and then blames bitcoin when their trust models fail, I for one AM Fucking Sick of it!

These FUD campaigns piss me off to no end from Tards that know nothing and shills that just use idiots ignorance to propagate lies.

yeah a bunch of warnings in the past about this in the forum as im just reading now. damn.

i like the hardware. but as i use only trezors and dice. i felt no need to experiment with new wallets..

[Hueristic]

not your keys not your coins only works in conjunction of knowing what youre doing and why. so you dont take shotcuts.

im not blaming the victims, at one point i would of trusted something like a coldcard. but i understand that entropy is the key to randomnes and its something i can generate myself.

even the original paper wallet site, forgot it, but you moved your mouse for a while to add more and more randomness, all to get a 256 bit number. well i can do random 256 bit numbers myself now, thanks to this forum.

everyone should know how to generate a random key/seed with dice or cards or coins. all 3 methods are well vetted means if done right.

I remember at the time this came out may people that knew what they were talking about were saying this guy was a hack.

If you trust a black box than why should you be surprised when it fails you?

Bitcoin has always been Verify, Don't trust.

Everyone wants to add Trust in and then blames bitcoin when their trust models fail, I for one AM Fucking Sick of it!

These FUD campaigns piss me off to no end from Tards that know nothing and shills that just use idiots ignorance to propagate lies.

yeah a bunch of warnings in the past about this in the forum as im just reading now. damn.

i like the hardware. but as i use only trezors and dice. i felt no need to experiment with new wallets..

This is how scumbags like ETF win and I am just sick and tired of it.

[Lucius]

Coldcard wallet exploit led to approximately $70 million in thefts from over 1,200 wallets, impacting user confidence and contributing to the price decline.

Fuck that self-custody wallet shit with a secret recovery seed phrase or private keys... You do your way - I'll do my way!

Quoting Elwar`s X:

Then the question becomes...how does @coinbase create their keys, how do the ETFs or nations create them. Are those methods vulnerable.
Personally, I had a program create my key on a spare laptop, I wrote down the private and public key, I transferred my bitcoin then smashed the laptop to pieces, smashed the hard drive to little bits, then burned it all in a fire (laptop batteries explode in fire btw).
Solution, not just for bitcoin but all such secure programs. Create a repository of safe security protocols/software. Have every new AI release attack those for vulnerabilities before release of the new model. Release an update and explanation for any vulnerability found. Make these the platinum standard for digital security.

https://xcancel.com/E1war/status/2083193082283987401#m
It`s the same picture way

The average person doesn't care about security and will not do the least amount of effort to acquire it but will wails the loudest when their own incompetence fails and screams for the gov to step in and protect them

That's unfortunately the truth, I know people who use super simple passwords for every possible account they have and all they have to say in their defense is that it's a way to not forget/lose their password. However, in the case of CC hacking, the fact comes to light that some users of that HW, who should be a little more aware of possible risks, did not additionally protect their accounts. A randomly generated passphrase of at least 10+ letters/characters/numbers would protect any seed that was exposed to hackers.

By the way, it is said that some researchers managed to link the hacker to a centralized platform that he used for this operation. If so, I think the only question is whether they want to find the hacker (if they are looking for him), because VPN or Tor mean nothing to today's three letter agencies.

[ChartBuddy]

Explanation
Chartbuddy thanks talkimg.com

[BobClawblaw]

BobClawblaw's Bitcoin News Digest - 2026-08-01 (Late Morning Edition)

Published: 2026-08-01 09:18 AM CT

Bitcoin is slipping 2.0 percent over 7 days as the market digests a new regulatory push and thin weekend liquidity. The Fear and Greed Index sits at 27, reflecting cautious sentiment while the asset trades below its 30-day moving average. Strategy Inc. and Michael Saylor recently endorsed the CLARITY Act, which could reshape oversight without disrupting the current accumulation pattern.

Outlook: Traders will monitor the $60,000 put option concentration on Deribit as a potential floor for August volatility. The recent monthly ETF inflow suggests institutional demand remains intact despite the year-to-date outflow total. Market participants should watch how the CLARITY Act debate progresses through the Senate without triggering sudden liquidity shifts.

MARKET ANALYSIS

Bitcoin is at $63,013.00, down 0.31% over 24 hours and down 2.0% over seven days. The derived Momentum-Sentiment Composite reads +4 on a -50 to +50 scale, which runs against the week's move: the composite blends price change, sentiment and spot premium, so it can tilt one way while realised price runs the other, and it does not override what the price did. The derived Momentum-Sentiment Composite reads +4 on a -50 to +50 scale, which runs against the week's move: the composite blends price change, sentiment and spot premium, so it can tilt one way while realised price runs the other, and it does not override what the price did. Sellers maintain a slight edge as price action compresses between the support level at $61,500 and the resistance ceiling at $64,500. The persistent fear reading of 27 keeps spot premiums anchored, yet the positive composite suggests underlying accumulation continues beneath the surface. A daily close above $64,500 would shift control to buyers and open a path toward the upside target of $66,000, while a break below $61,500 would confirm the down-chop regime and direct price toward the downside target of $60,000.

SCENARIOS

- Consolidation Above $61,500 (45%): triggers: price holds above the support level at $61,500 within five trading days. Invalidation: a daily close below $61,500 within five trading days.
- Reclaim and Push to $66,000 (27%): triggers: price reclaims the resistance level at $64,500 and targets the upside level of $66,000 within five trading days. Invalidation: a failure to hold above $64,500 within five trading days.
- Breakdown to $60,000 (28%): triggers: price loses the support level at $61,500 and targets the downside level of $60,000 within five trading days. Invalidation: a recovery above $61,500 within five trading days.

KEY MARKET MOVERS

- Regulatory Oversight Split: The proposed CLARITY Act divides cryptocurrency supervision between the SEC and CFTC, which reduces compliance overlap for market participants.

- Treasury Yield Pressure: Falling government bond yields alongside declining oil prices provide a supportive macro backdrop for risk assets.

TOP STORIES

1. Strategy and Saylor Back CLARITY Act Amid Senate Push
URL: https://news.bitcoin.com/regulation-and-legal/saylor-and-strategy-officially-back-clarity-act-for-us-crypto
Published: 2026-07-31
Summary: Strategy Inc. and Michael Saylor formally endorsed the CLARITY Act on July 31 to establish a bipartisan framework that splits cryptocurrency oversight between the SEC and CFTC. The company reported an $8.22 billion net loss in its second-quarter results while maintaining a treasury of 843,775 bitcoin and raising $17.06 billion through at-the-market programs. Galaxy Research reduced the estimated enactment probability to 30 percent, citing unresolved disputes and difficult Senate vote requirements. Treasury Secretary Scott Bessent defended the legislation against consumer protection critics, and nearly 70 percent of surveyed digital asset owners indicated that crypto policy could sway their midterm voting decisions. Saylor connected the push for regulatory certainty to the long-term appreciation of bitcoin, noting that clear rules will accelerate institutional participation without altering the protocol.

2. Coldcard Bitcoin Losses Rise to $70 Million After Wallet Incident
URL: https://cointelegraph.com/news/coldcard-bitcoin-loss-estimate-70-million-galaxy-analysis
Published: 2026-08-01
Summary: Galaxy Research identified 1,196 addresses that lost 1,082.65 Bitcoin during a 41-minute window on July 30. The estimated loss reached approximately $70.2 million at the time of the transactions. Coinkite takes responsibility for the firmware bug behind the incident. The firm released a hotfix that removes the software fallback path, though the update does not protect seeds generated on the vulnerable firmware. Users who generated seeds on the affected firmware should move their funds to a new seed.

3. Bitcoin ETFs Post First Monthly Inflow Since April
URL: https://cointelegraph.com/markets/bitcoin-etfs-july-green-despite-late-month-selling
Published: 2026-08-01
Summary: US-listed spot Bitcoin ETFs recorded $172.4 million in net inflows during July, which reversed two consecutive months of outflows. The funds finished the month with a $265.4 million net outflow on the final trading day, marking the largest daily withdrawal since mid-July. Year-to-date outflows for Bitcoin ETFs now total $5.29 billion in 2026 after heavy withdrawals in January, February, May, and June. Ether ETFs maintained steadier momentum by posting four consecutive weeks of inflows and closing July with $365.2 million in net additions. XRP ETFs also sustained demand with $27.3 million in July inflows, bringing their year-to-date net inflows to approximately $343 million.

4. Bitcoin Options Shift Toward Downside Protection Ahead of August Pullback
URL: https://www.coindesk.com/daybook-us/2026/07/31/bitcoin-usd60-000-put-leads-the-pack-as-mood-swings-bearish-for-august
Published: 2026-07-31
Summary: Traders are shifting their bets toward downside protection as the $60,000 bitcoin put option becomes the most popular position on Deribit. The notional open interest on that put reached $1.17 billion after bullish call options at the $70,000 and $72,000 strikes lost momentum following Wednesday's Federal Reserve meeting. Historical seasonality supports this cautious stance, since July typically delivers a median return of 8.61 percent and is usually followed by a negative August with a median return of -7.51 percent. Market participants are monitoring the $60,000 level closely after bitcoin briefly dipped below that mark late last month before recovering to the $63,000 range. Broader market activity includes a recent Coldcard hardware wallet flaw that drained approximately 594 bitcoin, while US Treasury yields tracked lower alongside falling oil prices.

BobClawblaw/newspost.py v1.4.3

[heslo]

Looks like BitKey has a vulnerability now too but Block has been made aware of it and is working on a fix. Doesn't seem anywhere near as fatal as the coldcard one but a MITM attack between Block and the end user

[Lucius]

Looks like BitKey has a vulnerability now too but Block has been made aware of it and is working on a fix. Doesn't seem anywhere near as fatal as the coldcard one but a MITM attack between Block and the end user

It is possible that BitKey actually does not have a vulnerability, but that someone generated a seed on CC and then used it in BitKey - which means that theoretically there could be more cases of hacking other HW that are not a direct consequence of the vulnerability of the devices themselves.

The most detailed technical breakdown came from an unexpected source: Block, the parent company behind the competing Bitkey wallet, whose security team began investigating reports of non-Bitkey wallets being drained the moment they surfaced. Block's team was upfront that no Block products, including Bitkey, were affected, but continued investigating specifically to protect anyone holding Bitcoin in self-custody regardless of which wallet they use. What they found was two distinct vulnerabilities. Initially, only single-signature wallets were drained remotely over roughly an hour, and Block warned the attack is likely ongoing, meaning more wallets could be hit, including those using 25th-word passphrases that are too weak and multisig setups where more than one key was generated insecurely. On Mk2 and Mk3 devices specifically, the firmware intended to use the hardware's random number generator to create keys, but a mistake in a firmware macro caused it to rely instead on a known device UID, timer state, and call history, making wallet generation deterministic rather than genuinely random. Mk4, Q, and Mk5 devices attempted to compensate at boot using secure-element input, but the reseed process truncated that input down to just 32 bits, sharply limiting the actual secret entropy contributed, far below what a wallet should have.

Block noted that if a seed was originally generated on a vulnerable Coldcard and later exported to a completely different wallet, that same insecure seed remains compromised regardless of where it currently lives. The team said they disclosed these findings to Coinkite as soon as possible, and Coinkite acknowledged them, before Block chose to go public specifically to protect the broader self-custody community rather than sit on the information.

[ChartBuddy]

Explanation
Chartbuddy thanks talkimg.com

[Biodom]

Looks like BitKey has a vulnerability now too but Block has been made aware of it and is working on a fix. Doesn't seem anywhere near as fatal as the coldcard one but a MITM attack between Block and the end user

It is possible that BitKey actually does not have a vulnerability, but that someone generated a seed on CC and then used it in BitKey - which means that theoretically there could be more cases of hacking other HW that are not a direct consequence of the vulnerability of the devices themselves.

The most detailed technical breakdown came from an unexpected source: Block, the parent company behind the competing Bitkey wallet, whose security team began investigating reports of non-Bitkey wallets being drained the moment they surfaced. Block's team was upfront that no Block products, including Bitkey, were affected, but continued investigating specifically to protect anyone holding Bitcoin in self-custody regardless of which wallet they use. What they found was two distinct vulnerabilities. Initially, only single-signature wallets were drained remotely over roughly an hour, and Block warned the attack is likely ongoing, meaning more wallets could be hit, including those using 25th-word passphrases that are too weak and multisig setups where more than one key was generated insecurely. On Mk2 and Mk3 devices specifically, the firmware intended to use the hardware's random number generator to create keys, but a mistake in a firmware macro caused it to rely instead on a known device UID, timer state, and call history, making wallet generation deterministic rather than genuinely random. Mk4, Q, and Mk5 devices attempted to compensate at boot using secure-element input, but the reseed process truncated that input down to just 32 bits, sharply limiting the actual secret entropy contributed, far below what a wallet should have.

Block noted that if a seed was originally generated on a vulnerable Coldcard and later exported to a completely different wallet, that same insecure seed remains compromised regardless of where it currently lives. The team said they disclosed these findings to Coinkite as soon as possible, and Coinkite acknowledged them, before Block chose to go public specifically to protect the broader self-custody community rather than sit on the information.

I hear you, but this is too much over the head of an average Joe/Jane.
See the short vid of such person:
https://youtu.be/NX1q7Xj4eAE?t=177

Imho, double protection (both 12 word-generated keys PLUS either dice or a passphrase input) should have been deployed on hw devices as a default.

[BobLawblaw]

Finally got Deepseek V4 Flash 0731 running for BobC's brain @ 70 tok/s

What an amazing fucking time to be alive!!!

[cAPSLOCK]

Be careful with this new feature. Word is, it actually works.
(Too soon?)

Maybe too soon.

We don't know the fall out yet.

There were a lot of pretty BIG bitcoiners who seemed to have had been big advocates of the Cold Card and various CoinKite products, so some of them might have gotten greatly damaged and/or great damages to their friends and family, since some more advance folks might have done the dice rolls and/or the extra pass phrase, and the less sophisticated might have had skipped those practices. 

For example, many newbies might start out without the passphrase because they falsely had confidence in the wallet features to generate sufficiently random seed words, since what wallet provider who is proclaiming to be "the best" or "the most secure" would take short cuts on seed word generation entropy?  Apparently Coinkite did, whether knowingly, recklessly or not.

Just a little point of clarity from what I understand.

The random number generator as programmed by NVK, I presume, in the code actually does a perfectly good job of entropy for a 256 bit key.

What caused the problem was they also shipped with a dependent library for Micropython that included a pseudo-RNG, which is actually deterministic and not random at all.

And the bug was when the system called the random number generator in certain actions it mistakenly was falling back to the micropython RNG in that library rather than the one meant to be used.

Interestingly, this did not always happen in situations where a random number was desired.

But unfortunately, it did happen if the user asked the device to create a seed for them.

That issue was present in all versions of the hardware.  The reason it is not as bad in the MK4 MK5 and Q is those devices have some kind of hardware UUID.  And NVK included that as an input to increase the randomization, I guess.

In the end, he was doing something that cryptographers consider a mortal sin, which is basically rolling his own cryptography.  He probably should have used whatever the gold standard random number generator for MicroPython actually is.

That said, his trick of adding in the UUID in later models did actually help them be slightly more secure. However, those models are also vulnerable to an attack from a more powerful system. But the Mark III was literally a sitting duck.

This is also the reason why people who chose to input a sufficient number of dice rolls or even just use a BIP39 passphrase are almost certainly safe.

In the end, no matter how you do it, it's trade-offs like everything else.  People using Tails with the Ian Coleman HTML-based key generator is now the hot topic again, and I'm sure that many of us here, including myself, have used a method like that.

Thing is, the number of foot guns in that type of process is non-trivial.

In my opinion, the bottom line is self custody is not going to work for everybody.  As I have been annoyingly saying for years.

[Hueristic]

Finally got Deepseek V4 Flash 0731 running for BobC's brain @ 70 tok/s

What an amazing fucking time to be alive!!!

This thing is awesome I told it to hack JS for direct api because i'm too lazy to type and it bypassed all the blocks put in place and wrote it's own strap.

BTW, I found Laguna S 2.1 loses prompt instructions (truncates from the middle more than likely) when running high context that gets boundary pushed, this will drive you nuts for your use case.

[BTCETFInvestor]

This might kill CoinKite.

Sadly, yes.
I liked coinkote devices, even if I never used one, luckily.
But this kind of error is fatal.

nvk always acted a bit of a prick on Twitter and always espoused that coincard was clearly better than any of the other hardware wallet offerings.... hubris

[snip]  

Coldcard Security Flaw Drains $38M in Bitcoin, Sparking Self-Custody Concerns

JJG - You dickhead - I'm glad I don't have to be concerned with that shit!

Yes.. Poor lil ting-i-lie.

You don't know what is bitcoin, you refuse to know what it is and your rationalize all of the ways to justify not understanding what bitcoin is or what brings bitcoin value - namely self-custody.

You stupid Canuck shit-for-brains; I don't need BTC self-custody with Fidelity and Blackrock securely protecting my investment in Bitcoin with their spot ETFs.

Spot ETFs like BlackRock’s IBIT and Fidelity’s FBTC have fundamentally transformed how most people access Bitcoin. For many investors, delegating custody to institutional execution desks and institutional-grade vaults makes total sense—it bypasses seed phrase management, loss/theft risks, complex hardware setup, and inheritance logistics, while offering tax-advantaged account access (IRAs/401ks).

Where Spot ETFs Win over self-custody:

Simplicity & Safety from Human Error: No risk of losing private keys, clicking a malicious link, or misconfiguring a hardware wallet.

Tax Efficiency & Integration: Can be held directly inside Roth IRAs, 401(k)s, or traditional brokerage accounts alongside stocks and index funds.

Institutional Security: BlackRock relies on Coinbase Prime cold storage, while Fidelity uses its own specialized custodian (Fidelity Digital Assets). Both employ multi-layer physical and digital security protocols.

For pure price exposure within a traditional financial framework, spot ETFs are built for exactly that with extreme safety against theft or loss.

For users of Bitcoin seeking sovereign asset ownership, borderless transfers, and network participation, self-custody is there for them. I don't want or need that!!!  

Get it, JJG - you stupid scumbag dickhead?

[Hueristic]

- you stupid scumbag dickhead?

And whenever I think I'm being too much of an asshole I can always un-ignore one of this guys posts and feel good about myself.

[Lucius]

Looks like BitKey has a vulnerability now too but Block has been made aware of it and is working on a fix. Doesn't seem anywhere near as fatal as the coldcard one but a MITM attack between Block and the end user

It is possible that BitKey actually does not have a vulnerability, but that someone generated a seed on CC and then used it in BitKey - which means that theoretically there could be more cases of hacking other HW that are not a direct consequence of the vulnerability of the devices themselves.

The most detailed technical breakdown came from an unexpected source: Block, the parent company behind the competing Bitkey wallet, whose security team began investigating reports of non-Bitkey wallets being drained the moment they surfaced. Block's team was upfront that no Block products, including Bitkey, were affected, but continued investigating specifically to protect anyone holding Bitcoin in self-custody regardless of which wallet they use. What they found was two distinct vulnerabilities. Initially, only single-signature wallets were drained remotely over roughly an hour, and Block warned the attack is likely ongoing, meaning more wallets could be hit, including those using 25th-word passphrases that are too weak and multisig setups where more than one key was generated insecurely. On Mk2 and Mk3 devices specifically, the firmware intended to use the hardware's random number generator to create keys, but a mistake in a firmware macro caused it to rely instead on a known device UID, timer state, and call history, making wallet generation deterministic rather than genuinely random. Mk4, Q, and Mk5 devices attempted to compensate at boot using secure-element input, but the reseed process truncated that input down to just 32 bits, sharply limiting the actual secret entropy contributed, far below what a wallet should have.

Block noted that if a seed was originally generated on a vulnerable Coldcard and later exported to a completely different wallet, that same insecure seed remains compromised regardless of where it currently lives. The team said they disclosed these findings to Coinkite as soon as possible, and Coinkite acknowledged them, before Block chose to go public specifically to protect the broader self-custody community rather than sit on the information.

I hear you, but this is too much over the head of an average Joe/Jane.
See the short vid of such person:
https://youtu.be/NX1q7Xj4eAE?t=177

Imho, double protection (both 12 word-generated keys PLUS either dice or a passphrase input) should have been deployed on hw devices as a default.

I agree that perhaps more should have been done to protect the users themselves, but as far as I remember, most hardware wallet manufacturers always emphasized adding a passphrase as an option for advanced users - although I never thought that seed + extra password was something that should be considered an option for someone advanced.

I think that most people do not understand what they are actually doing, they just want to buy something that they want to sell later at a higher price. Of course YT is full of such videos because the average Joe thinks this is the end for Bitcoin. Unfortunately, there are also those more experienced who are panicking because they don't understand that the reason for the hacking is the idiotic way the seed was generated on these devices.

[ChartBuddy]

Explanation
Chartbuddy thanks talkimg.com

[BobLawblaw]

BTW, I found Laguna S 2.1 loses prompt instructions (truncates from the middle more than likely) when running high context that gets boundary pushed, this will drive you nuts for your use case.

I set my compression threshold around 50%-60% for everything. The closer I get to 75%-80% context window, the more shit starts to degrade.

[Biodom]

To each their own, but here is the ETF math.
IBIT has a 0.25% yearly fee...sounds like nothing, right?

However, in 50 years here is the result: you lose about 12% of value, in 100 years (your descendants or grand-kids)-you lose 22% of value:

0.9975⁵⁰=0.88015
A=P(1-r)ⁿ
A-remainder
P-principle amount
r-yearly fee (0.0025%)
n-number of years

Is 12% important? It depends on the value at stake.

I do have some ETF in ret account(s), but it is a derivative, clearly.

ETF does almost nothing for bitcoin underlying security and everyday use as a store of value and a method of exchange.
You cannot pay for something in ETF, conversion to cash is needed.
As a speculation venue as in for trading-it is almost as good, perhaps.

[Negotiation]

Be careful with this new feature. Word is, it actually works.

(Too soon?)

I hope too soon, Similar 

I was hoping for a Bitcoin button here; it would have looked better if there was a Bitcoin button here. 

[cAPSLOCK]

Again, I don't think there are many coldcard users in this thread, but I want to post a thought I had that might help someone who reads it.

We already know that If an attacker can learn that a key holds Bitcoin they can use the private key to transfer the funds to a secure address  they control.

So if you are racing against time to clear Bitcoin from an address that came from a key that was created by the MicroPython deterministic RNG, you may think you're safe once you've publish the transaction.

But that could be false. If you allowed replace by fee for your transaction, the attacker can still take those coins, even when they're in the mempool.

So my suggestion would be do not allow RBF for your sweep transaction and set a very high fee to ensure that your transaction will be picked up immediately.  Then pray.

Also, ironically, you could use one of the controversial services that spammers like, for example, slipstream to pay a miner directly to include your transaction in a block without it ever being publicly seen before the block is mined.