Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong. .
News of the Month: The Coldcard Incident
In late July, a five-year-old firmware flaw in Coldcard hardware wallets, long regarded as among the most secure self-custody devices available, was exploited at scale: well over 1,750 BTC drained from more than 5,000 addresses, comfortably in excess of $100 million as of early August, with the first wave alone draining roughly 1,083 BTC from nearly 1,200 addresses in around 41 minutes, per Galaxy Research.
To be clear: no blockchain was breached, and no cryptography was broken. Bitcoin worked exactly as designed. What broke was the process that generates the secret. A March 2021 firmware build routed seed generation through a predictable software-based random number generator instead of the device's dedicated hardware chip, meaning an attacker could regenerate affected private keys entirely offline, years later, without ever touching a device.
Every self-custody setup, however careful, rests on three things that are hard to get right alone: how the seed is generated, how it is backed up, and how many single points of failure stand between an attacker and your Bitcoin. Coldcard failed on the first, and the other two couldn't save it. This is precisely the class of problem Xapo's architecture was designed to remove:
There is no seed to attack. Bitcoin held with Xapo is protected using Multi-Party Computation (MPC-CMP): the full private key never exists in one place, at any moment, on any device; not at creation, not at signing, not ever. Key shards are created collaboratively across geographically dispersed, independently operated, HSM-protected environments, each contributing its own randomness. A flawed random number generator in any single environment cannot make the key predictable, because no single environment's randomness determines the key. There is no key-cutting machine to compromise, because no whole key is ever cut.
Published code is not the same as examined code. Coldcard's entropy path went unexamined for five years. The MPC-CMP protocol is open-source, peer-reviewed cryptography, and Xapo's key-share creation process is CCS Level 3 certified; validated independently, not taken on trust.
Key shards do not age. Shards are automatically refreshed approximately every 60 seconds, so even a hypothetically compromised shard is obsolete before it could be exploited. There is no five-year-old secret sitting anywhere in the architecture.
The lesson of July is not that self-custody is dead. It is that the questions that matter in custody are always the same three: who generated the keys, how are they backed up, and what single point of failure remains. Ask custodians about any structure your Bitcoin sits in, including ours. We welcome the scrutiny.
For the full analysis of what happened, why the funds are in practice unrecoverable, and what regulated infrastructure offers, read the complete piece by our Executive Director, Joey Garcia: Self-Custody Is a Right. It Was Never a Guarantee.
The Inaugural Xapo Bank Summit, London
On July 1st we welcomed members, partners and friends of the bank to the Chancery Rosewood in London for our first Xapo Bank Summit. Our Management and Institutional teams were thrilled to meet so many of you in person, and we're especially grateful to the majority of attendees who travelled from overseas to join us. We hosted 38 speakers throughout the day, including Michael Saylor, Adam Back, and Dave Ripley, who convened to discuss everything from AI and quantum computing to Bitcoin's accelerating integration into mainstream finance.
For all the range on stage, one thread ran through the day. Bitcoin has finished the argument phase of its life. The debate in the room was no longer whether it belongs in the financial system, but how the financial system evolves because it exists, with adoption increasingly arriving through regulated credit, custody and yield, rather than speculation. And in a rangebound market, speaker after speaker returned to the same discipline: quiet cycles are won by the patient, not by those chasing unvetted yields.
To the members who joined us: thank you. The honest conversations you had with our team, on custody, on the cycle, on what you want this bank to build next, shaped more of our roadmap than any panel did. This Summit will be annual. We hope to see more of you in the room next year.
Xapo Bank Product Update
This month’s product news underlines London’s key takeaway: in quiet markets, patience wins.
Limit orders and stop-loss (coming soon). Most Bitcoiners hold a view on this cycle: a price at which Bitcoin is simply cheap, and they'd buy more without hesitating. Until now, acting on that view meant watching charts, and too often waking to find the move happened in your sleep. Limit orders change that. Set your buy price once and if Bitcoin touches it, the order executes, whether you're at your desk or asleep. Stop-loss orders work the same way on the downside, helping manage risk without the vigilance. Your conviction does the work; the order does the waiting. Rolling out to members in stages over the coming weeks. Keep an eye on the Trade screen in your app and we'll notify you when it reaches your account.
Activate your idle capital. Leaving stablecoins idle on an exchange means taking on counterparty risk for no return. Send USDC or USDT from any exchange and they convert straight into your USD balance, where they earn 3.35% variable interest, paid daily in Bitcoin. Your dollars sit in high-quality liquid assets, including US Treasury bills, with no lock-ups or notice periods, and USD deposits are protected up to the USD equivalent of £120,000. Dry powder that earns while it waits for your price.
DCA on autopilot. No firm view on the bottom? Set a recurring BTC purchase on your schedule and accumulate through the range without watching the charts. Your USD keeps earning interest right up until the moment it deploys, at a competitive 0.29% spread with no added transaction fee.
July BTC Market Update
Bitcoin spent July rebuilding from its second-quarter lows. The month's rally carried the price above $66,000 (peaking near $66,900 on July 21) as confidence grew that the CLARITY Act would reach a Senate vote, before the Federal Reserve's July 30 decision catalysed a ~3% selloff, leaving Bitcoin trading around $63,000 into month-end.
Zooming out, BTC remained range-bound in July, with the month's price action continuing to respect the ~$60,000 support carved out since June's drawdown.
(BTC:USD, 1D, Coinbase)
ETF flows mirrored this cautious optimism, recording positive net inflows of $172.4M over the month of July, marking a distinct reversal from the heavy outflows of May (-$2.4B) and June (-$4.5B). Despite macro headwinds, the market's resilience suggests broader institutional selling pressure has stabilised.
(BTC Spot ETF Fund Flow, SoSoValue)
Bitcoin Headlines
CLARITY Act vote pushed to September as Senate breaks for recess
The CLARITY Act, the bill that would finally set clear rules for how crypto is regulated in the US, will not get its Senate vote until September. Lawmakers left for their summer break without resolving a final disagreement, though the bill is first in the queue when they return. Read more at Forbes.
The Fed held rates, and hinted the next move could be up
The Federal Reserve left interest rates unchanged on July 30, but three officials voted to raise them in the strongest internal push for a hike in nearly a decade. Higher rates tend to weigh on assets like Bitcoin, which slipped more than 2% on the news. Read more at CNBC.
A proposed Bitcoin rule change looks set to fail
BIP-110, a controversial proposal to limit non-money data (think digital collectables) on the Bitcoin network for a year, entered its make-or-break voting window on August 8 with support from under 3% of miners, far below the 55% it needs. Whatever the outcome, coins you already hold are unaffected. Read more at CoinDesk.
Recommended Reading & Listening
Read: How Xapo Bank secures Bitcoin: MPC custody, human oversight, and the 48-hour Vault timelock: An overview of Xapo's multi-layered security infrastructure.
Read: Xapo Bank: The Gold Standard for crypto offramping: How members move seamlessly between crypto and fiat within Xapo's unique, regulated framework.
