card

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

ASUS and Gigabyte, among other graphics card manufacturers, plan to raise product prices in the mainland Chinese market again in September, by up to 500 yuan (approximately 2,300 New Taiwan dollars). The price increase effect will also boost the performance of ASUS, Gigabyte, MSI, Leadtek, and Chengqi.According to reports from mainland Chinese media IT Home, ASUS will raise the net cost price of the NVIDIA RTX 5070 series by 150 to 300 yuan in September, while prices for other series models will remain unchanged. Gigabyte will increase the price of all models in the NVIDIA RTX 5060TI 16G series by 200 yuan in September, while other models will remain the same. AMD's RX 9070 XT series will increase by 200 yuan; the RX 9060 XT 16G/8G series will increase by 200 to 250 yuan; and the RX 7650 GRE series will increase by 400 yuan.The main reason for the price increase is the shortage of memory, and production capacity has also shifted towards manufacturing AI computing power GPUs. NVIDIA has again lowered the overall shipment volume of consumer GPUs by 15% to 20% for the third quarter, and the estimated supply for various brands in September is similar to that in August, with supply still tight. The high-end models such as the NVIDIA RTX 5080 and 5070 TI remain among the most out-of-stock models. This year, NVIDIA has raised graphics card prices multiple times, and September marks another increase.

Bitcoin News posted on the X platform that Coldcard is replenishing dealer inventory in batches as new devices are produced. About a month ago, Coldcard's entropy vulnerability led to the theft of over 100 million dollars worth of Bitcoin from users; the company stated that several dealers have applied for additional inventory, and the devices continue to sell.

According to Catcher Predict monitoring, in the prediction market Polymarket for the event "St. Louis Cardinals vs. Colorado Rockies," the option "St. Louis Cardinals" in the sub-market "St. Louis Cardinals vs. Colorado Rockies" has experienced a drastic fluctuation in winning probability, dropping from 84% an hour ago to the current 12.5% (a fluctuation of 71.5%). Please note the impact of related breaking news.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

The People's Bank of China announced the overall operation of the payment system for the second quarter of 2026. By the end of the second quarter, a total of 10.267 billion bank cards had been issued nationwide. Among them, there were 677 million credit cards and credit card loans, a decrease of about 10 million cards compared to the end of the first quarter, and a decrease of nearly 20 million cards since the beginning of the year, averaging over 100,000 credit cards exiting the market each day. Compared to the historical peak of 807 million cards in the second quarter of 2022, the number of credit cards has been reduced by about 130 million.The mid-year report of listed banks in 2026 shows that the overdraft balances of credit cards from the six major state-owned banks decreased at the end of the first half compared to the end of the previous year. The Industrial and Commercial Bank of China had a credit card loan balance of 597.157 billion yuan, a decrease of 14.39% from the end of the previous year. By the end of June, the cumulative number of credit cards issued by Bank of China was about 152 million, with an increase of 1.76 million cards compared to the end of the previous year; China Merchants Bank saw a net increase of 256,300 cards to 97.7073 million cards.In terms of asset quality, the non-performing loan ratios for Agricultural Bank of China and Postal Savings Bank of China remained at 2.05% and 1.45%, respectively; the non-performing loan ratio for Industrial and Commercial Bank of China rose to 5.37%; and the non-performing loan ratio for Bank of Communications increased from 2.68% to 3.8%. The non-performing loan ratio for China Minsheng Bank rose to 4.22%, and for Industrial Bank, it rose to 3.79%. In the first half of the year, China Merchants Bank generated new non-performing loans of 23.698 billion yuan, with a non-performing loan ratio of 1.90%. In August 2026, the principal and interest of non-performing credit card transfers amounted to 12.2 billion yuan.

According to monitoring by Catcher Predict, in the Polymarket event "St. Louis Cardinals vs. Los Angeles Dodgers," the sub-market "First 5 Innings Spread -1.5" for the "St. Louis Cardinals" option has experienced significant fluctuations in winning probability, soaring from 14% an hour ago to the current 49% (a fluctuation of 35%). Please note the impact of related breaking news.

Gate, the global cryptocurrency exchange, has launched the Gate Card, a Visa prepaid card product, in collaboration with Bridge and Stripe, significantly reducing the implementation period to about 6 months, compared to the over one year estimated by traditional banking partners.The Gate Card is issued by Lead Bank and allows users to top up with stablecoins and spend on the global Visa network. The card can be added to Apple Pay and Google Wallet. Previously, Gate had launched card products in overseas markets, but faced complexities related to compliance and multi-party coordination in the U.S. market.Gate US COO Laura Lui stated, "Bridge serves as a critical coordinating layer among different participants, allowing Gate US to focus on customers, product experience, and overall business strategy." Gate US views the Gate Card as an early step in a broader stablecoin payment strategy, with potential plans to issue its own stablecoin in the U.S. through Bridge's stablecoin platform in the future.

According to monitoring by Catcher Predict, in the market prediction event "St. Louis Cardinals vs. Los Angeles Dodgers" on Polymarket, the option "Los Angeles Dodgers" in the sub-market "Spread -1.5" experienced a drastic fluctuation in win probability, plummeting from 81.5% an hour ago to the current 42% (a fluctuation of 39.5%). Please note the impact of related breaking news.

Gate AI and XYO announced a partnership to jointly launch the cryptocurrency asset prediction game XYO Crypto Cards. XYO randomly selects 3 cryptocurrency assets daily from the token pool launched on Gate, with Gate AI providing the first prediction. Players have 24 hours to judge the price rise or fall of the same assets and allocate their predictions to different multiplier card positions, competing against the AI model and other players.This product combines Gate market data, Gate AI, and XYO Layer One to establish a verifiable record for each prediction. Gate market data is used to determine the final results, and the choices submitted by players before the prediction window closes will be recorded on XYO Layer One. The game adopts a direct confrontation mode between users and AI.Gate US COO Laura stated that AI will play an important role in shaping the future of digital assets, with its value lying in achieving a more intelligent connection between users, data, and the ecosystem through AI. Currently, Gate US has obtained 36 state-level MTL licenses, expanding its compliant operational scope to 47 jurisdictions. Previously, Gate launched event contracts and event markets.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

The Block's investigation shows that on the social trading app Fomo and Robinhood's self-custody wallet Robinhood Wallet, users can directly purchase Memecoin using credit cards via Apple Pay or Google Pay without completing a separate KYC identity verification. Transactions can also accumulate points or cash back rewards as normal credit card rewards. The media tested the purchase of WIF, and transactions on the Visa and Mastercard networks were classified under merchant category code MCC 5815 (digital goods media), rather than the cryptocurrency asset categories MCC 6012 or 6051 as stipulated by card organization rules, which typically come with crypto tags and do not earn rewards.These transactions are supported by the Token Checkout product from the crypto infrastructure company Crossmint. Crossmint insists that this classification is appropriate, citing the joint guidance released by the SEC and CFTC in March of this year, which views certain Memecoins like WIF as "digital collectibles." However, Chase stated that the Visa transaction was not marked as a cryptocurrency purchase and that the classification was incorrect, and they have initiated a case review with Visa; the New York Attorney General's office also stated that it is reviewing the matter. Vanderbilt University law professor Yesha Yadav and other payment experts believe that the SEC's position and card organization rules represent "two completely different systems."

According to Cointelegraph, the stablecoin payment company Kast has launched the KAST Business platform, integrating features such as corporate accounts, payment cards, cross-border transfers, and stablecoin yield balances. The platform provides services through stablecoin infrastructure.Kast stated that businesses can receive payments through fiat virtual accounts provided by regulated partners, deposit supported stablecoins and crypto assets, issue virtual cards, and make local payments in over 20 currencies.The platform's services cover more than 170 countries and regions, but specific availability varies by jurisdiction. Idle balances earn an annual yield of up to 8%, and there is also a cashback of up to 3% on spending.Kast is a fintech company rather than a bank, and regulated services are provided by licensed partner institutions. Kast completed a $80 million financing in March at a valuation of $600 million, which will be used for product development, licensing acquisition, and expanding into North America, Latin America, and the Middle East markets. The company claims to currently have over 1 million users and plans to attract 1,000 to 5,000 active businesses by the end of 2026.

According to IT Home, WeChat Pay announced that the AI Exclusive Card now supports usage in DeepSeek Harness and OpenClaw. After user authorization, the process from smart recommendations to order payment can be completed in conversations.The AI Exclusive Card can currently be used to pay for over 700 Pay Skills on Skillhub in the aforementioned two products, with plans to expand to more scenarios in the future. The activation process includes: installing the weixinpay plugin for DeepSeek Harness or OpenClaw via the npx command, generating a binding link by the Agent when using paid skills on Skillhub, and completing the binding of the WeChat Pay AI Exclusive Card. After that, each order requires user confirmation on the mobile end, deducting funds from the exclusive card balance. The official emphasizes that the exclusive card funds are isolated from the main account, the limit is self-controllable, and each payment requires user confirmation.

Blockstream stated that Jade is not affected by the Coldcard random number generator vulnerability and has released firmware 1.41 after receiving extensive AI-assisted security reviews. Jade indicated that it has undergone dozens of automated AI scans and multiple manual reviews, focusing on sensitive areas such as random number generation and transaction signing.The new firmware enhances stack protection, updates dependencies, audits sensitive memory cleanup processes, and upgrades the Jade runtime environment. Blockstream claims that Jade's random number generation mechanism uses multiple entropy sources, including hardware chip noise, timing data, sensor data, and camera noise, and mixes them using SHA-512 to prevent a single entropy source failure from affecting seed generation. The team stated that other lower-severity findings are still being addressed, and firmware 1.42 is expected to be released in a shorter development cycle.

The Solana-based crypto debit card infrastructure Rain was hacked due to vulnerabilities in outdated contracts, resulting in approximately $1.1 million in funds being stolen. The affected crypto bank Avici's token AVICI dropped from a 24-hour high of $0.43 to a historical low of $0.217, a decline of 49%, before recovering to around $0.378.Avici confirmed that the attack only affected the card funds contract used for recharge consumption, and its self-custody wallets were not impacted, promising to fully refund the affected balances. In this incident, 1,685 Avici users lost approximately $500,800; another crypto bank, Tria, also had 636 users affected, with losses exceeding $430,000. The discrepancy between the approximately $1.1 million tracked on-chain and the losses reported by Avici indicates that other protocols supported by Rain were also attacked.Transaction data shows that the attacker repeatedly submitted signature authorizations, adding themselves as administrators of the card collateral account and withdrawing balances. The stolen stablecoins were exchanged for SOL, cross-chain to Ethereum, and ultimately flowed into the mixer Tornado Cash. Avici has filed a report with the FBI's Internet Crime Complaint Center. This incident also exposed issues with the custody transfer behind some self-custody crypto cards: although users control their wallets, the funds used for consumption are transferred to third-party contracts.

According to monitoring by Catcher Predict, in the Polymarket event "Pittsburgh Pirates vs. St. Louis Cardinals," the "Yes" option in the sub-market "Overtime" has experienced a dramatic fluctuation in winning probability, soaring from 8.5% an hour ago to the current 50% (a fluctuation of 41.5%). Please note the impact of related breaking news.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

Coinkite's hardware wallet Coldcard has been exposed for a serious entropy vulnerability, which has gone undetected since 2021, resulting in over $100 million in Bitcoin being stolen, with victims mostly being users of single mnemonic wallets. The weak entropy allowed attackers to guess private keys through customized means, prompting the Bitcoin community to reassess the reliability of single-signature self-custody.Against this backdrop, multi-vendor multisig solutions are becoming the new custody baseline recommended by long-term holders. This solution requires users to construct multisig addresses using keys from different wallet vendors, such as Trezor Safe 7, Ledger Nano, and Casa recovery keys to form a 2-of-3 multisig, thereby reducing reliance on a single hardware vendor. Multisig can also defend against wrench attacks and has given rise to Bitcoin insurance services priced in BTC, such as AnchorWatch.However, multisig also has its drawbacks; users not only need to keep threshold keys but also need to save copies of the multisig script or template to independently recover funds when the wallet service is offline.

Bitcoin News posted on the X platform that BTC Sessions stated their team spent several weeks assisting Bitcoin holders affected by the Coldcard vulnerability in transferring their funds to safety, estimating that they protected Bitcoin worth tens of millions of dollars during this period. However, for many, it was too late.A member of the local Bitcoin community lost 90% of their Bitcoin, while another woman who spoke with them lost all of her Bitcoin. BTC Sessions stated that this could be the most severe self-custody incident in Bitcoin history. BTC Sessions indicated that this experience prompted them to rethink asset custody, with diversified security measures becoming a key lesson.