Strategy's $8.2B Loss: Bitcoin's 594 BTC Wallet Hack

Today's market is telling us institutional Bitcoin is turning into productive collateral even as a hardware flaw quietly drains self-custody holders.

Bitcoin is trading near $63,908, with Ethereum around $1,888. Read the price chart alone and today looks like another quiet consolidation day inside the $62K–$66K band this Pulse has flagged since Tuesday. Underneath it, Strategy booked an $8.2 billion quarterly loss and started selling Bitcoin for the first time in its history, a Spanish megabank showed up on a BlackRock ETF filing, two more public companies started putting BTC to work as collateral and payroll rails, and a five-year-old firmware bug quietly drained $38 million from roughly 500 self-custodied wallets.

Corporate Bitcoin Splits Into Two Speeds: Patient Losses and Active Monetization

Strategy's headline loss and its new willingness to sell sit next to a run of much smaller companies discovering what else Bitcoin can do on a balance sheet.

• The loss: Strategy reported an $8.2 billion Q2 net loss, driven almost entirely by an $8.32 billion unrealized markdown on its bitcoin holdings under fair-value accounting. It now holds 843,775 BTC, up 25% since January, worth roughly $54.8 billion against a $63.7 billion acquisition cost, an average cost basis near $75,500 versus a market price in the mid-$60,000s.

• The pivot: the company's USD reserve rose 12% quarter-over-quarter to $2.4 billion at quarter-end, then jumped further to $3.75 billion since, enough to cover roughly two years of preferred dividends and interest. It sold $218.4 million in bitcoin under a new BTC Monetization Program, breaking a no-sell policy that had held since 2020. Chairman Michael Saylor framed it as expanding the company's "Digital Credit" business rather than losing conviction, and Strategy separately authorized a $1 billion buyback of MSTR common stock, though nothing has been executed yet.

• The Santander tell: Banco Santander, Spain's largest bank, disclosed a $4.3 million position in BlackRock's spot Bitcoin ETF (IBIT) in its Q2 13F filing, a small stake relative to its broader U.S. equity book, but the first appearance of a Tier-1 European bank on IBIT's shareholder list.

• The Hyperscale angle: Hyperscale Data (NYSE American: GPUS) had built its Bitcoin treasury to 1,106 BTC (~$71.7M) as of July 27, then sold roughly 100 BTC to help fund a Michigan AI data center under a contract that could exceed $3 billion, keeping the bulk of its remaining holdings as collateral for a new Bitcoin-backed credit facility priced at 4.5%–5%. Its chairman said borrowing against Bitcoin beat issuing equity at current valuations.

• The Vida template: Vida Global (NYSE American: VIDA), a publicly traded AI operating-system company, began paying its global team in Bitcoin over the Lightning Network via Voltage Credit, Vida settles in dollars, Voltage handles instant BTC delivery, and no Bitcoin ever touches Vida's balance sheet. The setup started with one employee in Argentina asking to be paid in Bitcoin instead of pesos.

• The read: none of this is the ETF-flow story this Pulse has tracked all week. It's a step past it, Bitcoin is starting to function as collateral, credit, and settlement rail for companies that aren't primarily Bitcoin businesses, even while the largest corporate holder just took its biggest quarterly loss on record.

A Five-Year-Old Firmware Bug Just Cost Self-Custody Holders $38 Million

The Coldcard hack and a copycat XRP staking scam landed in the same week, different mechanisms, same lesson about trusting the wrong layer.

• The exploit: roughly 594 BTC (about $38 million) was swept out of nearly 500 separate wallets in a 25-minute window early Friday, traced to a random-number-generation flaw in Coinkite's Coldcard hardware wallet. The bug, introduced in firmware 4.0.0 back in March 2021, caused affected devices to skip their hardware randomness generator and fall back to predictable, software-based key generation seeded from non-secret chip data, meaning an attacker who knew the flaw could reconstruct a wallet's private keys without ever touching the device.

• The blast radius: every drained wallet was single-signature, many had sat untouched for years, and the coins taken spanned 2021 to 2026, matching the age of the bug almost exactly. The attacker has already consolidated 562 of the 594 BTC into a single address that hasn't moved since.

• The fix: Coinkite says the flaw is isolated to seeds generated on Mk3 devices running firmware 4.0.1 or later; Mk4, Q, and Mk5 models appear unaffected based on its early analysis. The Mk5 is the model Coinjuice's own hardware wallet comparison recommended for Bitcoin-only holders wanting maximum security, so today's advisory affirms rather than undercuts that pick but caution is advised.

• The copycat: Seoul police say a fake staking site impersonating Flare Network drained 3.4 million XRP (about $8.5 million) from 71 investors in an eight-day run last October, promising 1.5%–1.8% monthly returns and laundering credibility through fake Naver blog posts, Wikipedia edits, and paid YouTube testimonials. Three suspects have been arrested, a fourth is subject to an Interpol Red Notice, and authorities believe the real take across the broader scam network could run as high as $19 million.

• The takeaway: different mechanism, same conclusion, a hardware flaw needs no victim error at all, while a staking scam needs only a convincing enough website. Self-custody removes counterparty risk from an exchange; it does not remove implementation risk from the device or platform holders trust to generate their keys.

The Lesson

Bitcoin's institutional story and its self-custody story are moving in opposite directions this week. Corporations are learning to put Bitcoin to work as collateral, credit, and payroll infrastructure. Individual holders are being reminded that "not your keys, not your coins" cuts both ways, a five-year-old firmware bug can make even a hardware wallet no safer than the exchange it was meant to replace. Custody strategy is a decision to revisit periodically, not a box to check once.

Coinjuice Lens: Self-Custody

The Coldcard flaw is a direct stress test of the framework in Coinjuice's self-custody guide: holding your own keys only reduces risk if the device generating them is trustworthy, verifiable, and kept current. A dormant single-sig wallet from 2021 was exactly the profile this bug targeted, proof that "set it and forget it" self-custody needs the same maintenance discipline this Pulse has applied to institutional accumulation all week, checking under the hood periodically rather than assuming a one-time setup stays safe indefinitely.

News Behind Today's Pulse

1. Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep (CoinDesk, July 31, 2026) — primary reporting on the Coldcard RNG flaw, the 25-minute sweep, and which firmware versions are affected.

2. Coinkite Issues Mk3 Security Warning After 594 BTC Swept in Minutes (TFTC, July 31, 2026) — Coinkite's own advisory, confirms Mk4/Q/Mk5 are unaffected and details the March 2021 firmware origin of the bug.

3. Strategy books $8.2 billion Q2 loss on bitcoin price decline (CoinDesk, July 30, 2026) — source for the Q2 loss figure, BTC holdings, cost basis, and the new BTC Monetization Program.

4. Banco Santander Discloses $4.31M IBIT Position in First-Ever Bitcoin ETF Filing (TFTC, July 2026) — source for Santander's Q2 13F disclosure and its first appearance on IBIT's shareholder list.

5. Scammers stole millions of XRP tokens from dozens of investors via a fake Flare Network site (CoinDesk, July 30, 2026) — source for the Flare Network impersonation scam and core figures; suspect count (three arrested, one Interpol Red Notice) cross-checked against Crypto Economy's July 30 report.

6. Strategy Inc (MSTR) Q2 2026 Earnings Call Highlights (GuruFocus, July 30, 2026) — primary source reconciling the $2.4B quarter-end vs. $3.75B current USD reserve figures.

7. Hyperscale Data Bitcoin Treasury Reaches 1,106 Bitcoin Worth Approximately $71.7 Million (PR Newswire, July 27, 2026) — company press release confirming the pre-sale treasury figure of 1,106 BTC.

Market Snapshot

Data as of July 31, 2026. BTC/ETH prices via DefiLlama. Strategy's loss, holdings and USD reserve figures are from its Q2 2026 earnings release, cross-checked via GuruFocus; the $2.4B and $3.75B reserve figures both come directly from that release (quarter-end level vs. the level reached subsequently) rather than being in conflict. Hyperscale Data's 1,106 BTC figure is the company's own July 27 press release; no primary source confirms a specific post-sale treasury figure, so it is not stated here. Coldcard theft figures come from Coinkite's own advisory and on-chain tracking and may be revised as the investigation continues. The Flare Network scam figures reflect Seoul police's disclosure as reported by CoinDesk and Crypto Economy; the department has said the true scale of the broader fraud network could be higher. This Pulse builds on prior editions covering the July 29 FOMC hold and July 30's institutional-accumulation thread; those events are not repeated here beyond the ongoing $62K–$66K consolidation context. Not financial advice.