A firmware flaw in one of Bitcoin's most popular hardware wallets just led to $130M+ in stolen BTC. 210,000+ BTC moved out of long-term holder wallets. Spot ETFs have seen inflows every single day. Price has not made a new low.

"Digital detectives are going sleepless after Bitcoin wallet hack." Bloomberg profiles the community response to the $130M Coldcard exploit. Alex Thorn, who's spoken with 100+ victims: "These are average everyday people saving their money in Bitcoin. They were true believers." Becca Rubenfeld on the developers working around the clock: "It's like they're off at war. That's the vibe."

All 8 Flock surveillance cameras in Winona, Minnesota were cut down and removed over a few days. Poles sawed at the base, cameras gone. It's part of a growing nationwide backlash against automated license plate surveillance. Multiple cities have now shut their Flock systems down entirely.

Senator Lummis after the Clarity Act vote delay: "We've come too far to quit. This fight is far from over."

Bitcoin's Red Team started as an emergency response to the Coldcard disaster. Less than 3 days later: 24 people, 425 projects scanned, ~6,700 findings, and 1,029 classified as high or critical. Moving at 7.7 projects per hour. But the real bottleneck isn't discovery. It's disclosure. Only ~19.5% of scanned projects had a SECURITY.md. Only ~13.1% listed a security email. By hour 55, the team had produced thousands of findings but had only contacted ~130 projects. The scanners move at machine speed. Responsible disclosure is still hunting around for an email address. @OpenSats stepped up and gave the effort a home. Code RED will prioritize support for red-teaming critical Bitcoin software and reimburse past LLM token costs. The dedicated Red Team Fund is live. This week exposed how cheap vulnerability discovery has become and how unprepared most open-source projects are to receive the results. If your code touches bitcoin, publish a security contact. If you can reproduce and triage findings, the Red Team needs you.

Gold futures surge above $4,400/oz, hitting their highest level since June 5th after the US economy lost 23,000 jobs in July. Gold is now up more than 10% over the last month.

Rand Paul says letters seeking Fauci prosecution for contempt delivered to DOJ after Senate vote.

Bank of America is spending $250 million a year on Ozempic and GLP-1 weight loss drugs for employees. CEO Brian Moynihan calls it a good investment in workforce health and productivity.

Coldcard is directing users to follow their next firmware updates on GitHub as they work on a new release focused on customer key migration.

Sen. Van Hollen and SIFMA CEO debate Clarity Act. Van Hollen: “I think this is a warning for all of us that bill is not ready for prime time.” CEO: “We think the bill that came out of the Senate Banking Committee had a number of good things in it.”

Saylor on why saving in dollars is a losing game. "One acre of land in Miami Beach cost $10,000 a hundred years ago. Today that same acre is $10 to $20 million. The dollar lost about 7% of its economic value every year for 100 years running."

Tesla's Terafab looks straight out of science fiction.

Saylor on why Strategy sold bitcoin: "The only person that's never sold more Bitcoin than me is Satoshi." Says they had to prove short sellers wrong. "If you want people to believe you can do a thing, you have to do the thing."

The company responsible for making sure AI models can't hack the internet just accidentally let AI models hack the internet. Irregular is an Israeli AI security startup backed by $80M from Sequoia. Their entire job is running cybersecurity evaluations on frontier AI models before they're released to the public. OpenAI, Anthropic, Meta, and Google all use them. Their website says their mission is "protecting the world in the time of increasingly capable and sophisticated AI systems." Irregular misconfigured their testing sandboxes, leaving internet access wide open when it should have been completely sealed off. Anthropic's Claude and Mythos models breached 3 real companies during capture-the-flag tests going back to April. Meta's Muse Spark 1.1 exploited a vulnerability in a third-party service during testing in the same type of misconfigured Irregular environment. Separately, OpenAI's models exploited a zero-day to escape their own sandbox and hack Hugging Face. Different failure, same theme. The walls aren't holding. None of the AI labs are dropping Irregular. And Irregular's response? They're "developing a white paper." The one company standing between unreleased AI models and the open internet failed at its most important job. Repeatedly.

$250 billion poured into passive equity funds over the last 4 weeks. A record. Meanwhile, active funds lost $50 billion. Combined net flows hit $200 billion, blowing past the previous all-time high of $165 billion from early 2021.

Big Oil is on track for ~$44B in Q2 profits, 3rd largest quarter ever. Exxon: $14.7B Chevron: $12.1B (record) Shell: $9.8B

Nikita Bier has resigned as X's Head of Product. He'll stay on as an advisor.

"Wave one happened in 41 minutes. Not one of those UTXOs was created before March 17th, 2021, when the cold card firmware bug was introduced." Alex Thorn breaks down the attack waves.

"All of the coins in wave one are just sitting inert. They have not moved." Alex Thorn on tracing the Coldcard hack funds through collector addresses, none of them laundered yet.

Senate may delay August recess to vote on the CLARITY Act. Sen. Lummis: “I don’t think we’ll be leaving on Friday. I think we’ll go into the weekend.”