Week 31 (2026) · BTC Weekly

Balanced · Trusted · Concise

Senate Majority Leader John Thune shelved the CLARITY Act before the chamber's August recess on July 27, dropping prediction-market odds of 2026 passage to 27% and leaving U.S. digital asset market-structure law without a clear path to enactment. On the same day, a firmware entropy bug dormant in Coldcard hardware wallets since March 2021 surfaced as an active exploit — an attacker swept $38 million from 474 wallets in 25 minutes — while Bitcoin's most contested soft fork proposal advanced toward its August 9 mandatory miner-signaling deadline with Foundry, controlling a third of global hashrate, putting the vote to its customers.

1 · Regulation

Senate Set the CLARITY Act Aside Before Its August Break — and 2026 Passage Odds Fell to 27%

Senate Majority Leader John Thune told reporters on July 23 that the chamber's pre-recess schedule — consumed by a Russia sanctions package dedicated to the memory of the late Sen. Lindsey Graham and a backlog of federal nominations — left no viable floor window for the CLARITY Act's required sequence of debate, amendments, and a 60-vote cloture vote before lawmakers scatter on August 7. The bill cleared the House 294–134 in 2025 and the Senate Banking Committee 15–9 in May 2026, but Democrats have continued to condition their seven to nine needed votes on changes to how the bill designates DOJ as the primary enforcement authority — a sticking point distinct from the ethics provisions barring federal officials from issuing digital assets that drew attention during the bill's July 22 revision. Polymarket prediction markets placed the bill's 2026 passage odds at 27% on Friday, down from a February peak of 82%; Galaxy Digital analyst Alex Thorn independently estimated the probability at 30%. The Senate returns from recess around September 8.

The September return lands in a fall calendar compressed by midterm-cycle scheduling pressures, with Democrats' core objection to the DOJ enforcement framework unchanged — the same combination that prevented a pre-recess vote.

(CoinDesk, Yahoo Finance)

2 · Research

A Firmware Build Error in Coldcard Wallets Let Someone Drain $38 Million From 474 Bitcoin Wallets in 25 Minutes

Introduced in firmware version 4.0.0 in March 2021, the error caused affected Coldcard devices to fall back to MicroPython's software random number generator during seed generation instead of using the dedicated hardware entropy source — producing seeds with as little as 40 bits of entropy rather than the expected 128. Seeds derived from predictable parameters — device serial numbers and internal clock values — gave an attacker a keyspace narrow enough to precompute private keys and scan the blockchain for matching outputs at scale; the July 31 sweep targeted 474 single-signature wallets that had been inactive for extended periods. The affected models include Mk3 devices running firmware 4.0.0 through 5.0.3, Mk4 and Mk5 devices before version 5.6.0, and Q devices before version 1.5.0Q. Coinkite urged all potentially affected users to generate new seeds with substantial external entropy — a minimum of 50 dice rolls, it said, to push keys outside the attackable range.

The attack establishes that a hardware wallet's security guarantee ends at the quality of randomness used during seed generation — a property invisible during normal operation and unauditable without on-chain forensics after funds move.

(CoinDesk, Bitcoin Magazine)

3 · Research

Foundry Put Bitcoin's Most Contested Soft Fork to a Hashrate-Weighted Miner Vote With the August 9 Deadline Approaching

The vote — weighted by each miner's average hashrate from July 6 to July 15, with non-responses counted as "No" — would commit Foundry to switching its signaling only if supporters cleared 51% of participating hashrate; Foundry controls approximately one-third of Bitcoin's global hashrate. BIP-110, titled the Reduced Data Temporary Softfork and authored by developer Dathon Ohm, reached Complete status in the BIPs repository on June 25; its seven rules would restrict most transaction outputs to 34 bytes, OP_RETURN to 83 bytes, and data pushes to 256 bytes for one year, targeting Ordinal inscriptions, BRC-20 payloads, and other non-payment data. Signaling support stood near 2.64% of global hashrate as of July 27, with OCEAN Pool signaling by default; Antpool and ViaBTC have not moved. Michael Saylor published a 110-point public case against the proposal on July 18, and leading Bitcoin Core developers have not endorsed the change — leaving the activation path advancing almost entirely against developer consensus.

If Foundry's customers vote against signaling and major pools hold out, total support will remain well below the lock-in threshold, and BIP-110's August 9 window will resolve to a failed activation — delivering the clearest live data point yet on how Bitcoin's governance handles a contested soft fork under widespread opposition.

(CryptoBriefing, Bitcoin Magazine)

Editor's Choice