Galaxy Research
@glxyresearch
$GLXY | Newsletter | Podcast | Reports Disclaimer:
75 Following 23.1K Followers
The Coldcard exploit is ONGOING. Move Coldcard single-sig funds to safe locations immediately!
We have reported ~600 addresses we believe to be hackers holding funds stolen from Coldcard-generated weak entropy addresses to federal investigators, industry compliance firms, and cross-industry cyber investigators.
Thank you to all the victims with the courage to share their addresses or relevant txids. Your act of sharing has helped us immensely to develop onchain patterns and thereby identify new victims and attacker addresses to report to authorities.
If you continue to share with us in replies or DM @intangiblecoins, we will continue to add your addresses to our investigation.
Show more
Zcash rolled out its Ironwood network upgrade Tuesday, permanently sealing the chain’s previous primary private transaction pool, called Orchard, so that it can no longer accept deposits or internal transfers, and opening a private pool named Ironwood.
More here 👇
Show more
been reading politico playbook for like 20 years but first time seeing my name printed in “talk of the town” 👀
that was fun last night! thanks to everyone in DC who joined us at Pubkey
pass the bill!
Show more
TradeXYZ, the top deployer of HIP-3 perps markets on Hyperliquid, is reimbursing traders for liquidations resulting from an accurate but anomalous third-party price feed reading. Notably, the hiccup came from the traditional financial system, not crypto.
More here 👇
Show more
CHARTS OF THE WEEK: Solana perps DEX Phoenix Trade recorded back-to-back record days for volume and open interest after announcing a rewards program that will pay traders $420k in USDC over the coming month. The lesson: incentives matter.
More here 👇
Show more
In this week's newsletter, Taj Singh parses the dueling open letters over AI regulation; Lucas Tcheyan unpacks Zcash’s Ironwood upgrade; and Will Owens looks at TradeXYZ’s one-time bailout of traders burned by an accurate but anomalous oracle mark.
Show more
We have completed a review of every Bitcoin transaction in the past 30 days and have identified NO additional transactions that match this pattern.
The analysis below captures the totality of transactions matching this fingerprint. However, the nature of the vulnerability means that future attacks are possible on any Coldcard-generated address and those do not need to match this pattern.
(The pattern tells us these were all the same attacker — it does not capture the attack itself, which looks the same as if a coin owner chose to move coins.)
Stay vigilant and move coins out of single-signature Coldcard addresses and into secure custody, either at a custodian or exchange you trust or into a multisig self-custody setup.
Show more
We mapped the flow of funds for the Coldcard vulnerability based on the pattern identified by engineers at Block and shared by @clay_garrett
1,196 addresses drained in full for 1,082.65 BTC (~$70.2M) between 01:10:20 and 01:51:26 UTC on Jul 30 — a 41-minute window, blocks 960,183-960,191. That preceded the hardware-wallet vendor's public advisory by ~30 hours.
Signature: every sweep paid an identical hardcoded 30.0 sat/vB — a 30-75x overpay vs the 0.4-1.0 sat/vB median that week — and left no change output. That looks like an automated tool spending keys it already held, not owners moving funds. Victims: 1,183 native segwit (BIP-84), 7 BIP-49, 6 BIP-44 — consistent with multi-path key scanning.
Proceeds consolidated within minutes and have NOT moved since:
- bc1qq85v2c9...cu9r — 562.02 BTC
- bc1qx76cae2...fhe3 — 398.48 BTC
- bc1q8jy96fe...tp3q — 89.62 BTC
- bc1qnk4zh9q...fecp0 — 32.45 BTC (unmoved)
Show more
We mapped the flow of funds for the Coldcard vulnerability based on the pattern identified by engineers at Block and shared by @clay_garrett
1,196 addresses drained in full for 1,082.65 BTC (~$70.2M) between 01:10:20 and 01:51:26 UTC on Jul 30 — a 41-minute window, blocks 960,183-960,191. That preceded the hardware-wallet vendor's public advisory by ~30 hours.
Signature: every sweep paid an identical hardcoded 30.0 sat/vB — a 30-75x overpay vs the 0.4-1.0 sat/vB median that week — and left no change output. That looks like an automated tool spending keys it already held, not owners moving funds. Victims: 1,183 native segwit (BIP-84), 7 BIP-49, 6 BIP-44 — consistent with multi-path key scanning.
Proceeds consolidated within minutes and have NOT moved since:
- bc1qq85v2c9...cu9r — 562.02 BTC
- bc1qx76cae2...fhe3 — 398.48 BTC
- bc1q8jy96fe...tp3q — 89.62 BTC
- bc1qnk4zh9q...fecp0 — 32.45 BTC (unmoved)
Show more
Even through record June ETF outflows, institutions leaned into onchain credit. Standard Chartered initiated coverage on Aave & Morpho, DeFi lending TVL held ~$39.9Bn, and tokenized RWAs hit a record $30.1Bn. The collateral base is deepening.
Our July update:
Cc: @kenzieyangxz @galaxyhq
Show more
ROBINHOOD CHAIN
traders have started pairing memecoins directly against tokenized equities
new @glxyresearch report on the chain's first month
link in replies
“If you don’t believe me or don’t get it, I don’t have time to try to convince you, sorry.”
the U.S. treasury secretary quoting satoshi nakamoto never gets old
pass the bill!
Pass The Bill
another day in washington, another orange tie
the black SUVs will continue until CLARITY passes
pass the bill!
Nic Carter on where AI, quantum, and Bitcoin collide.
This week's Galaxy Brains: @intangiblecoins talks with @nic_carter of Castle Island Ventures on AGI, cybersecurity, and the quantum threat to Bitcoin. Plus Beimnet Abebe (Galaxy Trading) on the latest in markets.
Show more
Bitcoin’s SOPR stands at 0.970, the 2nd percentile of its historical range (rank 103 of 4,942), indicating that onchain holders are collectively realizing losses.
30d SOPR (0.994) is approaching bear market bottoming levels (historically ~0.983).
Show more
PnL ALERT - 80.00 BTC ($5.10M) moved
+$3.56M (+231% gain)
cost basis ~$19K avg (oldest coin 2017-12-17) - held 8.6y
🕐 2026-07-13 23:51 UTC - block 957,916
Address: 3LfrYsaFFvT5vyVU8dkyt6HxbgpyWqARTq
Show more
almost 4000 BTC sent today so far by US government to coinbase prime.. these 2874 are latest
🇺🇸 US GOVERNMENT SPEND: 2874.902649 BTC ($183.28M) moved to Coinbase Prime in blocks 957893 & 957894
US Gov Address: 17Zcvze37nSVh7nuLMqGt45QzFYeZUruXF
TXIDs: dd7d40e79c12e2aaef844fcba4e67025bc64c0343a8e07d7a73fa920b4f36599
bf24fd3943d8988dbe00a36070dc1c1aa89bbc92677b115916fcb01ea8bc25d2
🕐 2026-07-13 18:26 UTC
🕐 2026-07-13 18:39 UTC
Show more
longest ever weekly net outflow streak culminated with -121,203 BTC (-$8.2 bn)
🟠 BITCOIN POLICY INSTITUTE INTERVENES IN ‘NOAH DOE’ CASE
big development in ‘noah doe’ "abandoned bitcoin" case in which an anon is seeking to gain legal title over satoshi’s coins.. @bitcoinpolicy just filed to intervene as a defendant fighting to kill the whole thing
👏👏
Show more
