Bitcoin is trading just under 63,000 dollars as the Coldcard hardware wallet exploit rolls into its fifth day, with observed losses now approaching 114 million dollars and a suspected fourth sweep taking another 448 BTC. Google DeepMind dropped Gemini Robotics 2, extending its model from upper-body manipulation to full humanoid whole-body control, with multi-robot collaboration and an on-device variant. Alibaba unveiled Qwen 3.8-Max, a 2.4 trillion parameter model that reportedly wrote 7,600 lines of code and ran 33 GPU training jobs autonomously over about 125 hours. Strategy sold another 1,638 bitcoin last week to fund dividends and buy back STRC preferred shares. And in Washington, the Senate has five days to move the CLARITY Act before summer recess, with prediction markets pricing passage at roughly 30%.
Let's start with the story rattling every self-custodian right now. The Coldcard exploit has entered its fifth day, and Galaxy's Alex Thorn now estimates total losses near 114 million dollars, with a fourth sweep wave hitting another 448 BTC over the weekend. Some of those transactions are still pending with replace-by-fee flags, which means if you spot your address in the mempool, you have minutes to bump the fee and rescue what's left.
Here's what actually happened, and it's brutal. This wasn't a supply chain attack or a firmware backdoor. It was a random number generator flaw sitting in Coldcard firmware for roughly five years. Seeds generated during that window were predictable at creation. The air gap didn't matter. The steel plate didn't matter. If your entropy was weak from day one, an attacker with enough compute could brute-force your keys from public blockchain data alone.
Kraken's security chief put his finger on the real scandal. Auditors verified that the intended random number generator existed in the code. They didn't verify it was actually being called. That's the kind of gap that turns a hardware wallet from a fortress into a paperweight. And it explains why Coinkite's own instruction to roll physical dice for entropy was more than paranoia. It was a hedge against exactly this failure mode.
The market reaction is telling. Bitcoin dropped about 1.5% to 62,600. Ether slid 2%. Coinbase premium hit a 77-day negative streak, meaning US spot buyers are less aggressive than overseas ones. And crucially, some holders are moving coins back to exchanges, which is the exact opposite of what Bitcoin culture has spent a decade preaching. Not your keys, not your coins, unless your keys were generated by broken firmware, in which case you might actually be safer on Coinbase for the moment. That's a sentence I never expected to say.
Google DeepMind shipped Gemini Robotics 2, and this one deserves attention because it's a real capability jump, not a marketing refresh. The previous version controlled upper bodies. This one handles the whole humanoid, from feet to fingertips. Walking, crouching, stretching, and dexterous manipulation with five-fingered hands. In the demos, Apptronik's Apollo 2 is picking up a watering can and using the SharpaWave hand for delicate tasks like sealing Ziploc bags and unscrewing lightbulbs.
The release comes in three pieces. Gemini Robotics 2 is the vision-language-action model that translates instructions into motor output. Gemini Robotics ER 2 is the embodied reasoning layer, essentially the brain, that plans multi-step tasks stretching into minutes and hundreds of decisions. And there's an on-device variant that runs locally without cloud connectivity, adapting to new robot bodies with often fewer than 200 examples.
Two features stand out. First, multi-robot collaboration. ER 2 can orchestrate different robot types working together, so Apollo 2 can hand off subtasks to a Franka Duo bi-arm robot cleaning a garage in parallel. Second, ER 2 introduces progress tracking, classifying task completion in five bands from zero to 100%, and moment-finding to pinpoint the exact frame when something went wrong. That solves one of the hardest problems in robotics, which is knowing whether the task is actually done, and if not, where to resume.
Safety got real attention too. The model halts a humanoid when it detects a person nearby and resumes only when the area clears. DeepMind is calling this its safest robotics model to date and published a new safety benchmark alongside it.
The practical implication? We're getting close to robots that can handle multi-step household and warehouse tasks without a human babysitter. Not tomorrow, but the trajectory is now visible.
On the coding agent front, Alibaba dropped what might be the most ambitious open-weight model yet. Qwen 3.8-Max clocks in at 2.4 trillion total parameters with 95 billion active per query. Weights are supposed to hit Hugging Face next week, which would make it the largest open model release we've seen.
But the parameter count isn't the story. The story is what it did unsupervised. Over 10-plus days, it built a project called oh-my-cli from scratch, running a self-evolving harness that converted requirements into GitHub issues, auto-claimed tasks, ran tests, iterated on failures, and kept going. Alibaba says it wrote 7,600 lines of code across 33 GPU training jobs over about 125 hours, reproduced all six main results from a research paper on data selection, and then beat that paper's benchmark by 2.7 points on AIME24.
The more interesting case study is the e-commerce simulation. They gave it 100,000 yuan of virtual capital and had it run a simulated year of online retail, managing stores, suppliers, pricing, returns, and crises. It ended with 416,000 yuan, roughly 38% ahead of a GLM baseline. That's not a coding demo. That's a system-level autonomy demo.
Benchmarks put it near or above Claude Opus 4.8 and GPT-5.6 on many metrics, though these are self-reported and independent verification is pending. As always with Chinese model releases, treat the numbers with skepticism until the weights land and people can rerun them.
What's genuinely interesting is the direction. Every serious lab is now pushing agents that run for days, not minutes. Hashimoto's new startup Superlogical is building a server-side terminal multiplexer specifically so long-running agent sessions survive across devices. The unit of work in software engineering is quietly shifting from a prompt to a project.
A few threads worth pulling together on the Bitcoin market side. First, the futures basis. Quarterly bitcoin futures yields have collapsed from over 20% in the last cycle to below two-year Treasury yields since February. The carry trade that funded a lot of institutional participation is essentially gone. That's a sign of a maturing market, but it also means one of the mechanical bid sources for spot ETFs, the cash-and-carry arbitrage, has dried up.
Second, ETF flows. Spot bitcoin ETFs just ended a three-week inflow streak with 62 million dollars of outflows. Not catastrophic against 54 billion in cumulative inflows since launch, but the momentum has shifted. Meanwhile, Nasdaq filed to quadruple the options position limit on BlackRock's IBIT from 250,000 to one million contracts, which would put it in the same league as mega-cap tech options. That's genuinely bullish for structural liquidity, even if flows are soft right now.
Third, Strategy. Michael Saylor's company sold another 1,638 bitcoin last week, about 105 million dollars worth, to fund dividends and repurchase 81 million of STRC preferred stock. They also raised 290 million selling common stock. The preferred dividend stays at 12% because STRC is still trading below its 100 dollar par. Saylor's team is now publicly tracking bitcoin's 200-week moving average as a key support level, which tells you something about where their heads are.
And fourth, the Clarity Act. Bernstein warns that if it fails this year, expect another leg down for crypto valuations. The Senate has effectively five days. Prediction markets give it a 30% chance. If it dies, regulators will likely accelerate rulemaking on their own, but the market wanted legislative certainty and it's not getting it.
The picture: derivatives defensive, spot demand thin, long-term holders sitting tight, and a policy overhang that isn't clearing. 10x Research thinks August could mark the bear market bottom. Historically August is rough, and this one is starting on schedule.
One takeaway. The Coldcard story is going to reshape how the industry thinks about hardware wallet audits. Verifying that secure code exists is not the same as verifying it runs. Every hardware vendor should be publishing entropy audits by the end of this quarter, and if yours isn't, ask why.