Stormrake - Insights #Coldcard exploitStormrake - Insights #Coldcard exploithttps://www.stormrake.com/blogs/tag/coldcard-exploitFri, 28 Aug 2026 18:04:46 +1000http://zoho.com/sites/<![CDATA[Rake Review: August 2026]]>https://www.stormrake.com/blogs/post/rake-review-august-2026The end of a bear market catches more people out than the start of one. Not because they miss the rally off the low, but because they watch it happen, decide they've missed the boat, and shelve Bitcoin entirely. They come back when it's retesting all time highs, paying 60% more for the same coin.]]>

Are You Ready For What's Next?

The end of a bear market catches more people out than the start of one. Not because they miss the rally off the low, but because they watch it happen, decide they've missed the boat, and shelve Bitcoin entirely. They come back when it's retesting all time highs, paying 60% more for the same coin.

We're Back, The Bear Market Is Over

Last month we raised the question of whether the bottom was in, and concluded that it didn't matter much either way. Waiting for confirmation was going to cost you more than being early ever would, because once the market turns and starts marching toward the forecasted $200k bull market target, the cheap entries don't come back.

We have now received that confirmation.

Bitcoin is up roughly 36% from its cycle low of $57,735, set at the start of July, and 24% from where price sat when we published last month's Rake Review. As of writing, it's trading just under $80,000.

Two things about this call sit slightly outside our own stated framework, and we'd rather flag them ourselves than have you spot them. First, price is still a touch below the $83,000 level we set as our bear market invalidation. Second, we're only ten months on from October's all time high, not the twelve that a textbook cycle usually needs before the turn. Neither is an oversight. Both are exactly why the rest of this piece exists.

The short version: the structural signals that have marked the end of every previous Bitcoin bear market have now fired, together, with volume behind them, and they've fired alongside a genuine macro catalyst. Waiting on a round number to tick over is how investors miss the first leg of a cycle.

Bear Market Over Signals

The Trendline That Has Never Lied

The single cleanest signal in our framework is the bear market trendline, the descending line connecting every lower high since October's peak. We've been tracking it with clients for months. In the third week of August, Bitcoin closed a daily candle above it, then closed above it again the following day, then went vertical.

That matters because of what it has meant historically. In 2018 and again in 2022, once price closed back above the descending bear market trendline, the low was already locked in. Both cases saw some chop in the weeks that followed. Neither ever revisited the low. This is not a signal that appears often. Structurally, it happens about once every four years.

The daily chart supported it too. A textbook inverse head and shoulders had been building since June, and the break took price straight through neckline resistance around $65,000 without hesitation. On the shorter timeframe, price had been compressing inside a symmetrical triangle for weeks, and that break was exactly the kind of decisive resolution that setup eventually produces.

Source: Stormrake Research

The Moving Average That Calls The Bottom

The second signal is the 50 exponential moving average on the daily. A sustained break above it, supported by volume, has historically marked the end of the bear market.


The important word there is volume. Bitcoin has attempted this break plenty of times before and failed, and the failures share two characteristics. They either lacked the volume to sustain the move, or they came too early in the cycle, before enough drawdown had actually been worn. 


In 2014/15, 2018/19 and 2022, the early attempts above the 50 EMA all rolled straight back over for one of those two reasons. It wasn't until the break came with real volume behind it that the bottom was in.


This time the volume showed up. That's the difference.

The Catalyst Nobody Was Watching

Technical signals need something to ignite them. In the third week of August, Bitcoin got it.

The US Treasury announced it will at least double the size of its liquidity support buyback operations for longer dated government debt, lifting the per operation cap from $2 billion to at least $4 billion across the 10 to 20 year and 20 to 30 year buckets. That followed a bond selloff that had pushed the 30 year yield to its highest level since 2007, with a buyers' strike running since late June.

The mechanism is simple. The Treasury becomes a large, price insensitive buyer in a market struggling for demand. Bond prices rise, yields fall, and every other asset competing for capital gets re-rated. When government debt pays less, capital moves further out the risk curve. Equities first, then gold, then Bitcoin. It also signals that the authorities will step in when conditions get strained, and markets read that as permission to take risk.

Worth being precise: this was the announcement only. The doubled operations don't begin until 9 September and run through to 4 November. Nothing has been bought yet. Markets never wait for the implementation date, they price the intent.

The derivatives market told the rest of the story. In the 24 hours that followed, crypto saw its largest single day of short liquidations on record, roughly $2.74 billion in shorts forcibly closed, making up over 90% of the day's total liquidations. That level of one sided positioning tells you how heavily the market was leaning the wrong way.

Readers will remember the mirror image. On 10/10 last year, close to $19 billion was wiped out, around $16.8 billion of it from longs. That day confirmed the top, and the market never took those highs back. What we've just seen is the inverse. Longs getting flushed confirms a top. Shorts getting flushed on this scale has historically lined up with a bottom.

A macro catalyst on one side, the largest short flush on record on the other. That's what lit the technical fuse.

Is There A Threat Of This Being A Fakeout?

It's the right question to ask, and we'd be suspicious of anyone who didn't ask it.

Bear markets are built on false hope. Bitcoin has produced counter trend rallies of 30% to 40% inside every major downtrend it has ever had, and this one was no exception. Each one arrived with the same confidence, the same headlines, and the same people declaring the bottom, right before another major leg lower. So who's to say this isn't just another one of those?

The signals above are the first part of the answer. The second is what the market did around the low.

In our Q3 Outlook, published the first week of July, we flagged that a swing low was the likely next move and put a $55,000 target on it. Price landed at $57,735. That's within $2,735, comfortably inside a 5% tolerance. Sometimes close enough is good enough, and the structure matters more than the digit.

We've seen this exact dynamic before. Heading into the 2022 bottom, the entire market was fixated on $10,000 as the level that would confirm the low. Bitcoin never gave it to them. It bottomed near $15,000 instead, accumulated quietly for two months, then launched to $25,000 and never looked back. Everybody waiting for their number missed the move.

Then look at how price behaved inside the accumulation range. Every single attempt to push back below the $62,000 to $61,000 higher low failed. Repeatedly. Each failed breakdown was the market saying the same thing, that sellers had run out of ammunition and the longer this dragged on without a new low, the more the odds tilted upward.

That's what separates this from a bull trap. A bull trap is a rally that fails at the trendline. This is a rally that broke the trendline, reclaimed the 50 EMA on volume, completed an inverse head and shoulders, and came on the back of a record short liquidation and a genuine macro catalyst. The traps had none of that. They were bounces inside a downtrend that never changed the structure.

The speed is also the tell, not the warning. Every major Bitcoin bottom has resolved the same way once the trendline finally broke, not with a slow grind but with a violent rally that leaves almost everyone behind. The 2018 break was followed by a 231% rally. The 2022 break by 83%. The 2026 break is up around 36% so far.

That speed exists for a reason. It's designed to inflict maximum pain on both sides at once. Late bulls chase a rally they swore they'd buy lower. Bears, freshly proven wrong, move their target down to a price we traded at two weeks ago and wait for a retest that history says never arrives. That mutual pain is what actually marks the start of a cycle. Not a headline, not a clean signal everybody agrees on, just exhaustion on both sides simultaneously.

Nothing in markets is certain, and we'd never present it that way. But a fakeout doesn't usually come with this much structure underneath it.

It Isn't Too Late, But The Window Is Closing

We covered the multiples last month. They've compressed since, and they'll keep compressing.

With Bitcoin at roughly $78,500:

  • To the prior all time high of $126,080: a 1.6x, or a return of about 61%
  • To our $200,000 bull market target: a 2.55x, or a return of about 155%

Round it to $80,000 and the maths to $200k is a clean 2.5x. That's the number to hold in your head, because it's the number that shrinks every week this rally continues.

Put that in context. To hit $200k, Bitcoin needs to reclaim its all time high and then add another 59% on top. That's a target many had pencilled in for the last cycle and never got. It is not a modest forecast, and we'd rather you weigh it as an estimate than a promise.

But the shape of the opportunity is the point. Two thirds of the return to $200k is still sitting on the table, and it's sitting there specifically because price hasn't reclaimed the old high yet. The moment it does, the narrative shifts, the headlines return, and the entry you're looking at now is gone.

Any pullback or sideways chop from here that lets you accumulate before six figures prints again is a gift, not a given. It's increasingly unlikely we see a sub $60,000 print again this cycle now the trendline has broken with force. If you're still waiting for that level, treat the window as closing rather than opening.

And if you've been dollar cost averaging through the drawdown, this is the moment to reassess the strategy rather than continue it on autopilot. DCA is built for uncertain or falling markets. It works against you once the market turns and starts moving higher.

The Debasement Trade Is Back On

Every catalyst behind this month's breakout has been reported as its own headline. Step back from the individual events and a single thread runs through all of them, one Wall Street hasn't leaned on seriously in years.

The debasement trade.

What It Actually Means

Most explanations start with Roman emperors shaving silver out of their coins. It's a good story and it doesn't help much.

Here's a version that lands better.

You own shares in a company. The company decides it would rather print new shares than cut its spending. Your share certificate hasn't changed. The number on it is exactly the same. But your slice of the business is smaller, because there are more slices now. Nobody stole anything from you. You just got diluted.

That's debasement, applied to a currency instead of a company.

Once investors believe it's happening, they do a predictable thing. They move money into assets nobody can print more of. Gold, because you have to dig it up. Bitcoin, because the supply is fixed in code and no one can vote to change it.

That logic has always been true. The question was whether the market cared. This month it started caring again.

The Fortnight That Made The Case

Two numbers landed a day apart.

On 18 August, total US government debt passed $40 trillion for the first time. It came in at $40.047 trillion, more than double what it was in January 2017. It had only crossed $39 trillion five months earlier, back in March. July alone produced a $432 billion deficit, the fourth largest month in US history, and the shortfall for this financial year has already beaten the whole of last year with two months still to run.

The next day came the Treasury buyback announcement covered earlier, doubling the cap on purchases of long dated government debt.

One number said the debt is growing faster than anyone forecast. The other said the government will step in to keep yields down rather than let the market sort it out.

Investors put those two facts next to each other and drew the obvious conclusion about what comes next. It wasn't spending cuts.

And note what didn't move the market. Doubling a cap from $2 billion to $4 billion is a rounding error against a bond market worth tens of trillions, and the buying doesn't even start until 9 September. Not a dollar has been spent yet. What repriced it was the read on intent, which is the only variable that matters when you're working out how $40 trillion gets handled over the next decade.

Gold Moved First, Bitcoin Moved Harder

Gold is the reflex trade here, and it always has been. When investors start worrying about what a currency is worth rather than what it yields, bullion is the first thing they reach for.

It bottomed at $3,965 in late June, before the buyback announcement and before the debt headline. It now sits near $4,650. That's a gain of around 17% off the low and its best month since September 1999. The dollar went the other way, dropping to its weakest level since mid May and posting its third down week in four.

For clients who want that exposure without leaving crypto, PAXG is the cleanest way in and has tracked the move closely, sitting near $4,650. It's been on our Stormrake Spotlight in Stomrake’s Morning Note for exactly this reason.

But look at what happened next.

Bitcoin bottomed a fortnight after gold, at $57,735, and has since run to around $78,500. That's a 36% recovery against gold's 17%, measured from each asset's own low. Bitcoin arrived at the trade late and has already more than doubled the return of the asset that led it.

That's the part worth sitting with.

The Market Just Reclassified Bitcoin

Here's why all of this matters for the asset most of you actually own.

For most of this year, Bitcoin has struggled to sustain a narrative.

The risk asset argument stopped working first. The S&P 500 has hit 27 record highs in 2026 and is up around 13% for the year. Bitcoin spent that same stretch grinding lower and is still down about 10%. Whatever drove equities to record after record, Bitcoin wasn't invited.

The digital gold argument wasn't working either. Every time investors reached for safety this year, Bitcoin went the other way.

So it wasn't trading like a risk asset and it wasn't trading like a hedge. It answered to nothing, which is exactly what a bear market looks like when the story around an asset has run out.

August changed that. Bitcoin is up more than 25% on the month, printed $80,000 for the first time since May, and gained 23% in a single week. It did that in near lockstep with gold while the dollar fell.

A reason to own Bitcoin that actually works, after a year in which neither of them did.

And being the faster mover off the low is not the same as having caught up. Gold has recovered its whole year and sits around 17% below its January record. Bitcoin is still down about 10% for the year and remains roughly 38% below its all time high. Run those two facts together and the picture is straightforward. Bitcoin is moving quicker and still has considerably further to travel.

We've already called the bear market over, so we don't read that gap as a warning. We read it as Bitcoin being the faster half of a trade that has only just restarted.

There Is Only One Door Left Open

There are three ways out of a debt pile this size, and two of them are already shut.


Grow out of it. That isn't happening, because interest costs are now the second largest line in the federal budget and they're outrunning the economy. Cut spending or raise taxes. Politically dead, because the biggest items are pensions and healthcare and the population keeps ageing.


That leaves devaluing the money the debt is written in. Nobody announces it and nobody votes on it. It's simply what's left once the first two doors are bolted shut.


So this isn't really a trade. A trade has an entry and an exit. This is a direction of travel, and it only moves one way. The debt went from $39 trillion to $40 trillion in five months.


If a currency is headed one way over time, you own the things that can't be printed. Gold does that job, but its supply still grows every year as more comes out of the ground. Bitcoin's doesn't. Twenty one million, fixed in code, with no committee able to vote for more.


Every trillion added to the pile makes that argument stronger. The market spent this month remembering it.

August Delivered, Now For September to Continue the Momentum

Heading into August, Bitcoin was up for grabs. July had delivered the first green month since April, the bulls wanted to build on it, and the bears turned to history, since August is one of only two months with a negative average return across Bitcoin's history.

The bulls won, and it wasn't close. August has produced Bitcoin's largest single monthly gain since November 2024, the month of the Trump election win, currently sitting at 25% at the time of writing. As covered above, the breakout also confirmed the end of the bear market.
The chart shows the bulls in complete control. Resistance smashed, structure flipped, momentum firmly back in their hands.

Now the obvious question. September is historically Bitcoin's worst month, averaging -4.86% with just six green closes out of fifteen. On paper, that's a case for caution.

But look at which six. September has now closed green three years running, up 3.99% in 2023, 7.39% in 2024 and 5.16% in 2025, the last of those the third best September on record. The seasonal weakness everyone quotes is concentrated in years that look nothing like this one.

And here's the part worth holding onto. Even if Bitcoin delivers exactly its historical September average and gives back close to 5%, it would still be sitting near $75,000. The bulls would remain firmly in control and the bear market would still be comprehensively over. A red September wouldn’t change the mood or the structure.

We'd expect Bitcoin to ignore the seasonal script anyway, given how strongly the bulls are positioned. The target for September is the lower high at $83,000, the same level we set as our bear market invalidation. Take that out and the doubters run out of arguments, while Bitcoin clears the bulk of the overhead resistance sitting between here and the early $90,000s.

In the News

Australia Is Heading For Another Rate Hike:

The classic go to investment that has served Australians for decades keeps losing its appeal. We've already seen what the negative gearing changes did, with CBA expecting dwelling prices to end 2026 around 3% lower than they otherwise would have. Now borrowing is about to get more expensive again. July CPI came in hotter than forecast, with trimmed mean inflation holding at 3.6% and posting its largest monthly rise in a year. Markets doubled their odds of a September hike to 36%, and most major banks now expect the cash rate to move from 4.35% to 4.60% before Christmas. Higher borrowing costs into a market that just lost a major tax incentive points one way for house prices. In the meantime, Bitcoin has just completed its bear market.

Ray Dalio Advocates for Gold and Bitcoin:

The debasement trade has just picked up an endorsement from one of the most respected investors alive. On 21 August, Ray Dalio warned that a US debt crisis could arrive "in three years, give or take two" without a change of course, pointing to government revenue near $5.5 trillion against $7.5 trillion of spending and roughly $10 trillion of debt needing refinancing. His prescription is to underweight bonds, hold 10% to 15% in gold and add a bit of Bitcoin, because he expects monies that governments cannot produce to do relatively well. Dalio spent years as one of Bitcoin's more prominent sceptics. The sharpest minds in traditional finance have stopped debating whether Bitcoin belongs in a portfolio and started debating the size of the position.

Hyperliquid Begins To Lead Once More:

Bitcoin took most of the headlines this month, but Hyperliquid was right there beside it. HYPE printed a fresh all time high of $83.50 on 26 August, clearing its June record near $76. We've covered the fundamentals here for a long time, but the move that mattered came from the White House. On 19 August, President Trump named Hyperliquid directly, saying CFTC Chair Michael Selig was working to bring the exchange into the United States "in a fully compliant and legal fashion". HYPE was near $66 before those remarks and in the $70s within two days. There's no approval, no registration and no timetable yet, but if the CFTC really is being lined up as its regulator, the largest derivatives market in the world opens up.

Market Update

Top 10 cryptocurrencies by market cap
Here is the fast five of what you need to know about the market in August 2026:

      1. Bitcoin is up over 25% in August

      2. Ethereum has climbed 36% in August

      3. XRP flipped USDC to become the 5th largest Cryptocurrency by market cap and HYPE has entered the top 10 once more

      4. PAXG is up 13% in August

      5. The entire crypto market cap grew by 25% in August

    Video of the month

    Coldcard Hack: $113M Stolen From Bitcoin Wallets | Bisher Khudeira on The Money Block™ Ep. 125 

    Education: The Coldcard Exploit And The Limits Of Self Custody

    This deserves more than a paragraph in the news section. What happened to Coldcard owners at the start of this month is the most useful self custody lesson the market has produced in years, and the cheapest way to learn it is from somebody else's loss.

    What Happened


    At around 1:30am UTC on 30 July, Bitcoin started leaving wallets whose owners were asleep. Inside 25 minutes, roughly 594 BTC, about $38 million at the time, was swept from around 500 single signature wallets. The attacker sorted by balance and took the largest first, clearing more than $30 million in the opening ten minutes. One individual lost around $1.8 million. Three further waves followed, and Galaxy Research's running tally reached roughly 1,816 BTC, close to $116 million, drained from more than 5,200 addresses.


    Nobody was phished. Nobody installed malware. Nobody approved a transaction. No device was ever physically touched. The only thing the victims had in common was the date their wallet was created.


    What Caused It

    Every Bitcoin wallet begins as a random number, and everything above it is derived from that one moment. Get the randomness right and the wallet cannot be guessed. Get it wrong and none of the cryptography above it matters.


    Think of it as dice. A properly generated seed carries the equivalent of rolling a six sided die about 50 times and recording the sequence in order. Nobody on earth can guess that.


    A build error in Coldcard's March 2021 firmware meant the device stopped drawing randomness from its dedicated hardware chip and quietly fell back to a basic software routine. It kept telling users it had rolled the die 50 times. On the older Mk3 it had effectively rolled it about 16 times, and about 28 on the newer models.


    Sixteen rolls is roughly a trillion possibilities, a number modern hardware works through in an afternoon. The flaw shipped in March 2021 and survived every release until the emergency patch on 31 July 2026. Five years, in open source code, in one of the most respected devices in Bitcoin, and nobody caught it. Worse, updating the firmware doesn't repair a seed already created weakly, so affected owners face a full migration rather than a patch.


    What This Means Practically

    This isn't a Bitcoin problem. It's a self custody execution problem, and it's exactly the kind of tail risk that sits quietly beneath "not your keys, not your coins" until the day it doesn't. Firmware, chip design and randomness generation are layers most holders never interact with directly, which is a great deal of trust to place in work you have no way to check. The bug was Coldcard's alone, but the dependency isn't.


    This is not the first self custody solution to fail and it won't be the last. Stormrake custody removes that layer entirely.

    Self Custody Is A Right, Not An Obligation

    We believe in self sovereignty at Stormrake, and self custody is a genuine part of that. It's a right every holder has. But a right isn't a recommendation.


    This incident cost people their entire positions through no fault of their own, and the setups that survived it demanded a level of technical discipline most holders simply don't have. 

    If your setup is one device, a seed phrase on the card that came in the box, and a quiet hope that the firmware did its job, you're carrying risk you have no way to measure. The honest question isn't whether you have the right to hold your own keys. It's whether the consequences of getting it wrong are ones you could absorb.

    Where Stormrake Fits

    For clients who decide the answer is no, our custody solution takes that entire class of problem off your plate. Seed generation, firmware risk, device security, backup integrity, none of it sits with you. No drawer, no single point of failure, and no wondering five years later whether the setup you did one afternoon was done properly.

    It's a different trade off rather than no trade off. You're moving from a risk you personally carry to one managed under institutional process and oversight, which is the right answer for many holders and the wrong one for some. That's why it's a conversation rather than a product.

    If you're running an affected device, or you simply want your Bitcoin somewhere secure while you work out your next step, speak to your dedicated Stormrake broker.

    The most expensive lessons in this market are the ones learned first hand. This one is available second hand, for free.

    Written by Alexandar Artis

    Start Your Brokerage Account

    Get Started

    If you enjoyed this Rake Review, feel free to open an account and gain access to more proprietary research and work with your very own dedicated crypto broker.

    No Advice Warning 

    The information in this newsletter is general only. It should not be taken as constituting professional advice from the author - Stormrake PTY LTD.
    Stormrake is not a financial adviser and does not provide financial product advice. You should consider seeking independent legal, financial, taxation or other advice to check how the information relates to your unique circumstances. Stormrake is not liable for any loss caused, whether due to negligence or otherwise arising from the use of, or reliance on, the information provided directly or indirectly, by this newsletter.
     

    Disclaimer 

    All statements made in this newsletter are made in good faith and we believe they are accurate and reliable. Stormrake does not give any warranty as to the accuracy, reliability or completeness of information that is contained here, except insofar as any liability under statute cannot be excluded. Stormrake, its directors, employees and their representatives do not accept any liability for any error or omission in this newsletter or for any resulting loss or damage suffered by the recipient or any other person. Unless otherwise specified, copyright of information provided in this newsletter is owned by Stormrake. You may not alter or modify this information in any way, including the removal of this copyright notice.

    Copyright © 2026 Stormrake Pty Ltd, All rights reserved
    ]]>    Fri, 28 Aug 2026 15:26:12 +1000