tl;dr
Apologies from the CCC team. Japan is proving its technological worth once again. Coldcard users must act now.
Market Snap
Market Wrap
For the last month or so, call options with strike prices between $70k and $72k have been the dominant positions on Deribit. That has changed. For August expiry, the largest open interest is now in $60k put options, indicating a bearish outlook for the market.
Occasional Series – Interregnum
The CCC team apologises for our recent breach of the usual publication schedule. Much of my time has recently been devoted to playing Master Parrot in Anne Boleyn at The Tower Theatre, N16, which has now come to its end. Parrot has squawked his last, like his more illustrious namesake (https://www.youtube.com/watch?v=TaFDzTzKAT0), so we are back on track.
We won’t let down you again – at least not until the next time.
Curious Cryptos’ Commentary – Japan
Earlier this year Japan outlined a reform to reduce the tax payable on certain crypto gains from up to 55% to 20% for “specified crypto assets”, expected to include BTC and ETH.
It is patently obvious that increasing taxes on specific activities leads to less of that activity. The converse holds true too – lowering taxes on BTC and ETH profits will encourage more investment into those coins. It will also drive a greater interest and investment in the entire crypto ecosystem.
2026 has seen a steadily increasing number of stablecoin payment initiatives within Japan. Nomura, Japan’s largest investment bank, has announced that it is developing a foreign exchange settlement service to convert yen into USDC to streamline cross-border payments for Japanese companies. Fees will be minimal, and settlement virtually instantaneous, a huge upgrade to today’s cumbersome processes.
RLUSD, Ripple’s USD denominated stablecoin, was launched in Japan earlier this year. JCB, the country’s largest domestic payment network, has signed an MOU with Circle to explore using USDC for settlements domestically and internationally. Digital Garage and Resona Holdings have been experimenting with in-store payments using USDC since January. Convenience store operator Lawson will follow suit at one outlet in Tokyo shortly. Payments company Netstars launched Stablecoin Pay in July which allows physical and online retailers to accept USDC and USDT with instantaneous exchange into yen removing any FX risk for the retailer and negating the need for the retailer to manage any crypto infrastructure.
All these initiatives have one common thread – increased productivity, leading to higher growth and a lower cost of capital, which in turn leads to higher tax revenues for politicians of all stripes to fritter away as they see fit.
…
If you know of any country with a productivity and growth problem that is about to materially raise CGT on all asset gains – thereby compounding that problem whilst simultaneously lowering the tax take (according to government modelling) – perhaps you might write to your local MP, pointing out the lessons being learned in Japan.
Curious Cryptos’ Commentary – Coldcard
The CCC champions the use of Ledger Nano – preferably the Flex – for long-term storage and management of your crypto investments. It links with MetaMask, combining its security benefits with MetaMask’s flexibility. Ledger owners need to maintain strict security protocols, such as never screen-shotting seed phrases and, ideally, taking out a subscription to Ledger Recovery, but for the CCC team it remains the outstanding solution to self-custody of crypto assets.
Ledger Nano signs transactions offline within the device and then broadcasts that transaction to the network via a USB connection. There are some who believe that connecting via USB is itself a security risk, but they have never adequately explained why that is.
For those who do worry about the USB connection required by Ledger Nano, the solution is to have an air-gapped wallet, such as Coldcard. Coldcard stores the private keys and signs transactions offline, which are then passed to the blockchain via PSBT files using MicroSD, NFC or QR codes. Your Coldcard wallet is never connected to the internet, if that is something about which you are concerned.
…
One subject that is often overlooked is the creation of seed phrases and the concept of entropy behind them. I asked Perplexity to concisely summarise the concept of entropy:
“Entropy in the context of seed phrases is the amount of randomness behind the large number that your recovery words represent, which determines how hard that seed is to guess or brute‑force. A standard 12‑word BIP‑39 seed encodes 128 bits of entropy—enough possibilities that even idealized supercomputers cannot realistically search the space—while 24 words encode 256 bits for even higher, long‑term security.”
You can create private keys from seed phrases with very low entropy. For instance, you could create private keys from just a single word – “password”. I think that would be a foolish thing to do, but it seems not everyone agrees with me. Using “password” as the seed phrase maps to a public address 16ga2uqnF1NqpAuQeeg7sTCAdtDUwDyJav. Look at that wallet:
https://www.blockchain.com/explorer/addresses/btc/16ga2uqnF1NqpAuQeeg7sTCAdtDUwDyJav
Remarkably, this wallet has 45,028 transactions.
Less surprisingly, every single incoming transaction is (almost) immediately matched by an outgoing transaction of the same value. It is likely a scammer has set up a monitoring tool for this wallet. Every time someone sets up a new wallet using “password” as the seed phrase and transfers BTC into it, the scammer removes it. The transactions are all low value, totalling just $22k so far. But you must wonder why anyone could possibly contemplate using only “password” to create private keys.
…
Which brings us back to Coldcard.
A firmware change in 2021 weakened seed generation. Though the seed phrase was still twelve words long, the effective entropy dropped from the intended 128 bits to a far smaller space – on the order of tens of bits – making brute‑force attacks by modern computers feasible. For those who are not of a mathematical bent, the difference between those two numbers is simply vast. It is like moving from the number of grains of sand on one large beach to the number of grains of sand in trillions of Earths covered entirely in sand.
I hope you can see the problem here. The seed‑generation software used by Coldcard since 2021 does not provide enough entropy. The seed phrases can be guessed by a modern-day computer, thus creating the private keys allowing access to the content of the wallets linked to those private keys.
Which is exactly what has happened.
A fourth wave of attack is currently underway as I write. Almost 449 BTC has been stolen from Coldcard‑generated wallets in this latest wave so far, on top of roughly 1,367 BTC in the first three attacks, taking the total to more than $110mm and climbing.
If you are a Coldcard wallet user, you must act now. Move your coins immediately to your favourite centralised cryptocurrency exchange whilst you wait to take delivery of the Ledger Nano Flex you are about to order from Ledger.