Bitcoin July 2026 Update: Easier Liquidity, Weaker Accumulation

Further evidence of stabilization can be seen in ETF flows, as spot Bitcoin ETFs recorded approximately $280 million in net inflows during July. This marked a reversal from the record $4.3 billion of outflows in June and roughly $2 billion in May. Although July’s inflows were modest relative to the strong allocations recorded in late 2025, they ended two consecutive months of heavy redemptions and suggest that institutional selling pressure began to ease.BTC treasury company demand weakened further, with net purchases turning negative for the first time. July saw $140 million of net disposals after falling to just $463 million in June. This represents a sharp reversal from the $4.1 billion and $2.2 billion recorded in April and May, respectively, leaving the treasury-company bid well below its early-2026 highs. Concentration remains the central caveat, as Strategy continues to drive the majority of activity, hence the reason why flows were negative (Strategy sold BTC in July to fund preferred-stock distributions and replenish its USD reserve).  

Stolen BTC

On July 30, 2026, Coldcard users began reporting drained wallets, and Coinkite issued a security advisory. Coinkite’s preliminary investigation identified faulty seed generation, a bug that caused the device to draw randomness from a far weaker source than designed. Reports point to a roughly five-year-old firmware issue, though there is also blame on insufficient hardware entropy. Low entropy shrinks the keyspace enough that seeds become brute-forceable, so once an attacker reverse-engineered the flaw, they could reconstruct keys and sweep funds at scale. Critically, the devices were never physically or network-compromised. The failure sat at the point of key generation itself, meaning air-gapping and offline storage offered no protection. Galaxy has mapped over ~1,200 addresses being drained of over 1,083 BTC (worth over $70 million).This is one of the most consequential disclosed hardware-wallet seed-generation failures, and it disproportionately hit technically sophisticated Bitcoiners who followed every best practice. This is precisely what makes it corrosive to self-custody's credibility. If experienced users doing everything right still lose funds, the onboarding case for mainstream self-custody weakens considerably. The broader and more speculative concern raised is LLM-assisted vulnerability discovery. Capable models are increasingly surfacing long-dormant bugs in open-source and firmware, which cuts both ways and argues for using the same tools defensively to audit the critical systems (entropy, signing, firmware) that custody depends on. The case for self-custody may continue to erode as ETFs, centralized exchanges and other vehicles offer easier exposure. 

Updates