Laws move slower than markets. But they hit harder. This is issue #69 of The Bitcoin Act — your Tuesday and Sunday briefing on the legal and regulatory moves that actually shape Bitcoin.

Now for today’s top stories:

⚖️ Coldcard Victims Weigh Class Action
Lawyers are gathering victims of the +$100M seed flaw for product-liability claims against Coinkite.

🛡️ SEC Freezes Nasdaq Bitcoin Options
CME's jurisdiction challenge paused QBTC, dollar-settled options.

🏛️ CLARITY Act Misses Its Window
Still unpassed, absent from Monday's Senate schedule, recess closing in. If it dies, unelected agencies write the rules instead of Congress.

Don't wait. Sign up for The Hustle to unlock our side hustle database. Unlike generic "start a blog" advice, we've curated 100 actual business ideas with real earning potential, startup costs, and time requirements. Join 1.5M professionals getting smarter about business daily and launch your next money-making venture.

Get the guide

Galaxy Research counts about 1,816 BTC (~$115M) drained from 5,200+ addresses since July 30. Thomas Braziel of 117 Partners is assembling claimants for product-liability claims — suits arguing a defective product caused the loss. Nothing is filed yet.

Seed generated on an affected Coldcard? Move funds now to a freshly-generated wallet — a hot wallet is fine as a temporary stop. Unaffected? Help others verify. And ignore anyone DMing as "Coldcard support" — that's the scammers' encore.

Bitcoin.com

The SEC froze Nasdaq's approval of QBTC — Bitcoin index options that settle in dollars, not sats — after CME objected. CME argues Bitcoin's a commodity, so the CFTC, not the SEC, owns these contracts. The approval is on hold, not dead, with comments due August 24.

Zero impact on your self-custodied sats — this is a paper-Bitcoin turf war between Wall Street venues, settled in dollars. The signal worth keeping: regulators keep treating Bitcoin as a commodity, the lighter-touch lane. No action needed; keep stacking cold.

The Block

The CLARITY Act — the House-passed bill splitting oversight of digital-asset markets between the SEC and CFTC — wasn't on the Senate's Monday floor schedule. It still hasn't passed the Senate. With recess days away, its 2026 odds are fading.

Sovereign read: if the bill dies, Bernstein expects the SEC and CFTC to write the rules themselves under "Project Crypto" — unelected agencies, not Congress. For Bitcoin, less rides on this: it's already a commodity. Keep self-custodying regardless.

Bitcoin.com

🎭 Hong Kong Romance Scam Nets $3.3M
An insurance pro in her 50s lost HK$26M (~$3.3M) to an online "boyfriend" pushing a fake crypto trading app that showed 800% gains, then blocked withdrawals — one of 25 weekly romance scams.

🏦 $676M Flowed From Iran-Linked Exchange to Binance
A Reuters probe found unlicensed Dubai exchange Shelbit moved ~$4B for Iranian gambling sites, the central bank and Revolutionary Guard-linked wallets — ~$676M reaching Binance, which disputes the figures.

🎙️ Coldcard Fallout Sparks Policy Alarm
The Bitcoin Policy Institute convened an emergency panel on the Coldcard breach, noting an AI model spotted the weak-randomness flaw in minutes and flagging looming policy fights over open-source software, self-custody, and AI disclosure.

💬 "A Wallet Failing Isn't Bitcoin Failing"
Amid Coldcard's fallout, advocate Decentra Suze argued Bitcoin's core case — censorship-resistant payments and access for the unbanked — stands, but insisted the tools built around it must earn trust through security and transparency.

🇰🇷 Bithumb Targets 2028 Stock-Market Listing
South Korean exchange Bithumb published a roadmap to go public by 2028, converting its accounting to international standards this year and filing a preliminary listing review in 2027 — after repeated delays and money-laundering fines.

⚖️ Myanmar Passes Death Penalty for Scam Bosses
Myanmar's military-backed parliament passed an anti-scam law with 10 years to life for running scam centers or "digital-currency fraud," and death for those who coerce workers by violence — though the final text isn't published yet.

🇫🇷 France: Waltio Leak Fuels Armed Home Raid
An Amiens court tried a man over a June armed attempt to kidnap and extort an elderly woman in the Somme, targeted using data from January's Waltio tax-app breach — guard who knows you hold.

🏔️ Bhutan Hands Sovereign Bitcoin to a Manager
Bhutan's Gelephu Mindfulness City appointed Canadian firm 3iQ to manage part of its Bitcoin treasury — the first time a Bitcoin-holding sovereign has publicly outsourced its stack, drawn from a pledge of up to 10,000 BTC.

🃏 Coldcard Thief's Loot Traced to Offshore Casino
Researcher Alex Thorn traced ~17 BTC stolen from a Coldcard victim — swapped to ETH — into offshore casino Duel, which refused to freeze the funds without cryptographic proof the victim owned the hacked address.

🚢 US Sanctions Iran's Bitcoin "Toll" for Hormuz
The US Treasury sanctioned two Iranian firms behind a Revolutionary Guard-backed scheme forcing ships to buy "insurance" — payable in Bitcoin — to cross the Strait of Hormuz. Paying in Bitcoin carries full sanctions exposure.

Every week I drop one concrete, actionable answer to a legal or political question that actually affects your life as a Bitcoiner, focused on a specific, real-world action you can take. No theory. No fluff. Just the move.

This week: Your Coldcard got drained (or could be) — the damage-control playbook

A firmware flaw in Coldcard generated weak, guessable seed phrases from March 2021 onward. Updating the firmware does not fix a seed already created on the bad version, the only cure is moving to a fresh one.

1. If sats still sit on a seed generated by affected firmware (Mk3 versions 4.0.1–4.1.9, or Mk4/Mk5/Q before 5.6.0/1.5.0Q) without 50+ private dice rolls, move them today. Sweep to a freshly-generated wallet — a hot wallet is fine as an emergency first hop.

2. Never reuse the compromised seed. Generate a new one only after installing the fixed release (5.6.0 for Mk4/Mk5, 1.5.0Q for Q, 4.2.0 for Mk3), or on a different device. Add a strong, unique BIP-39 passphrase — a secret phrase layered on top of your seed words.

3. If you were drained, don't wipe the device — it's evidence. Record the wallet fingerprint, every theft transaction ID (txid), the attacker's addresses, and your discovery date. Screenshot a block explorer showing the sweep.

4. File with the FBI's Internet Crime Complaint Center at ic3.gov and get a local police report with a case number. Beyond recovery odds, an official report establishes "no reasonable prospect of recovery" — the legal trigger for claiming the loss on your taxes.

5. Track the on-chain analysis as it develops. Galaxy Research and Block are mapping the attacker addresses and identifying new sweep waves; roughly 600 suspected addresses have been reported to federal investigators. Following that work tells you whether your addresses are implicated and whether funds move.

Got a legal or regulatory question you want answered next Tuesday? Hit reply and send it.

📊 CLARITY Act signed into law in 2026? — 31% chance Polymarket

📊 Who will Trump pardon before 2027? Keonne Rodriguez — 13% Polymarket

📊 Which Senators will vote for the CLARITY Act? Josh Hawley — 21% Polymarket

Be the very first to open this newsletter and claim 2,100 sats! Learn interesting things and get paid for being quick! 👇

“When it becomes dominated by a collectivist creed, democracy will inevitably destroy itself.” — F.A. Hayek

Help spread the signal, and get paid in sats for it. The Bitcoin Act runs a tiered affiliate program.

Every milestone you hit triggers an automatic email asking for your Lightning address.

Reply, and the sats are sent. → 1 referral = 21 sats → 5 referrals = 210 sats → 10 referrals = 2,100 sats

Track your progress anytime from the referral dashboard. Your referral link: {{rp_refer_url}}