Galaxy's Alex Thorn on the Coldcard Fallout, Clarity Act Odds, and the SEC's New ICO Pathway
Alex Thorn, head of firmwide research at Galaxy Digital, has spent weeks tracing one of the ugliest self-custody failures in Bitcoin's history. He joined Simply Bitcoin to walk through where that investigation stands, why he thinks a key piece of crypto legislation is unlikely to pass the Senate this year, and what a new SEC proposal could mean for token fundraising.
THE COLDCARD EXPLOIT IS STILL ACTIVE
The vulnerability traces back to a firmware flaw in Coldcard hardware wallets. Coinkite disclosed that the vulnerability originated in March 2021, when it integrated a new cryptographic library into the firmware, weakening the randomness used to generate some wallet seeds.
On the show, Thorn said the pace of new confirmed theft has slowed, putting the high-confidence stolen total at roughly 1,780 bitcoin, worth around $116 million at the time the coins were stolen and more today given the price rally. That figure is Thorn's own running estimate as stated on the show. Independent reporting from Galaxy Research has put confirmed losses across three attack waves at 1,596 bitcoin, with a total that could climb to roughly 2,055 bitcoin, or nearly $130 million, if a suspected fourth wave is confirmed. Galaxy said about 90% of the stolen bitcoin has not moved, and none of the coins taken during the first three confirmed waves have moved since the theft.
Thorn explained why this hack behaves differently than a typical exchange breach. In a centralized hack, funds start in one place and investigators trace them outward. Here, the stolen coins came from thousands of unconnected self-custody wallets with no relationship to each other, so the only reliable way to identify victims is when they report the theft directly. The first wave was caught by an on-chain pattern spotted by engineers at Block. Every wave after that surfaced because victims came forward.
Thorn's warning to anyone still holding funds generated by a vulnerable Coldcard device: move them. He said every vulnerable seed will eventually be swept, and that a full list of possible vulnerable seeds is likely to surface on GitHub within months.
CLARITY ACT ODDS: ABOUT 10 PERCENT
Coinbase CEO Brian Armstrong has been publicly bullish on the CLARITY Act's chances. Armstrong said in a CNBC interview that he expects the bill to secure more than 60 votes in a Senate cloture vote scheduled for September 15. Thorn is far less convinced.
He noted the practical math: Republicans hold 53 Senate seats, so Majority Leader John Thune needs at least seven Democratic votes to clear the 60-vote cloture threshold and open debate on the bill itself. On the show, Thorn said the Senate will only have about two weeks of working sessions in September before recessing again for the November midterms, leaving little room to actually pass anything even if the cloture vote succeeds. He put his odds of Senate passage this year at around 10%.
Thorn also flagged a separate blocker: an unresolved ethics dispute in Congress tied to conflicts of interest, including the fallout from Trump-linked crypto ventures, which he said remains a genuine sticking point regardless of how the vote count shakes out.
THE SEC'S BACKUP PLAN
Armstrong has also argued that clarity is coming either through Congress or through regulators directly. SEC Chairman Paul Atkins said, "today, we are charting a new course with a package of exemptions that would facilitate capital formation and allow crypto asset innovation to flourish in the United States in the years ahead."
The agency followed through. The Securities and Exchange Commission proposed new rules that would create a dedicated offering framework for crypto assets, including a "startup" exemption allowing issuers to raise up to $5 million over a four-year period, and a "fundraising" exemption permitting offerings of up to $75 million in each 12-month period with more extensive disclosure obligations.
Thorn's take: regulatory relief is real but fragile. A future SEC could unwind it the way Chairman Atkins rolled back rules from his predecessor, Gary Gensler. Federal statute cannot be undone that easily. He specifically pointed to protections for non-custodial wallet developers and the right to self-custody as provisions that only survive if they are written into law, not just agency rulemaking.
On whether the SEC's proposal could spark a new wave of token fundraising akin to the 2017 ICO boom, Thorn said it is possible but far from guaranteed. The proposal still carries a 60-day comment period before it becomes final, and its real test will be whether projects actually use it once it takes effect.
This story comes from the Simply Bitcoin Live show. Watch the full episode.
