July was the best month the crypto market has had in a year, and almost nobody enjoyed it. Prices rose while spot volumes fell to their lowest level since 2023. ETF flows turned positive by the narrowest margin on record. Two recognisable exchanges announced they were winding down, one after eleven years and one after nine. Meanwhile the regulatory architecture that has been under construction since 2024 quietly started binding — MiCA’s grandfathering ended, Japan moved crypto into its securities law, and Singapore put a hard cap on what its banks may hold.

A recovery month, then. Just not a comfortable one.

Market Performance

Bitcoin

Bitcoin opened July at $58,523.93 and closed the month at $62,825.90, a gain of just over 7% and the first positive month since April. It reached an intramonth high of $66,923.95 on 21 July before giving back most of the advance in the final week, with the lowest print of the month — $57,717.55 — landing on day one.

That snapped a two-month slide. June closed down 20.5%, Bitcoin’s worst month since June 2022, and May had already fallen 3.5%. Even after July’s recovery, bitcoin is down roughly 28% year to date and sits about 50% below the $126,080 all-time high set in October 2025.

The number that describes July better than the price is the volume. Average daily spot turnover ran at roughly $2.2 billion — the lowest since November 2023, and more than 75% below late-2024 levels. Implied volatility closed the month at 37%, its lowest reading since May. This was not a rally with participation behind it.

US spot bitcoin ETFs took in a net $172.4 million across the month. That is positive, which matters after June’s record $4.51 billion outflow, and it is also the smallest monthly inflow the products have ever recorded. The month contained both a $424.7 million single-day outflow on 13 July and a seven-session inflow run of nearly $1 billion in the third week. Year to date, the complex is still $5.29 billion in net redemptions.

Ethereum

Ethereum did considerably better. ETH opened at $1,569.45 and closed at $1,860.66, up roughly 18.5%, with a high of $1,979 on 27 July. Against bitcoin, ETH gained 10.4% and broke above its 200-day moving average for the first time since January.

Spot ether ETFs took in $365.2 million, more than double the bitcoin complex in absolute dollars — on a fund base roughly one-seventh the size. It was the largest monthly ETH ETF inflow since October 2025.

Supply conditions help explain the divergence. Exchange reserves sit near all-time lows around 14.5 million ETH, the staking ratio is at a record with roughly a third of supply locked, and the entry queue reached 2.5 million ETH with 43-day delays. Fewer coins are available to sell.

Total crypto market capitalisation rose 5.98% to $2.158 trillion. The CoinDesk 20 Index gained 8.7%, its biggest monthly advance since July last year.

Points of Interest

A Firmware Flaw Drained $70m from Cold Wallets Nobody Touched

Between 01:10 and 01:51 UTC on 30 July, an attacker swept 1,082.65 BTC — around $70 million — out of 1,196 Coldcard-generated wallets across six blocks. By early August the cumulative figure had reached roughly 1,367 BTC across 4,585 addresses as the attacker worked down to smaller balances.

The mechanism is worth understanding precisely, because most of the commentary got it wrong. An internal build setting caused seed generation to skip the hardware random number generator. The library check tested only whether the setting existed, not whether it was enabled. Seeds therefore fell back to the chip’s factory serial number and clock registers, collapsing the keyspace to about 4 billion possibilities — brute-forceable offline, on ordinary hardware, with no access to the device at all.

Coinkite’s patch protects newly generated seeds. It does nothing for seeds already created. CEO NVK’s advisory opened: “If you generated a seed using a Coldcard wallet, move your funds now.”

The reaction was predictable and mostly wrong. ARK’s Lorenzo Valente told CoinDesk that “you are better off today holding funds across several publicly-traded exchanges or ETFs.” But nothing in this failure is a property of self-custody. A key derived from a serial number is a bad key regardless of who holds it. What failed was entropy generation and the verification of a build flag — an engineering control, present or absent in custodial systems too, and auditable in either. The custody model determines who bears the loss. It does not determine whether the key was random.

Washington Ran Out of Calendar

The CLARITY Act did not pass. Senate Republicans released updated text on 22 July merging the Banking and Agriculture committee versions, and on 23 July Majority Leader John Thune conceded it would not clear before the summer recess: “I would like to at least get Clarity started… We’ll see where the votes are.”

The arithmetic is the problem. The bill needs 60 votes for cloture against 53 Republican seats, and only two Democrats have publicly backed it; three more formally opposed the merged text after an ethics provision was removed. Polymarket priced 2026 passage at 28% on 30 July, down from 82% in February, and Galaxy Digital’s estimate is 30%.

Separately, the SEC’s regulatory agenda targets July for “Regulation Crypto,” its first formal crypto rulemaking under Chair Paul Atkins — temporary registration exemptions for developers launching investment contracts, a four-year startup exemption, and an investment contract safe harbour paired with token taxonomy guidance. It had been sitting at the White House’s regulatory review office since April. As of month-end we could not confirm the proposal was formally issued.

The pattern is now familiar. Rulemaking advances; legislation does not.

MiCA’s Grandfathering Period Expired

On 1 July, the transitional regime under MiCA Article 143(3) closed. Firms that had been serving EU clients under pre-MiCA national law lost their cover unless they had secured authorisation.

The deadlines were never uniform, which is where the risk concentrated. Belgium, Bulgaria, Czechia, Denmark, France, Ireland, Italy and Spain ran the full 18-month clock to 1 July. Germany, Austria, Lithuania and Slovakia closed at the end of December 2025. Latvia, Hungary, the Netherlands, Poland and Slovenia closed in mid-2025. Cross-border firms are bound by the earliest applicable deadline, not the most generous one.

Losing transitional status does not lift AML obligations. Travel-rule reporting, sanctions and PEP screening and record-keeping all persist through a wind-down, even as the KYC programme underneath them loses its legal standing. ESMA has signalled it expects orderly wind-down plans, and late applicants are getting heightened scrutiny rather than expedited review.

Asia Hardened Its Frameworks in Three Different Directions

Japan passed amendments on 15 July moving crypto out of the Payment Services Act and into the Financial Instruments and Exchange Act — reclassifying it as a financial product. The package brings insider-trading prohibitions, issuer disclosure duties, and exchange-level disclosures for decentralised assets. The penalty for unregistered operation rises from three years’ imprisonment to ten, and the maximum fine from ¥3 million to ¥10 million. Taxation drops to a flat 20% from rates as high as 55%, effective January 2028, and the change removes the legal barrier to domestic spot bitcoin ETFs.

Singapore went the other way on bank exposure. On 28 July MAS required banks with any cryptoasset exposure to notify it and engage on prudential treatment, and capped locally incorporated banks at 2% of Tier 1 capital for exposure to assets on permissionless blockchains during the transitional period. The full Basel-aligned framework lands 1 January 2027.

South Korea moved to consolidate roughly ten pending digital asset and stablecoin bills into a single Digital Asset Framework Act, presented to the National Assembly on 29 July. Unresolved: whether won-backed stablecoins run through a bank-led consortium, and whether equity ownership caps apply to the domestic exchanges.

Circle Became a Bank Twice, and Kraken Applied to Become One

Circle received final OCC approval on 10 July to establish a national trust bank — the first stablecoin issuer to do so — bringing USDC reserve management under federal oversight and enabling institutional digital-asset custody. On 31 July, NYDFS granted it a limited-purpose trust charter authorising fiduciary, custody and asset-management services under New York Banking Law. Jeremy Allaire called the New York charter “a longstanding objective”; USDC’s market cap stands above $71.8 billion.

Circle was one of five firms conditionally approved by the OCC in December 2025, alongside Ripple, Paxos, BitGo and Fidelity Digital Assets. Those charters authorise nonfiduciary custody — a distinction worth holding onto when reading the coverage.

On 7 July, Kraken confirmed it is seeking a specialised banking licence from the Bank of Lithuania, which would make it the first crypto exchange with that designation and allow current accounts, consumer lending and stock trading across the EEA. Co-CEO Arjun Sethi: “the plan for the next 10 years is to get all of these licenses, either through buying an existing business, or going de novo in each region.”

Two exchanges closed in July. Two infrastructure firms applied to become banks. Those are the same story told from opposite ends.

Strategy Sold Bitcoin at a Record Pace, and the Treasury Model Came Apart

An SEC filing on 6 July disclosed that Strategy had sold 3,588 BTC for roughly $216 million at around $60,000 — its largest sale ever, one month after selling just 32. The proceeds fund preferred stock distributions and replenish its dollar reserve.

Q2 results on 30 July showed 843,775 BTC held at an average cost near $75,476, against a net loss of $8.22 billion driven by an $8.32 billion unrealised digital-asset writedown. CFO Andrew Kang pointed to a $3.75 billion dollar reserve covering more than two years of dividend obligations.

Strategy is the strongest balance sheet in the category, which is what makes the rest of it notable. Across the sector in July: Satsuma Technology sold 668 BTC while liquidating and delisting from the LSE; Sequans sold 1,025 BTC then roughly 80% of what remained; Empery Digital sold about half its holdings; Nakamoto sold 284 BTC for working capital. Miners MARA and Bitdeer are redirecting compute to AI data centres. Jack Mallers stepped down as CEO of Twenty One Capital and Adam Back’s BSTR scrapped its merger. VanEck’s Matthew Sigel noted that several companies have “exited crypto entirely or are reducing holdings substantially.”

Stablecoin Supply Contracted for the Third Straight Month

Total supply fell from a mid-May peak of $322.1 billion to $307.6 billion by early August — a $14.6 billion decline, the largest since Terra. USDT went from roughly $189 billion to $183.2 billion; USDC from an $80 billion March peak to $72.1 billion.

The cause is structural rather than cyclical. The GENIUS Act bars licensed issuers from paying interest or yield, which removed the return on holding a digital dollar and pushed capital into tokenized Treasury products — now around $17 billion. MiCA restrictions and falling prices did the rest.

Two things complicate the doom reading. Stablecoin adjusted transaction volume hit an all-time record $1.79 trillion in June even as supply shrank, which means the float is turning over faster rather than being abandoned. And the decline is about 3% from peak, against 26% during the 2022 winter.

Separately, Tether crossed a two-year mark on 17 July: its GENIUS Act grace period expires 18 July 2028, and roughly 25% of USDT reserves — precious metals, lending instruments, bitcoin — sit outside the cash and Treasuries the Act permits.

Macro Backdrop

The Federal Reserve held rates at 3.50%–3.75% on 29 July, and crypto spent the month outperforming risk assets rather than tracking them: the Nasdaq 100 fell 9%, the Russell 2000 fell 3%, and chip stocks fell 22% while the CoinDesk 20 gained 8.7%. That decoupling is unusual and probably says more about equity positioning than crypto conviction.

Sentiment stayed poor throughout. The Fear & Greed Index closed July at 25 — firmly in fear — despite the best monthly return in a year, which is a fair summary of how the month felt from the inside.

Underneath, two counter-signals. DeFi active loans recovered to $22.2 billion, up 7.2% month-on-month after five consecutive months of decline, and tokenized real-world assets passed $32 billion. Both grew while spot volumes hit three-year lows.

Final Thoughts

The unifying theme of July is that the infrastructure layer and the trading layer have separated.

Trading is in genuine retreat — volumes at 2023 lows, two exchanges winding down, treasury companies unwinding, stablecoin float shrinking. Infrastructure is doing the opposite: Circle holding two banking charters, Kraken applying for a third, Japan writing crypto into securities law, MiCA and the FCA moving from consultation into authorisation queues, tokenized assets and on-chain credit both growing.

And then the Coldcard exploit, which is a reminder that none of this architecture protects against a bad random number. Regulatory perimeters govern who is allowed to hold keys. They say nothing about whether the keys were generated properly.

That remains an engineering question, and July was an expensive month for getting it wrong.