Sunday was a security-and-paperwork day. SafePal said an order-tracking plug-in flaw exposed names, addresses, and purchase details for about 39,798 hardware-wallet customers, while wallets and seed phrases stayed off the leaked list. The Dutch cyber agency confirmed attackers are using a patched macOS Screen Sharing bug to plant Monero miners. Novig sued Wisconsin officials to keep sports event contracts on federal rails. Hashdex Bitcoin ETF (DEFI) has its last NYSE Arca session today. Lido published NEST, the surplus-funded LDO buyback machine, and Aave pulled Horizon listings back under DAO votes.
As of the 00:27 UTC market snapshot on August 17, 2026, bitcoin traded around $62,733 (-0.4% over 24 hours), ether around $1,871.70 (-0.4%), and solana around $74.40 (-1.3%). Global crypto market cap sat near $2.24 trillion, with bitcoin share about 56.2%. U.S. spot bitcoin ETFs printed a $56.2 million net outflow on Friday after a $131.1 million Thursday print. Primary documents are below. For more tape context, see our market snapshot guide, Bitcoin history, and spot ETF glossary.
SafePal says an order-tracking flaw exposed about 39,798 customers
SafePal's August 16 security update says an authorization flaw in an order-tracking plug-in let outsiders view another customer's order record. The company says the window covers hardware-wallet orders placed between March 2, 2025 and April 11, 2026, and that about 39,798 customers had name, email, shipping address, phone number, and purchase details accessed. It says seed phrases, private keys, wallet passwords, bank details, payment cards, and government IDs were not in the leak, and it emailed affected buyers from security@safepal.com. SafePal says it patched the plug-in, cut order-data retention to 90 days, took down more than 30 phishing sites, and opened a lookup page that checks order ID plus shipping country.
Dutch NCSC: macOS Screen Sharing bug used to plant Monero miners
The Netherlands National Cyber Security Centre updated advisory NCSC-2026-0280 on August 12 after reports that CVE-2026-65400 is being exploited in the wild. NCSC-NL says several Macs with Screen Sharing reachable on port 5900 from the internet were rooted, and that a Monero miner was installed in every confirmed case. Apple patched the authentication bypass on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, describing it as an attacker on the network authenticating to Screen Sharing without valid credentials. The practical fix is to install those updates, or turn Screen Sharing off until the patch lands.
Novig sues Wisconsin AG to keep sports event contracts on federal rails
Ludlow Exchange LLC, doing business as Novig, filed a 45-page complaint on August 14 in the Western District of Wisconsin (case 3:26-cv-00761) against Attorney General Joshua Kaul and gaming administrator John Dillett. The filing asks the court to block Wisconsin gambling law from being used against Novig's sports event contracts, which it calls swaps under the Commodity Exchange Act and therefore inside exclusive CFTC jurisdiction. Novig says it began offering those contracts to Wisconsin customers the week before the suit, after the CFTC designated Ludlow Exchange as a designated contract market on June 16, 2026. Wisconsin already sued Kalshi, Polymarket, and Crypto.com over similar sports contracts in April, so this filing is preemptive rather than a ruling that Novig is in the clear.
Hashdex Bitcoin ETF (DEFI) last trades August 17 before a cash wind-up
Hashdex's August 12 press release, furnished with an 8-K/A, says the Hashdex Bitcoin ETF (NYSE Arca: DEFI) will close and liquidate. Assets were about $14.7 million as of July 30, 2026, while Hashdex says it still manages more than $200 million in other U.S. products. Shareholders can sell on NYSE Arca through the close of business on August 17, 2026, after which the fund stops creations, delists, sells remaining bitcoin, and plans a cash distribution around August 24 that will reflect wind-up costs and bitcoin's price while the book is sold.
Tudor Investment lifts IBIT shares while cutting reported calls
Tudor Investment's Form 13F, accepted August 14 and dated June 30, lists 688,529 shares of BlackRock's iShares Bitcoin Trust, up from 579,083 at March 31. The filing assigns about $23 million of reported value to those shares. The call line shrank from 998,000 underlying shares at March 31 to 148,000 at June 30, while puts eased from 725,000 to 715,000. Form 13F does not disclose strikes, expiry, or whether the options were hedges, so the rows are not a clean net bitcoin bet.
Lido publishes NEST automated LDO buybacks with daily and annual caps
Lido's August 14 post explains NEST, an onchain buyback that converts a slice of staking surplus into LDO via CoW Swap when revenue clears a baseline. Launch settings approved by the DAO include a $40 million annualized revenue baseline (about $109,000 a day), a 50% surplus share, a $50,000 daily cap, and a $10 million rolling annual cap. NEST starts in treasury-only mode, sending purchased LDO to the DAO's Aragon Agent. The post separates NEST from the April 13 LDO Accumulation Program, a one-time committee trade, not this daily machine.
Aave Horizon listings now go through DAO votes, not Labs alone
Aave Labs posted on August 14 that Aave Horizon will stop listing new collateral under the old delegated model. Every new Horizon asset will follow the Asset Listing ARFC path in Governance Framework v2: a published business case, LlamaRisk risk assessment, Aave Labs technical assessment, then a binding Snapshot vote. Labs still implements a successful listing. The change is effective immediately and is meant to give the DAO direct say as Horizon moves past tokenized Treasuries into other real-world assets.
U.S. spot bitcoin ETFs post a $56.2 million net outflow on August 14
Farside's full bitcoin ETF flow table shows a $56.2 million net outflow on Friday, August 14, after a $131.1 million net outflow on Thursday. BlackRock's IBIT accounted for $55.5 million of Friday's print, Fidelity's FBTC $6.8 million of outflows, and Bitwise's BITB a $6.1 million inflow. The Friday row is fully populated, unlike some overnight stubs that leave dashes on the large funds. Two down sessions do not make a trend, but they are the live flow print heading into this quiet Sunday tape.
