A Hard Month for Bitcoin Security, a Steady One for Bitcoin Well: Our August 2026 Update

Well over $100 million walked out of hardware wallets and Lightning nodes in a few weeks. Our 80,500 customers lost nothing. That isn't luck, and it isn't a slogan. It's the model.

In August 2026, Bitcoin Well posted gross profit above $265,000, grew its customer base past 80,500, kept building the Bitcoin IRA for a Q3 launch, and absorbed a wave of attacks on the software the whole industry depends on without a single loss. Here's what the month looked like from the inside, and why a bad month for bitcoin's price was a clarifying one for bitcoin's purpose.

Picture the first week of August from the seat of anyone running bitcoin infrastructure. On July 30, an automated sweep had started pulling coins out of Coldcard hardware wallets whose seeds had been generated with weak randomness years earlier. By the time the four waves finished, roughly 1,800 BTC were gone from more than 5,000 addresses, well north of $100 million. Nobody's device had been touched. The keys were simply guessable. A week later, on August 7 and 8, BTCPay Server (the open-source payment stack a huge slice of bitcoin merchants run on) disclosed that an unauthenticated attacker could grab the credential files for a Lightning node and drain it. Funds were stolen before the patch landed. Around the same time, Trezor and SafePal customers learned that shipping partners had leaked their names and home addresses, which is the kind of breach that ends with a knock on the door rather than an alert on a screen.

That was the backdrop. Not one attack, but a month where the ground under the entire ecosystem kept shifting, and where a lot of the damage came sideways, through firmware and dependencies and vendors, rather than through anyone's front door.

Against that backdrop, here's our month.⁠⁠

The numbers, straight

Gross profit came in above $265,000 in August. That's down from roughly $295,000 in July and well below the $546,000 we posted in August 2025. We're not going to dress that up. Year over year, gross profit is roughly half of what it was.

The reason isn't a mystery. In August 2025, bitcoin was trading around $108,000 and climbing toward the all time high it would set that October. This August opened near $63,000. Our business earns a spread on people buying and selling bitcoin, so when the dollar price of the thing being bought is 40% lower and the mood is 100% worse, the dollar figure at the top of the income statement shrinks. That's arithmetic, not a change in the business.

Total customers surpassed 80,500, up from 79,000 at the end of July and 59,900 a year ago. That's 34% more people in twelve months, most of which were bear-market months. Yearly active users came in above 12,600, ahead of last August's 11,824.

Read those side by side. Price down 40%, gross profit down by half, customer base up by a third. That's the shape of a business people join because they need the tool, not because they're chasing the chart.

And then the month ended with a twist. Bitcoin ran from the low $60s to near $80,000 in the back half of August, its biggest weekly rally in three years, and our platform lit up. Adam O'Brien, our founder and CEO, put it this way: "To finish off the month, we saw a huge spike in customer activity and volume due to the increase in the price of bitcoin. Bear markets are for building, bull markets are for capitalizing and our team is ready for both!"

We've written before about why bear markets are for building. August was the month we got a preview of the other half of that sentence.

What we built while the price was asleep

Three things, and they're related.

The first is the Bitcoin IRA, which is scheduled to launch in Q3. It gives our American customers the ability to buy bitcoin inside tax-advantaged retirement structures. That's a bigger deal than it sounds. The average person's largest pool of long-term savings sits inside an IRA or a 401(k), fenced off by rules that make it clumsy to hold anything unconventional. Meanwhile Washington has spent the past year loosening the fence: the Labor Department dropped its 2022 warning against crypto in retirement plans, an executive order last August told regulators to make room for alternative assets, and a proposed safe-harbor rule closed public comment in June with more than 33,000 submissions. The door is opening. We want to be the non-custodial way through it. We expect the IRA to drive a meaningful boost in both customer acquisition and customer spend into the final quarter of the year.

The second is a set of improvements to the Bitcoin Well Infinite portal, which serves our large-transaction clients. Minor changes individually, but this is the part of the business that moves the most bitcoin per customer, and every friction point removed there compounds. We expect the continued work on Infinite to keep growing that side of the business.

The third is security, and it deserves its own section.

No losses. Here's why that sentence matters.

The security work in August was a direct response to what was happening around us. Adam described it as responding "swiftly to a serious number of indirect attacks on software we rely on." Indirect is the key word. Nobody was kicking down Bitcoin Well's door. The attacks were aimed at the shared plumbing, the libraries and tools and upstream code that every bitcoin company, including us, builds on top of. When that plumbing gets poisoned, everyone downstream has to move fast.

Our team did. Bitcoin Well suffered no losses from any of it. "I am very proud of the way the team put their heads down and helped keep our Company safe and secure in August," Adam said.

You see, there's a second reason that sentence was possible, and it's structural rather than heroic. Bitcoin Well doesn't hold your bitcoin. Ever. When you buy from us, the coins go to a wallet you control. When you sell, they come from a wallet you control. There is no Bitcoin Well vault with 80,500 customers' savings in it, which means there's nothing for an attacker to sweep in twenty-five minutes.

Compare that to the shape of every big loss this year. The Coldcard victims lost because a device they trusted generated keys that were secretly weak. The BTCPay victims lost because a server they ran held Lightning credentials an attacker could reach. In each case, the vulnerability lived wherever the keys or the coins were concentrated. Attackers go where the honey is. A non-custodial exchange has a lot of things worth protecting (customer data, payment rails, the integrity of our own code), and we protect them hard. But the single most catastrophic failure mode in this industry, the one where a company's mistake becomes thousands of customers' lost savings, is one we designed out on day one.

Murray Rothbard built his whole economics on a simple premise: property is what you actually control, and a right you can't exercise isn't a right at all. Custody is the financial version of that idea. The Coldcard disaster is a painful reminder that self-custody is a practice, not a purchase (we wrote a full timeline and a checklist of what to do about it), and that the practice still beats the alternative. Even in the worst hardware-wallet failure in bitcoin's history, the people who lost were a small fraction of the people who held their own keys. When a custodian fails, it's everyone, all at once.

Böhm-Bawerk and the long way around

Here's the frame that makes sense of August as a whole, and it comes from an Austrian who doesn't get quoted nearly enough.

Eugen von Böhm-Bawerk, writing in the 1880s, made an observation that sounds obvious once you hear it. The most productive ways of making things are the roundabout ones. You can catch fish with your hands right now. Or you can spend a week weaving a net, catching nothing, and then catch ten times as many fish for years. The net is capital. The week of catching nothing is the price of it. Longer, more roundabout production processes yield more, but only for the person willing to wait, and to keep working through the stretch where the output isn't visible yet.

Böhm-Bawerk's insight was that this waiting is the whole game. Present goods are worth more to people than future goods (that's time preference, and he's the one who put it at the center of the theory of interest), so the person who defers reward to build the net is doing something real and costly. The reward for that is what capital earns.

Look at August through that lens. A Bitcoin IRA takes months of legal, technical and compliance work before a single account opens. Hardening your stack against attacks on upstream software is invisible when it works and only visible when it fails. Improvements to a portal for large clients don't show up in a press release as anything more than a bullet point. None of it produced fish in August. All of it is the net.

The market, meanwhile, was doing what markets do: pricing the present. Gross profit halved because the price halved, and the price halved because the crowd's time preference spiked. When people are scared they want dollars now. When they're greedy they want bitcoin now. A company that only makes money when the crowd wants bitcoin now is a bet on the crowd's mood. A company that spends the scared months weaving nets is something else.

This is also, and not by accident, what bitcoin itself asks of the people who hold it. Fixed supply, no bailout, no way to print your way out of a bad month. It rewards the low-time-preference saver and punishes the tourist, and it does so in every cycle without exception. We've written about how the dollar's slow leak is the reason six figures feels like scraping by. Bitcoin is the opposite instrument, and running a bitcoin company well means adopting the same posture your best customers already have. Keep stacking through the months that don't feel good. Judge the work by what it's worth in four years, not four weeks. And never mistake a quiet quarter for a reason to stop building.

What August actually told us

Strip away the price and here's what's left.

Thirty-four percent more customers than a year ago. More active users than a year ago. A retirement product weeks from launch into a regulatory window that's opening for the first time. A security posture that held while the industry took some of the worst hits in its history, partly because our team moved fast and partly because we never built the vault that attackers dream about. And a final week where the machine we'd spent the bear market building got to run hot for a few days, and ran.

The dollar figure at the top of the release will follow the price. It always has. What doesn't follow the price is whether people trust you with the most important financial decision they'll make, and whether you've built things well enough to keep earning that trust when the whole neighborhood is getting robbed.

There's no pile of customer bitcoin at Bitcoin Well because there was never supposed to be one. If you want the convenience of modern banking with the sovereignty of holding your own keys, in a bear market, a bull market, or a month that managed to be both, that's exactly what we built Bitcoin Well to do.

⁠Read the full press release.