July 2026 Market Commentary

This commentary was written by Jianing Wu, with contributions from Su Lee.

Crypto Holds

Markets moved on three main threads in July: recurring U.S.-Iran conflict headlines, AI-related capital spending, and a Federal Reserve that held rates steady while offering little forward guidance. Equities finished the month roughly flat to slightly lower. Crypto, meanwhile, had a strong month, with BTC posting its second-best monthly gain of the year and ETH its best.

Of the three threads, AI-capex anxiety drove most of the damage, hitting semiconductor stocks and the Nasdaq hardest while the S&P 500 held roughly flat. The U.S.-Iran conflict compounded that pressure by pushing oil higher and adding an inflation angle to the Fed's already-hawkish, low-guidance hold statement on July 29. Relief came from the same place the selloff started: strong Microsoft and Amazon earnings help validate the AI buildout by month-end, a recovery that's carried into August with the S&P 500 and Dow near record highs, though the Nasdaq has yet to fully join in.

The macro backdrop stayed unsettled. At its second meeting under Chair Kevin Warsh, the Fed voted 9-3 to keep its target range at 3.50%-3.75%. Three regional presidents (Cleveland's Beth Hammack, Minneapolis's Neel Kashkari, and Dallas's Lorie Logan) dissented in favor of a hike. Warsh's press conference, notably light on forward guidance, sent long-end yields sharply higher, with the 30-year Treasury yield touching its highest level since 2007, and triggered a same-day equity selloff.

Oil's specific path is worth noting: As the conflict widened over the course of the month, Brent oil climbed more than 20%, to the low-$90/barrel range, before easing on ceasefire talks. Gold rose roughly 2.2%, a modest bid amid the broader turmoil. The dollar slipped about 1%, weighed down by the Fed's hold and softer growth data broadly, then dented further in the final days of July by an intervention-driven spike in the yen.

Crypto, by contrast, had its best month in 2026 so far. BTC rose roughly 7% and ETH roughly 18% on the month, decoupling from the equity turbulence even as sentiment stayed cautious. Spot bitcoin ETFs, which had just logged their worst month on record in June, turned to net inflows in July with $194 million. The Crypto Fear & Greed Index held in "fear" territory for much of the month despite the price gains but is turning toward “neutral.” BTC spent most of July range-bound between the high-$50,000s and mid-$60,000s. The price repeatedly tested its 200-week moving average from both sides as Iran headlines, chip-sector risk-off spillover, and shifting ETF flows pushed it in and out of range, before closing the month firmer near $64,000.

On the DAT side, Strategy was a net seller through most of July following broader pressure from the preferred-stock stress that forced a capital-structure overhaul in late June. It sold 3,588 BTC (~$216 million) in early July – its largest single sale ever – to fund preferred-stock dividends, then raised roughly $466.7 million and $263.5 million in back-to-back weeks by selling MSTR common stock rather than touching its BTC holdings. The company closed the month with a further sale of 1,638 BTC (~$105 million), leaving its holdings at 842,138 BTC.

On policy, the CLARITY Act's odds kept slipping. The Senate released a combined market-structure text on July 22, merging the Agriculture and Banking committees' versions, but Galaxy Research cut its 2026 passage probability to 30% from a coin-flip in June (more on this below). Separately, SEC Commissioner Hester Peirce warned that onchain vaults and lending arrangements aren't automatically exempt from securities law. A vault where the manager actively allocates funds can still qualify as a security, depending on how it's structured, she cautioned.

001 CLARITY Act’s Odds Keep Slipping

On July 22, Sen. Cynthia Lummis (R-Wyo.) released the Senate's combined CLARITY Act text, merging the Banking and Agriculture Committees' earlier bills into a single 616-page package. It included provisions that survived months of back-and-forth: a compromise restricting stablecoin yield to keep it from competing directly with bank deposits and developer protections under the Blockchain Regulatory Clarity Act.

What's new, and what's now holding the bill up, is an ethics provision that wasn't in either committee's earlier draft. It would restrict senior officials from issuing or sponsoring crypto while in office, but route enforcement solely through the Justice Department and expires in 2029. Democrats complained this doesn't go far enough, and a group who had been negotiating with Republicans said publicly the text "falls short."

That matters because the math was already tight. Even with every Republican vote, the bill needs 60 to clear a filibuster, and a couple of reported GOP holdouts mean Republicans may not even have a clean majority on their own.

The calendar worsened the legislation’s prospects. Passing a bill isn't a matter of taking one vote. It requires filing cloture, a mandatory waiting period, floor debate, and an amendment process, which together eat up several legislative days in a row. The Senate's session ran only through Aug. 7 before recess, and floor time was already committed to other priorities, leaving no real runway to start that sequence even if a last-minute deal had landed. Majority Leader Thune confirmed the chamber wouldn't finish floor action before recess, and prediction market odds drifted down into the mid-10% range at the time of writing. Galaxy Research cut its 2026 passage odds to 30% on July 24, down from a coin-flip in June.

Separately, SEC Chair Paul Atkins signaled the agency could write its own crypto market-structure rules if Congress doesn't act, a fallback that would trade the durable, harder-to-reverse law the bill was designed to deliver for something regulators could write on their own.

Yet the crypto market didn’t wobble on the bearish CLARITY headlines. Bitcoin finished July well above where it traded back when CLARITY's odds stood at 60%. As we’ve stated before, a CLARITY failure wouldn't leave the industry empty-handed, because regulators can still deliver most of what it wants through agency guidance over the next few years, just without statutory permanence. Institutional building continued on that assumption as banks kept pushing forward efforts on working with digital assets, suggesting the market is pricing CLARITY as one lever among several rather than the sole gate to institutional adoption.

002 Banks Keep Pushing Into Crypto

The "blockchain, not bitcoin" refrain has run among TradFi participants since crypto’s first mainstream cycle more than a decade ago, when institutions widely acknowledged the appeal of a digital ledger even as they dismissed the asset class. A handful of banks explored institutional use cases such as collateral mobility and trade-finance collateral management, but most projects stayed small and in the proof-of-concept stage. In 2026, we are seeing financial institutions advancing on both sides of the stack: bringing traditional assets onchain to improve settlement, collateral mobility and distribution, while also expanding clients’ access to native cryptoassets.

DTCC has emerged as one of the clearest examples. After its DTC subsidiary received an SEC no-action letter in December authorizing it to tokenize certain DTC-custodied securities, DTCC conducted a large-scale production initiative on July 15 in which DTC-held securities were converted into tokens and used in live transactions. More than 30 firms participated across collateral pledges, securities lending, U.S. Treasury and repo delivery-versus-payment, equity DVP and delivery-versus-delivery, token transfers and central-counterparty margin workflows. The transactions ran across both Canton, billed as a public network (some dispute this), and DTCC’s private network, built on the Linux Foundation Decentralized Trust’s Besu (formerly Hyperledger Besu), reflecting a deliberate multichain strategy ahead of the service’s planned October full launch.

BNY pushed the same transition further into fund servicing on July 29 with the launch of its Digital Transfer Agency. The platform is designed to support digitally native funds across multiple jurisdictions and blockchains, integrating tokenization, distribution, and custody while allowing the legal representation of a fund’s books and records to exist on a public blockchain. Investment manager Baillie Gifford is using the capability for its newly launched U.K.-regulated tokenized fund, while BNY Investments Dreyfus and BlackRock are expected to use it for forthcoming products. BNY’s broader transfer-agency business services approximately $8.6 trillion of assets across more than 7.6 million investor accounts, giving the digital platform a significant base from which to scale. (To be clear: the full $8.6 trillion is not being transferred onchain at launch.)

Apart from leveraging distributed ledger technology, banks are also moving on the client-facing side: On July 16, Morgan Stanley’s ETRADE completed the rollout of spot trading in bitcoin, ether, and solana, allowing eligible clients to buy, sell and hold the assets through linked Zero Hash accounts within the ETRADE experience. The following day, Bank of America named Sonali Theisen head of its global digital assets platform while she retained her role leading global fixed income, currencies and commodities (FICC) electronic trading and markets strategic investments. Although the appointment did not coincide with a product launch, the organizational structure indicates that digital-asset infrastructure is being placed alongside core electronic-trading and markets functions rather than isolated inside an innovation lab.

003 Your Keys, Not Your Coins

Self-custody is often presented as the cleanest way to eliminate counterparty risk: investors hold their own private keys and are therefore insulated from the failure of an exchange, custodian, or other intermediary. The recent Coldcard exploit exposes the other side of that trade-off. Removing a third-party custodian does not remove custody risk; it transfers that risk to the hardware, software, and key-generation processes on which the holder depends.

Starting July 30, attackers drained wallets hosted on Coldcard devices across multiple escalating waves: roughly 1,082 BTC by Aug. 1, then approximately 284 BTC in the next two waves, with a fourth wave reported. Galaxy Research now estimates at least 15 separate attackers are exploiting the bug independently, up from the handful of coordinated operators it initially identified, with total losses tracked near $130 million as of Aug. 4.

The vulnerability originated in Coldcard’s seed-generation process. Normally, the device would draw entropy (a measure of randomness) for a new seed phrase from a dedicated hardware random-number generator embedded in its chip. A firmware bug introduced in a March 2021 (yes, five years ago) release instead routed part of that process through a software fallback. That fallback was seeded only by the device’s fixed information and its timer/clock registers, rather than a strong source of new randomness.

The software function was not intended to generate private keys. As a result, affected seeds that should have contained approximately 128 bits of randomness may have had an effective entropy of only around 40 bits for affected Mk2 and Mk3 devices and 72 bits for newer Mk4, Q, and Mk5 devices. At that level, an attacker with an approximate understanding of the device identifier and seed-generation timing could generate candidate seeds offline and compare the corresponding addresses against the public blockchain. Physical access to the wallet was not required.

Coinkite, the Canadian manufacturer of Coldcard, released emergency firmware updates, but the remediation is prospective rather than retroactive. The patches can protect seeds generated after installation, but they cannot strengthen a seed that was already created using vulnerable firmware. Those seeds remain permanently susceptible to brute-force recovery. Affected users have therefore been advised to generate an entirely new seed on patched hardware and migrate their assets to new wallets.

The incident complicates one of the central assumptions behind self-custody. The conventional maxim of “not your keys, not your coins” frames control of the private key as the primary safeguard against loss. In this case, however, the hardware wallet itself introduced the vulnerability at the point of key creation. One user said he kept a Coldcard in a bank safe-deposit box, never connected it to the internet, and nevertheless lost 18.25 BTC in seven minutes. As the user observed, “Perhaps the hardest part about this is that I did everything right.” The failure occurred before standard operational-security practices could offer any protection.

This risk asymmetry helps explain why many institutional investors continue to prefer exchange-traded products over direct self-custody. Custodians supporting spot bitcoin ETFs, such as Coinbase Custody and Fidelity Digital Assets, typically employ controls including offline key generation, multisignature authorization, geographically distributed key material, and segregated cold-storage accounts. These measures do not eliminate custody risk, but they are designed to prevent the failure of a single device, or location, from resulting in a total loss. In effect, they apply the same risk-distribution principle as multisignature self-custody, but embed it in a regulated and operationally controlled custodial framework.

Market sentiment appears to have remained comparatively resilient. The Crypto Fear & Greed Index, which spent much of the year in “fear” territory, registered neutral readings in the mid-to-high 40s and low 50s in early August. That response suggests market participants have so far treated the Coldcard incident as a product-specific implementation failure rather than a broader challenge to bitcoin or the underlying case for self-custody.

The more durable lesson is narrower but still significant: possession of a private key is only as secure as the process and infrastructure used to create it.

004 Our Takeaways and Predictions

Coming into August, the Fed is the bigger source of uncertainty than any single data point. Chair Warsh has abandoned forward guidance, leaving markets with no signal on the Fed's reaction function heading into the Sept. 15-16 meeting. With no baseline path to anchor against, upcoming inflation and labor-market releases carry more weight than they normally would, and Treasury yields sitting near multi-decade highs mean the market has less room to absorb a surprise in either direction.

The AI trade appears to be moving from correction into consolidation, though it's too early to call the bottom with confidence. Valuations have come down meaningfully after July's selloff, but the market's expectations for the sector remain elevated given how much of this year's gains were concentrated there, leaving room for renewed volatility on either side of an earnings surprise. Separately, the U.S.-Iran ceasefire remains a fragile truce rather than a resolved conflict; implementation and any progress toward a longer-term agreement remain uncertain, leaving in place the same slow-burning geopolitical risk premium that carried through last month.

Crypto's setup looks more constructive than the headlines around it, in our view. We believe BTC shows signs of finding a floor, with whale and longer-term holder accumulation visible below $60,000 providing a support zone the market has repeatedly defended. On policy, the CLARITY Act's 2026 odds have continued sliding, now near 16% on prediction markets, all but removing near-term legislative catalysts from the table. But as July has shown, the bill’s dimming prospects need not be a drag on crypto price performance. The market may already be pricing in a CLARITY delay and potential failure rather than treating it as a shock, for now.

Key Events to Watch:

• August 11: CoreWeave (CRWV) Earnings

• August 26: Nvidia (NVDA) Earnings

• August 27-29: Jackson Hole Economic Policy Symposium

Key Macroeconomic Data Releases:

• August 12: CPI

• August 13: PPI

• August 14: Retail Sales

• August 21: Manufacturing PMI, Services PMI

To learn more about the topics covered in this month's newsletter, contact our team or reach out to your Galaxy representative.

Crypto Performance & Volatility Data