Bitcoin’s USD spot market posted a coordinated 3.65% gain over the past 24 hours, with trading activity dominated by Coinbase and price moves unfolding in lockstep across the major USD venues.

The session analyzed by CryptoSlate, on Aug. 11, 09:40 CEST, provides a clear look at where USD liquidity sits and how it shapes the flow of the market.

Coinbase, Kraken, Bitstamp, and Binance’s BTCUSD pair saw a combined $981.93 million in rolling 24-hour USD volume.

These four exchanges capture the core of Bitcoin’s USD spot market. Binance is the largest exchange globally in terms of total crypto volume, but most of its trading is in USDT and other stablecoin pairs, while Coinbase, Kraken, and Bitstamp handle the bulk of direct USD volume.

Including Binance’s BTCUSD pair alongside the three USD-heavy venues gives a fuller picture of price formation and liquidity in the dollar-denominated segment of the market.

Coinbase handled the bulk of this with $544.47 million, more than half the total. Kraken followed with $207.70 million, Bitstamp with $174.86 million, and Binance trailed with $54.90 million. This imbalance means the center of gravity for USD price discovery rests firmly with Coinbase.

Most large trades in this market will either pass through Coinbase directly or anchor their pricing to it. Kraken and Bitstamp add meaningful secondary depth, while Binance’s USD pair plays a minor role compared to its much larger USDT markets.

Prices across the four moved together, showing a strong, consistent upward push. Coinbase ended the period at $121,782.48, up 3.53%. Kraken closed at $121,762.00, up 3.49%, Bitstamp at $121,763.00, up 3.50%, and Binance at $121,598.17, up 4.10%.

The equal-weighted average price across the venues climbed from $117,435.57 to $121,726.41. Daily ranges were wide but orderly: Binance led with a $5,388.18 swing (4.62%), while Bitstamp and Coinbase both moved about $4,679 (3.98%), and Kraken’s range was $4,571.70 (3.89%).

The spark for the day’s rally hit at 04:00 CEST, when all four venues recorded their largest five-minute session gains. Prices at that moment were separated by just $113.62 from top to bottom, a sign of how closely aligned the books were when the move began.

The synchronized nature of the spike tells us that a broad catalyst affected prices, rather than a single exchange leading and the rest following.

Even in a clean uptrend, the differences between venues matter. The median spread between the highest and lowest quotes in the sample was $678.40, with a 95th percentile of $917.04. Binance’s median deviation from the average price was 42 basis points, far greater than Kraken’s 11.6 bps or Bitstamp’s and Coinbase’s ~14 bps.

That gap is more than a quirk of the data; it affects execution costs. Traders routing across all venues without price filters risk paying hundreds of dollars more per Bitcoin than necessary if they hit the wrong side of a broader market.

These liquidity patterns have knock-on effects. With so much USD flow running through Coinbase, its order book naturally acts as a reference point. Price moves there tend to ripple outward, influencing quotes on other venues, especially those that rely on aggregated feeds.

Kraken and Bitstamp, with their tighter alignment to Coinbase, reinforce the core USD price. Binance’s wider deviation in its USD pair means it sometimes moves to its own rhythm, which could be linked to internal order flow or spillover from its larger USDT markets.

Realized volatility over the 24 hours averaged 1.66% across venues. Coinbase saw the highest at 1.71%, followed by Bitstamp at 1.70%, Binance at 1.66%, and Kraken at 1.58%. The volatility figures fit the price ranges: steady upward motion rather than chaotic swings. That environment benefits traders looking to work large orders over time, but the venue-by-venue pricing differences remain a key factor in minimizing costs.

The day’s low across the sample was $116,749.76, and the high was $122,308.00, framing the session’s battlefield. The rise from bottom to top was steady and broad-based, the kind of move where spot and derivatives markets tend to reinforce each other.

The lack of sharp retracements suggests the buying was persistent enough to absorb profit-taking along the way.

Looking at this distribution, the state of the USD Bitcoin market is clear: one dominant venue sets the pace, while others help anchor the price. This means execution quality depends on knowing where the real liquidity is and which books stay closest to the market’s core.

A run like this, with a clean 24-hour rally and relatively tight clustering between large exchanges, shows efficient price discovery in action.

If these patterns hold, Coinbase’s role as the USD price hub will not be challenged soon. Kraken and Bitstamp will remain important for diversification and redundancy in pricing.

The post Coinbase held the majority of USD trading volume as BTC spiked to $122k appeared first on CryptoSlate.

Summer 2025 wasn’t just hot; it was relentless.

Ransomware hammered hospitals, retail giants suffered data breaches, insurance firms were hit by phishing, and nation-state actors launched disruptive campaigns.

From stealthy PowerShell loaders to zero-day SharePoint exploits, attackers kept defenders on their heels.

This report breaks down the season’s most high-impact incidents and what security teams need to do before the next wave hits.

Summer Expose Healthcare’s Growing Ransomware Risk

Hospitals can’t afford downtime, and attackers know it. 

This summer, ransomware groups targeted healthcare, exploiting both the value of patient data and the urgency of care.

Interlock rises as a major threat to US healthcare

A July 22, 2025, joint advisory by CISA, FBI, and HHS highlighted Interlock as a major threat to the Healthcare and Public Health (HPH) sector. The group is linked to around 14 incidents in 2025 alone, with a third affecting only healthcare providers.

What sets Interlock apart is its use of “FileFix,” a PowerShell launcher that hides malicious scripts behind decoy file paths. It tricks users into running payloads through File Explorer, bypassing typical security detections.

Rhysida ransomware targeted another US healthcare center

On July 8, 2025, the Rhysida ransomware group allegedly leaked sensitive data from Florida Hand Center, including medical images, driver’s licenses, and insurance forms. 

The clinic, which serves patients in Punta Gorda, Port Charlotte, and Fort Myers, was given just seven days to respond before the release.

Qilin recycles Scattered Spider playbook in wave of healthcare breaches

In June 2025, Qilin became the most active ransomware group, recording 81 victims, 52 of them in the healthcare sector.

The group exploited unpatched Fortinet vulnerabilities (CVE-2024-21762 and CVE-2024-55591) to gain access, deploy ransomware, and exfiltrate sensitive data such as EHRs and insurance records.

To maximize pressure, Qilin went beyond encryption, leveraging legal-themed extortion tactics like a “Call Lawyer” feature and automated negotiation tools to drive faster payouts.

Major Brands Breached in Retail Cybercrime Wave

The retail sector couldn’t escape the wave of cyberattacks sweeping through Summer 2025.

Louis Vuitton breach marks third in a quarter

On July 2, 2025, Louis Vuitton UK suffered a data breach exposing customer contact info and purchase history, its third LVMH brand breach in three months after Dior and LV Korea. 

Days later, on July 10, UK police arrested four suspects tied to high-profile attacks on M&S, Co-op, and Harrods. 

The group is allegedly linked to Scattered Spider, a domestic threat actor known for social engineering and collaboration with ransomware operators like DragonForce, signaling the growing impact of homegrown cybercriminals on major retailers.

DragonForce hits US retail chain Belk

Between May 7 and 11, 2025, on the other side of the Atlantic, North Carolina, based retailer Belk suffered a data breach.

DragonForce claimed responsibility, stating it exfiltrated 156 GB of customer and employee data, including names, Social Security numbers, emails, order histories, and HR files, which were later posted on its leak site after ransom negotiations stalled.

DragonForce, first emerging in late 2023, operates as a ransomware-as-a-service cartel, listing approximately 136 victims by March 2025, many of whom are in US and UK retail organizations.

Scattered Spider’s tactics have shifted from retail to insurance 

Scattered Spider (UNC3944), a native English-speaking cybercriminal collective, used identity-centric social engineering, voice phishing, MFA fatigue, help-desk impersonation, and typosquatted domains to breach UK retailers (M&S, Co-op, Harrods) in April–May 2025. 

In mid-June 2025, the researchers flagged that Scattered Spider (UNC3944) had shifted from retail to targeting US insurance firms.

• Aflac detected and contained unauthorized access on June 12, 2025; customer and employee personal data (including SSNs, health claims) may have been compromised. 

• Erie Insurance and Philadelphia Insurance Companies also reported similar cyber disruptions in early to mid-June, resulting in operational downtime.

The intrusions matched Scattered Spider’s known tactical profile, though no ransomware was deployed, and systems remained operational.

State-Sponsored and Geopolitical Cyber Activity

Not all cyber threats this summer were about money. 

Nation-state hackers and hacktivists also made their mark, using the turbulent geopolitical climate to launch attacks.

• June 14–17, 2025: Pro-Israel hacktivist group Predatory Sparrow hit Iran’s Bank Sepah, disrupting banking services, then destroyed ~$90M in crypto by breaching Nobitex and sending tokens to burn wallets.

• June 30, 2025: The US Department of Homeland Security and CISA issued a joint alert warning of impending Iranian cyber retaliation targeting critical infrastructure in the US and Europe. 

These incidents serve as a stark reminder that cyber conflict is now a frontline extension of geopolitical tension, one that can ripple far beyond borders and sectors.

Key Vulnerabilities Gaining Public Attention 

Multiple Microsoft SharePoint vulnerabilities were exploited this summer in a widespread cyber espionage campaign known as ToolShell.

• CVE-2025-53770 is a critical remote code execution flaw allowing unauthenticated attackers to run arbitrary code on vulnerable on-prem SharePoint servers. Threat actors used it to deploy web shells, steal credentials, and move laterally through enterprise networks. CISA added the bug to its KEV catalog on July 20, 2025.

• CVE-2025-49704 and CVE-2025-49706 were also added to the KEV on July 22 after being abused in chained attacks. The pair enables authentication bypass and code injection, allowing attackers to exploit unpatched SharePoint systems even if earlier fixes were applied.

The ToolShell campaign targeted organizations across the US, Europe, and the Middle East, including government agencies, energy firms, and telecom providers. 

Security researchers say the attackers likely reverse-engineered Microsoft’s July Patch Tuesday fixes to develop the bypass used in CVE-2025-53770.

What to Take from the Summer Wildfires in Cybersecurity?

From hospitals to retail giants and insurance providers to nation-states, the season exposed cracks in even the most fortified environments. 

Here’s what security teams should do next.

Patch like your life depends on it, because they do in critical sectors.

Start with CISA KEV entries and high-severity CVEs, but don’t stop there. Ask the harder question: are you the kind of target that attackers go after?

Validate whether each CVE is actually exploitable in your environment.

Focus on exploit chains, not just the scores. That’s what adversaries are doing.

Harden identity as your new perimeter.

Social engineering worked better than malware this summer. Stop MFA fatigue attacks, reinforce help-desk verification, and limit privileged access. 

Train your humans, because they were the breach point.

Scattered Spider and others didn’t exploit a CVE; they exploited a person. Run regular simulations, update phishing scenarios, and prepare high-risk roles for real-world lures.

Watch for what happens after initial access.

Threat actors like Interlock and Qilin didn’t just drop ransomware; they moved laterally, staged data, and evaded detection. Implement behavioral monitoring for techniques, such as PowerShell abuse, credential theft, and stealthy exfiltration.

Don’t ignore legacy systems and overlooked infrastructure.

Don’t ignore legacy systems and overlooked infrastructure. The ToolShell campaign exploited unpatched on-prem SharePoint servers, many running unsupported or outdated versions.

Whether it’s aging on-prem SharePoint, appliances, or unmonitored legacy gear, isolate what you can’t upgrade, monitor what you can’t patch, and replace what you’ve ignored.

We strongly suggest simulating the mentioned attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform.

You can also test your defenses against hundreds of other malware and exploitation campaigns, such as Medusa, Rhysida, and Black Basta, within minutes with a 14-day free trial of the Picus Platform.

Sponsored and written by Picus Security.