Coldcard’s $38 million (so far) exploit shakes faith in self-custody, may push investors to ETFs

Some prominent bitcoin advocates say the incident is among the most damaging failures of self-custody the industry has experienced.

“This is the worst hit in bitcoin history to the most knowledgeable and ‘properly secured’ bitcoiners,” said Bitcoin commentator Guy Swann. “This isn’t an exchange getting hacked because of hot keys. This is thousands of individuals having their personal private keys recreated out from underneath them.”

Trading one risk for another

For years, bitcoin advocates have argued that holding private keys removes the counterparty risk of centralized exchanges, a lesson reinforced by failures such as FTX. Analysts now argue that users have simply exchanged one set of risks for another.

“The self-custodial hardware space is a disaster at this point and creates more bad rep for the industry than anything else,” said Lorenzo Valente, director of digital asset research at ARK Invest.

“In practice, consumers have traded counterparty risk for software risk, hardware risk, supply-chain risk, phishing risk, backup risk, and the possibility of losing everything through one mistake,” he said. “Frankly, you are better off today holding funds across several publicly-traded exchanges or ETFs.”

The Coldcard flaw illustrates that challenge. Researchers found that certain firmware versions generated wallet seeds using far less randomness than intended, making them susceptible to brute-force attacks.