Binance founder Changpeng Zhao (CZ) has cautioned that hardware wallets are not entirely risk-free, advising crypto users to distribute their holdings across multiple wallets following a major Coldcard security incident.
Responding to the reports on X, CZ emphasized that even well-established wallets can contain undiscovered bugs. He suggested splitting funds as a way to reduce exposure, while noting that diversification introduces its own risks and that no security solution is completely foolproof.
The breach traces back to a firmware flaw introduced in March 2021, which compromised the randomness used to generate recovery seeds on certain Coldcard devices. This weakness enabled attackers to reconstruct private keys offline, allowing them to access funds without physical access to the wallets.
Initial on-chain data showed that about 594 BTC—valued at roughly $38 million at the time—was drained from around 500 wallets within 25 minutes on July 30. Further analysis by Galaxy Research later expanded the масш to 1,082.65 BTC, or approximately $70 million, stolen from 1,196 addresses over about 41 minutes. Many of the affected wallets had remained inactive for extended periods.
Coldcard manufacturer Coinkite has acknowledged the issue, issued an apology, and released emergency firmware updates. The company advised users who generated recovery seeds on affected versions to create entirely new seeds on updated devices and carefully transfer their funds, warning that updating firmware alone does not secure already compromised wallets.
The incident has reignited debate over the limits of self-custody. Although hardware wallets are widely regarded as one of the safest methods for storing bitcoin offline, the Coldcard exploit demonstrates that even trusted devices can harbor critical vulnerabilities for years. CZ’s call for diversification highlights a key trade-off: spreading risk can improve security but also adds complexity in managing multiple wallets and keys.
