In light of the recent $70 million exploit affecting Coldcard hardware wallets, Binance's founder, Changpeng Zhao, known as CZ, has emphasized the importance of diversifying crypto holdings across multiple wallets.
On Saturday, following the alarming security breach involving Coldcard devices, Zhao advised crypto investors to distribute their assets among various wallets. He stated, “Even hardware wallets can have bugs. Even old wallets (with long history) can have bugs. How to mitigate? Split your funds in a few wallets maybe? This has a different set of risks. Nothing is 100%. Stay informed. Stay SAFU!”
The issue surfaced on July 30, when numerous Bitcoin users found that their Coldcard wallets had undergone unauthorized transactions. The breach stemmed from a firmware vulnerability dating back to March 2021, which compromised the randomness in generating recovery seeds for specific Coldcard models. This flaw enabled an attacker to reconstruct private keys offline, allowing them to siphon funds without needing physical access to the wallets.
Initial reports indicated that approximately 594 BTC, valued at around $38 million at the time, was stolen from roughly 500 wallets within a 25-minute timeframe. However, a subsequent analysis by Galaxy Research revealed that the total amount looted was 1,082.65 BTC, equating to about $70 million, taken from 1,196 addresses over approximately 41 minutes. Many of the wallets affected had been inactive for several years.
Coinkite, the manufacturer of Coldcard, has acknowledged the vulnerability, apologized, and issued urgent firmware updates. The company recommended that users who generated seeds using the compromised versions should create entirely new seeds on updated devices and carefully transfer their funds, as merely updating the firmware does not secure the previously created vulnerable seeds.
This incident has reignited discussions about the limitations of self-custody. While hardware wallets are generally considered one of the safest methods for storing Bitcoin offline, the Coldcard breach demonstrates that even well-established devices can have significant flaws that go unnoticed for extended periods. CZ’s call for diversification reflects an understanding that spreading assets carries its own set of practical challenges, particularly concerning more complex key management.