$70M Coldcard Exploit: CZ Just Admitted Hardware Wallets Aren't Safe
A $70 million Coldcard exploit just shattered one of crypto's most sacred beliefs: that hardware wallets are the final word in self-custody security.
Binance founder Changpeng Zhao is now publicly warning that no single hardware wallet should be trusted with your entire stack. His message is blunt: hardware wallets have bugs, they always have, and if you're holding everything on one device, you're one undiscovered vulnerability away from losing it all.
The Exploit That Changed Everything
Coldcard has long been the gold standard for Bitcoin self-custody. Security-first design. Air-gapped operation. The choice of serious Bitcoiners who don't trust exchanges or software wallets. That reputation took a direct hit this week after a major security failure exposed users to a $70 million loss.
Details of the exact attack vector are still emerging, but the core message is already clear: even the most trusted hardware in crypto is not immune to catastrophic failure.
What CZ Is Actually Saying
CZ's advice isn't panic-driven. It's strategic. Spread your holdings across multiple wallets. Don't concentrate risk in a single device, a single manufacturer, or a single point of failure.
This is the same logic institutional traders apply to exchange exposure after FTX collapsed. No single counterparty. No single point of failure. The lesson apparently still hasn't fully reached the self-custody crowd, and this exploit is a brutal reminder.
For everyday holders, this means rethinking the "one Ledger or one Coldcard and I'm safe" mentality that has dominated crypto security advice for years.
The Broader Problem Nobody Wants to Say Out Loud
Hardware wallet firmware is written by small teams, often under-resourced compared to the billions in assets they protect. Security audits happen, but they don't catch everything. And when a critical vulnerability surfaces, the damage is instant and irreversible. There is no fraud department. There is no chargeback.
The uncomfortable truth is that self-custody, while powerful, carries a risk profile most retail holders have never seriously stress-tested.
What You Should Watch and Do Right Now
If your entire crypto position sits on a single hardware wallet, this is your signal to act. Consider splitting holdings across at least two different hardware wallet brands from two different manufacturers. Coldcard users specifically should monitor official channels for firmware advisories and avoid any transactions until the exploit is fully documented and patched.
This story is still developing. The $70 million figure may not be the final number. Watch for on-chain analysis in the next 48 hours that could reveal how the funds were moved and whether additional wallets are at risk.
Self-custody is still the right move. Concentrated self-custody just got a lot harder to justify.