$70M Gone From Cold Wallets: CZ Just Admitted Something Every Bitcoiner Needs to Hear
The wallet you think is safe may not be — and CZ is now saying it out loud.
Galaxy Research has revised the damage from the Coldcard hardware wallet exploit to nearly $70 million, almost double the initial estimate that circulated when the attack first surfaced. That revision alone should stop every self-custody advocate cold.
Binance founder Changpeng Zhao responded publicly, and his message was blunt: "Nothing is 100%." Coming from the man who built the world's largest crypto exchange and has spent years championing self-custody as the gold standard, that admission lands differently than a generic security warning from a lesser name.
What Actually Happened
The exploit targeted Coldcard users, a hardware wallet widely regarded as one of the most secure options on the market. Coldcard has built its entire brand around air-gapped security and open-source firmware. The fact that attackers were able to drain an estimated $70 million from holders using this device doesn't just hurt one company's reputation. It puts the entire cold storage thesis under the microscope.
Galaxy Research's updated figure suggests the initial reporting significantly underestimated the scope of the attack. That pattern, where the real damage is always worse than the first headline, is becoming a familiar and dangerous trend in crypto security.
CZ's Actual Advice
Zhao's recommendation was direct: spread funds across multiple wallets. Don't concentrate holdings in a single device, a single seed phrase, or a single point of failure. The logic is simple. If no system is unbreakable, then concentration is your biggest risk, not the exploit itself.
This isn't new security thinking, but hearing it from CZ after a $70 million wipeout gives it weight that a blog post from a hardware vendor never could.
What Crypto Holders Should Watch
This event has two immediate implications for the market.
First, expect a conversation about hardware wallet alternatives. Competing products and multi-signature custody solutions will see renewed interest. Any project positioning itself as a Coldcard alternative is worth watching over the next two to four weeks.
Second, on-chain insurance and decentralized custody protocols could quietly catch a bid. When high-profile exploits hit, capital flows toward whatever the market believes is the next safe haven, at least until the next exploit proves otherwise.
The uncomfortable truth CZ surfaced isn't that Coldcard failed. It's that no single product, no single strategy, and no single number on your security checklist is a finish line.
Diversify your custody. Watch the wallet security space closely. The $70 million figure will not be the last one.