Following a significant security incident involving Coldcard hardware wallets, Binance founder Changpeng Zhao (CZ) has advised crypto holders to consider spreading their assets across multiple wallets. The event underscores that even reputable offline storage solutions are not immune to flaws and highlights the ongoing challenges of self-custody in the digital asset space.
On July 30, 2026, observers noted a rapid series of transactions that emptied funds from numerous Coldcard devices. An attacker exploited a long-standing firmware issue originating in March 2021.
The defect compromised the randomness used when generating recovery seeds on certain models, primarily older Mk3 units and some others.
This weakness allowed the reconstruction of private keys offline, without any physical access to the hardware itself.
Many of the impacted wallets had remained inactive for years.
Early estimates indicated roughly 594 bitcoin, valued at about $38 million at the time, were moved from around 500 addresses in roughly 25 minutes.
Later analysis by Galaxy Research revised the figures upward, identifying approximately 1,082.65 bitcoin—worth around $70 million—taken from 1,196 addresses over a 41-minute period.
Coinkite, the manufacturer of Coldcard, acknowledged the problem, issued an apology, and released emergency firmware patches.
The company stressed that simply updating the software does not protect seeds already created under the vulnerable versions.
Affected users were instructed to generate entirely new seeds on updated devices and carefully transfer their holdings.
Newer models such as the Mk4, Q, and Mk5 were largely unaffected by the specific flaw in question.
Responding to reports of the theft on the social platform X, CZ noted that hardware wallets and even those with lengthy track records can contain bugs.
He suggested that dividing funds among a few different wallets could help reduce exposure, while openly recognizing that this strategy introduces its own set of challenges, such as more complex key management.
“Nothing is 100%,” he emphasized, closing with his familiar call to remain informed and stay SAFU.
The recommendation reflects a pragmatic view of risk in cryptocurrency custody.
Concentrating large holdings in a single device or seed phrase creates a single point of failure.
Distributing assets across independent wallets—ideally generated on different hardware or with varied methods—limits the damage if one is compromised. At the same time, managing multiple recovery phrases increases the chance of user error, loss of backups, or operational mistakes.
The incident has prompted wider discussion within the Bitcoin and broader crypto communities about the limits of even the most trusted self-custody tools.
Hardware wallets remain a cornerstone of secure storage for many because they keep private keys offline and isolated from internet-connected computers.
Yet this event demonstrates that firmware errors, entropy weaknesses, or other technical issues can still surface years after deployment.
For holders, the practical takeaway is clear: verify the generation history of existing seeds, migrate funds from any potentially affected devices as advised by the manufacturer, and evaluate whether a more diversified setup better matches their risk tolerance.
Continuous education, careful operational practices, and realistic expectations about security remain essential.
No single approach eliminates every threat, but thoughtful distribution of assets can meaningfully lower concentration risk. As the industry continues to mature, such episodes serve as reminders that vigilance and layered defenses are indispensable for protecting digital wealth.