Claims of absolute security from self-custody have just been shattered. David Schwartz, Ripple CTO Emeritus, spoke out in response to the recent breach of Coldcard hardware wallets that drained the coins of thousands of users. He described the incident as a prime example of an outlier risk - a rare technical failure leading to losses far exceeding user expectations.
For Schwartz, the root of the vulnerability does not lie in the concept of crypto itself. He likened the Coldcard incident to the collapse of brokerage firm MF Global back in 2011, when customers suddenly lost access to their accounts because funds that should have been segregated were instead misused by the broker. His main point is straightforward: the practice of self-custody does not automatically eliminate all types of operational risk. Ultimately, users must still trust the hardware manufacturers and the released firmware code.
The Illusion of Security Without a Safety Net
The sharp contrast between the crypto ecosystem and traditional financial systems becomes immediately apparent when disaster strikes. Customers of regulated financial institutions are protected by deposit insurance, orderly bankruptcy proceedings in court, and fund recovery mechanisms. On the other hand, Coldcard owners whose Bitcoin was stolen this time are left completely without a similar safety net.
This security disaster stems from a specific technical oversight. The firmware released in March 2021 apparently relied on a software-based random number generator, bypassing the more adequate hardware entropy system. This critical flaw was left unpatched in Coldcard Mk2 and Mk3 models running versions 4.0.1 to 4.1.9, leaving a gaping loophole for hackers.
Tracking data from Galaxy Research outlines the scale of this theft. A total of 1,596 BTC has disappeared from approximately 7,300 addresses across three confirmed attack waves. The opening wave, which erupted on July 30, swept away over 1,000 BTC from at least 1,200 addresses in less than an hour. Galaxy researchers predict a fourth wave could follow, potentially bringing the total stolen coins to 2,055 BTC, valued at approximately $130 million.
As a mitigation measure, the Galaxy team has shared hundreds of the attacker’s wallet addresses with US federal investigators, several crypto exchanges, and blockchain security firms. As of the latest report, approximately 90% of the total stolen Bitcoin has not been moved again by the perpetrator.
What Are the Next Emergency Steps?
Coinkite, the manufacturer of Coldcard, has released corrective firmware to plug this security loophole. However, a software update alone does not secure the old seed codes that have already been exposed. Users must generate a new seed and transfer their remaining assets to ensure the security layer is restored.
Official guidance from Coinkite instructs customers to update their devices to version 4.2.0 or later, generate a new seed phrase, and send a small test transaction first. Only after the network is confirmed to be normal can the remaining funds be transferred.
The complexity of the recovery procedure and the massive amount of money lost are gradually shifting the sentiment of crypto owners. The Coldcard exploit triggered record inflows into centralized exchanges like OKX, a sign that many investors are starting to reconsider holding their own wallets. When the option of holding one’s own keys proves capable of leading to uncompensated losses, some users choose to seek shelter behind the defensive walls of major exchanges. Reported from crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
