The elliptic-curve math underlying Bitcoin has never been cracked. The randomness that fed it was.

The impact extends beyond the stolen coins. A seed is not a Bitcoin-specific object; it is pure entropy. It can also create addresses and keys for other systems. Anyone who brought a Coldcard seed into a multi-chain wallet was using the same defective dice at a different table.

Coinkite, the Canadian company behind the device, has released its own explanation of the incident. A few weeks before the theft, the firm ran one of the top available AI models over this exact code, searching for security issues. The review found nothing. The company also thinks that is how the attacker discovered the flaw, since the firmware has always been open source. Both sides had the same tool. It worked for only one of them.

This event underscores a key issue with AI-assisted security. A defender asks a model to examine a codebase and needs it to catch every serious vulnerability. An attacker asks it to find one exploitable route and can tolerate any number of failed attempts because only one correct answer is needed. Defense must be right everywhere. Offense must be right once. Inexpensive code review does not reduce that imbalance; it speeds it up.

That brings us to the well-known saying. Not your keys, not your coins. The oldest phrase in Bitcoin. It was directed at exchanges, and last week it worked exactly as stated. The victims held their own keys. So did the attacker. The protocol does not care which one was the true owner.

That is why recovery here is more than just difficult. Bitcoin is a bearer instrument. Anyone who can produce a valid signature can move the coin. The network does not check whether you are entitled to the funds. It only checks whether the signature is valid.

After that, the matter goes to the courts. You must locate the person, in a jurisdiction willing to hear your case, then demonstrate that the wallet was yours and that the transfer was theft rather than authorized. From the blockchain alone, those scenarios can appear identical.

Some years ago, a Bitcoin whale visited the office to learn about the digital asset products we offered. He asked about custody within 90 seconds, then made a show of distrusting every name on the list. Enterprise-grade, ISO-certified, audited, insured—and, to him, irrelevant, because someone else held the keys.

My answer then is the one I would give now. A regulated custodian is the part of the structure that can be held accountable. If client assets are mishandled, there may be insurance, contractual liability, auditors, and regulators to pursue. None of these guarantees recovery, but someone is responsible.

He chose otherwise, as was his right. The problem is that the choice was made by a slogan. Six words settled a question about a very large sum of money that deserved a discussion about failure modes, insurance, and exactly who you would sue.

None of this is an argument for buying the ETF and turning off your brain. Self-custody did not fail here. One vendor's build pipeline failed, and every user who provided his own dice rolls at setup came through unaffected. But the flaw was hidden for five years, and it sat inside the very ritual the practice tells you is safe.

That leaves the uncomfortable part. There is no self-test. You cannot run anything against your own wallet to find out whether your seed fell within the reproducible set, because a compromised seed and a sound one look the same. The only honest approach is to assume you are affected and move the assets to a newly generated, secure wallet.

The lesson is not that self-custody does not work. It is that it shifts responsibility. The key question is not just who holds your keys, but who bears the loss when those keys fail.

Yevgeny Bebnev is an investment professional and multi-manager fund specialist based in Dubai. He is also the founder and CIO of Alaris Capital.