Coldcard Hack Fallout: Where Bitcoin Custody Goes Next

I bought one of the first Coldcards ever made. For six years the device did exactly what it was built to do: keep my bitcoin where nobody else could touch it. Last Thursday I spent the afternoon hurriedly moving coins that were supposed to sit still for years, because the seed phrases some Coldcards generated turned out to be guessable.

I got lucky. My device predated the bug. Thousands of holders did not. As I reported on August 4, a flaw in Coldcard firmware shipped in March 2021 silently skipped the device's hardware randomness chip, and the weak keys it produced sat in public code for five years before anyone noticed. The theft total has climbed to roughly $130 million, about 2,000 bitcoin drained from more than 5,200 addresses, according to press tallies built on Galaxy Research's on-chain tracking.

The panic has reopened an old argument: who should hold the keys. "There's a single point of failure whether it's Coinbase or yourself," Michael Tanguma, the co-founder and chief executive of bitcoin platform Onramp, said in an interview.

The Rush To The Poles

The first reflex has been flight to Wall Street. U.S. spot bitcoin ETFs took in $626 million in the days after the hack, according to Bitcoin Magazine. Bloomberg Intelligence ETF analyst Eric Balchunas posted that the exploit "could spur greater migration to ETFs," writing that what "used to be seen as a bug by coiners (dorky boomer TradFi) may all the sudden seem like a feature."