Is Bitcoin Self-Custody Dead? Inside The Coldcard Hack

On July 30th, attackers began draining bitcoin from addresses linked to seeds generated by compromised “cold storage” wallets. The devices, called Coldcards, were manufactured by Coinkite, and were widely viewed as the best choice for those who are paranoid in the extreme about cybersecurity. The fact that it was Coldcard and not some other device that fell victim to this hack rocked the bitcoin world at its foundations.

Galaxy Research tracked at least 15 different attackers who have stolen about 2,000 bitcoins worth about $130 million from 4,385 addresses in just a few hours. The speed and scale of the attack amounted to the worst disaster in bitcoin’s history.

The obvious question after such a catastrophe is whether self-custody itself has failed. Self-custody is promoted by bitcoin enthusiasts because it protects against institutional corruption and counterparty risk. But with this great power comes great responsibility – namely, to be 100% sure that the hardware and software one uses for self-custody of bitcoin is not itself compromised.

Financial sovereignty remains worth pursuing, because custodial risk remains very real. However, the bitcoin community is now coming to terms with the fact that it takes much more technical skill on the part of individuals to be sure their bitcoin is safe in their own custody – an idea that cuts against the notion that anyone, no matter their age, location, or background, can be sovereign over their digital property.