CZ urges wallet diversification after $70M Coldcard exploit

Binance founder Changpeng Zhao urged crypto holders to spread their funds across multiple wallets after a firmware flaw in Coldcard hardware wallets allowed an attacker to drain approximately $70 million in Bitcoin over the span of roughly 40 minutes.

"Even hardware wallets can have bugs. Even old wallets (with long history) can have bugs," Zhao wrote on X on Saturday. "How to mitigate? Split your funds in a few wallets maybe? This has a different set of risks. Nothing is 100%. Stay informed. Stay SAFU!"cryptonews+1

The Attack

The theft began on July 30 when an attacker exploited a flaw in how certain Coldcard models generated their cryptographic keys. Initial on-chain analysis identified roughly 594 bitcoin — about $38 million — swept from around 500 wallets in a 25-minute window, according to CoinDesk. Subsequent research by Galaxy Digital expanded the scope to 1,082 bitcoin, valued at approximately $70 million, taken from 1,196 addresses over about 41 minutes.coindesk+2

The vulnerability traced back to firmware version 4.0.1, released in March 2021, which caused seed generation to fall back to a weak software pseudorandom number generator rather than the hardware's true random number generator. This made private keys for single-signature wallets predictable enough for an attacker to reconstruct offline, according to Bitcoin Magazine. Many of the affected wallets had been dormant for years.bitcoinmagazine+1

Coinkite Responds

Coldcard maker Coinkite initially said the flaw affected Mk3 devices but later acknowledged that all models were vulnerable after additional thefts surfaced, according to Forbes. The company released emergency firmware updates and advised affected users to generate entirely new seeds on patched devices and carefully migrate funds.forbes

"Updating the firmware does not repair a seed that was generated by affected firmware," Coinkite wrote. "A new seed must be generated and the funds migrated to the new wallet."forbes

Engineers at Block, the payments company founded by Jack Dorsey, said they identified that the attacker likely used a paid account at a blockchain services provider to query target addresses during the sweeps.bitcoinmagazine

Broader Implications

The episode has renewed debate over the limits of self-custody in cryptocurrency. Hardware wallets are widely considered among the strongest options for securing digital assets offline, yet the Coldcard case demonstrates that even long-established devices can harbor undetected flaws for years. Zhao's call for diversification acknowledges the tradeoff: splitting funds reduces single-point-of-failure risk but introduces more complex key management.tradersunion+1

Galaxy Digital's research arm advised Bitcoin holders to move funds out of single-signature Coldcard addresses and into more secure custody arrangements.bitcoinmagazine