Binance founder Changpeng Zhao is urging Bitcoin holders to reconsider how they store their coins after a firmware vulnerability in Coldcard hardware wallets led to roughly $70 million in losses. Galaxy Research determined that 1,082.65 BTC was drained from 1,196 addresses over about 41 minutes on July 30, up from an initial estimate of 594 BTC (roughly $38 million) across some 500 wallets in a 25-minute window.
Responding on social media, Zhao wrote: "Even hardware wallets can have bugs. Even old wallets (with long history) can have bugs. How to mitigate? Split your funds in a few wallets maybe?"
No perfect solution, CZ acknowledges
Zhao was careful to note that spreading funds across multiple wallets is not a cure-all. He said the approach carries a "different set of risks" of its own — more addresses to manage, more surface area for user error — before adding, "Nothing is 100%." He closed his post with Binance's long-running rallying phrase, "Stay SAFU!"
The flaw behind the losses
The underlying issue traces back to a firmware defect introduced in March 2021, which caused seed generation on certain Coldcard models to compromise the randomness of recovery seeds. Rather than needing physical access to a victim's device, the attacker was able to reconstruct private keys offline once the weak randomness pattern was understood.
Coldcard maker Coinkite has acknowledged the bug, pushed emergency firmware updates, and is advising affected users to generate entirely new seeds on patched devices rather than assume an update alone secures funds tied to a seed generated before the fix.
A reminder that self-custody has its own risks
Many of the compromised wallets had sat untouched for years, a detail that has renewed debate over how much trust holders should place in any single piece of hardware, no matter how established. CZ's suggestion to diversify storage echoes advice long given around exchange custody, now being applied to the self-custody side of the industry as well.
