Coldcard Flaw Steals $38M in Bitcoin, Fuels ETF Shift
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- Coinkite disclosed a firmware flaw in its Coldcard hardware wallet that allowed attackers to recreate wallet recovery seeds, leading to the theft of roughly 600 bitcoin (~$38 million) — one of the largest self-custody failures on record.
- Coinkite CEO NVK issued an open letter instructing affected users to generate entirely new wallets and move funds, warning that patching the firmware does not protect seeds already generated on vulnerable versions.
- ARK Invest's Lorenzo Valente called the self-custodial hardware space 'a disaster,' arguing consumers have traded counterparty risk for software, hardware, supply-chain, and phishing risk and are better off holding funds across public exchanges or ETFs.
- Casa CEO Nick Neuman criticized Coinkite's recommended workaround — supplementing wallet randomness with physical dice rolls — saying 'you just can't ask people to roll dice to be secure with your self custody' and calling it 'a non-starter for 99% of people.'
- Blockaid data cited in the article shows most crypto losses in the first half of 2026 stemmed from compromised keys and operational security failures rather than smart contract hacks, with Coldcard fitting that key-generation-stage pattern.
- Amicus co-founder David Lawrence predicted the incident will steer new investors toward regulated products such as BlackRock's iShares Bitcoin Trust (IBIT), declaring the dream of '8 billion people' holding bitcoin in cold storage 'over. Done.'
- Taproot developer Udi Wertheimer argued that security is no longer a set-and-forget task in the age of AI-driven vulnerability discovery, writing that bitcoin holders must either constantly monitor threats themselves or pay professional custodians to do so.
Why it matters: Roughly $38 million in bitcoin was drained through a firmware-level vulnerability that bypassed the core promise of hardware wallets, and the remediation — dice-roll entropy plus full wallet migration — is impractical enough that industry voices from ARK Invest, Casa, and Amicus are openly steering retail users toward ETFs and regulated custodians instead. The shift matters because Coldcard was long treated as the gold standard for 'properly secured' self-custody, and its compromise undermines the ideological foundation that has sustained Bitcoin's not-your-keys-not-your-coins ethos for over a decade.
