Binance Founder CZ Sounds Alarm on Wallet Risks Post $70M Coldcard Incident

Binance founder Changpeng Zhao (CZ) has warned that hardware wallets are not immune to vulnerabilities, urging crypto users to spread their holdings across multiple wallets following a major Coldcard exploit.

Writing on X, CZ stressed that even well-established wallets can contain undiscovered flaws. He suggested diversifying funds to limit risk, while noting that no security setup is perfect and that using multiple wallets introduces its own challenges.

The breach is linked to a firmware bug dating back to March 2021, which weakened the randomness used to generate recovery seeds on certain Coldcard devices. This flaw enabled attackers to recreate private keys offline, allowing them to access funds without ever physically handling the wallets.

Initial on-chain data indicated that around 594 BTC—worth roughly $38 million at the time—was drained from about 500 wallets within a 25-minute span on July 30. Subsequent analysis by Galaxy Research expanded the масш of the attack to 1,082.65 BTC, or approximately $70 million, taken from 1,196 addresses over about 41 minutes. Many of the affected wallets had remained dormant for years.

Coldcard manufacturer Coinkite has since acknowledged the issue, apologized, and released emergency firmware updates. The company advised users who created seeds on affected versions to generate entirely new ones on updated devices and carefully transfer their funds, warning that updating firmware alone does not secure previously compromised seeds.

The incident has renewed debate over the limits of self-custody. Although hardware wallets are widely considered one of the safest ways to store bitcoin offline, the Coldcard case highlights that even trusted devices can harbor critical vulnerabilities over long periods. CZ’s call for diversification underscores a key trade-off: reducing risk often comes at the cost of greater complexity in managing multiple wallets and private keys.