Binance founder CZ calls for wallet diversification after $70 million Coldcard exploit

Following a major security exploit affecting Coldcard hardware wallets, Binance founder Changpeng Zhao (CZ) has urged cryptocurrency holders to diversify the wallets they use rather than focusing solely on diversifying coins. This advice came after a firmware vulnerability dating back to March 2021 was exploited to steal bitcoin from users’ Coldcard devices without any physical access to the hardware. The flaw weakened the randomness used to generate recovery seeds, allowing the attacker to reconstruct private keys offline and drain funds.

Initial reports on July 30 revealed that approximately 594 bitcoins, valued at about $38 million at the time, were stolen from roughly 500 wallets over a 25-minute period. However, a more detailed analysis by Galaxy Research increased the estimate to around 1,082.65 bitcoins—worth approximately $70 million—taken from 1,196 wallets over about 41 minutes. Many of these wallets had been inactive for years. Coldcard’s manufacturer, Coinkite, acknowledged the bug, apologized, and released emergency firmware updates. They have advised users whose wallets are affected to generate new seeds on updated devices and migrate funds carefully, as simply updating firmware does not secure previously generated vulnerable recovery seeds.

This breach highlights ongoing concerns about the risks associated with self-custody, even when using hardware wallets, which are generally regarded as among the safest methods to store bitcoin offline. The incident demonstrates that even well-established and long-used devices can contain serious, previously undetected vulnerabilities. CZ’s recommendation to split funds across multiple wallets aims to mitigate such risks but also introduces additional complexity in managing multiple keys and wallets. The Coldcard exploit thus underscores the importance of remaining vigilant and informed in the evolving landscape of crypto asset security.