Coldcard's $38 million (so far) exploit shakes faith in self-custody, may push investors to ETFs

A major flaw in Coldcard, a popular hardware wallet maker, has shaken confidence in self-custody and prompted some investors to consider alternatives like ETFs. Coinkite, the maker of Coldcard, issued an open letter urging affected users to generate new wallets and transfer their funds before reading further. The vulnerability allowed attackers to recreate wallet recovery phrases and steal bitcoin from what users believed were secure self-custodied wallets.

Despite the patch, users must now generate entirely new wallets and move their funds, as updating the firmware alone does not eliminate the risk. This incident exposes the growing tension between self-custody and the technical burden of securing private keys, which may push ordinary investors toward professional custodians, exchanges, and regulated investment products.

Some prominent bitcoin advocates consider the exploit among the most damaging failures of self-custody in the industry's history. The self-custodial hardware space is now seen as a source of bad reputation for the industry. The incident also underscores the evolving nature of cybersecurity threats, with artificial intelligence lowering the cost of discovering software vulnerabilities.

As a result, bitcoin holders may increasingly need to either constantly monitor threats themselves or rely on professional custodians with dedicated security teams.