Bitcoin’s promise of self-custody has always rested on a compelling proposition: Investors do not need to trust a bank, exchange or government to protect their assets. A major security incident reported this week involving Coldcard hardware wallets, however, has changed the risk calculus among firms weighing crypto’s four custody models.
Attackers exploited a flaw affecting older versions of firmware used by Coldcard, a popular bitcoin hardware wallet made by Coinkite. The vulnerability weakened the randomness used to create some wallets’ recovery phrases, making the private keys derived from them potentially discoverable. Estimates of the losses have continued to rise as researchers identify additional affected addresses, with recent reporting placing the total north of $100 million across more than 5,000 individual wallets.
The incident did not break bitcoin’s encryption or reverse transactions on its blockchain. It wasn’t a wrench attack where attackers stole a physical device, tricked its owner into revealing a password or installed malware on an internet-connected computer. Instead, the failure occurred at the point of a supposedly secure device.
The problem is that bitcoin transactions are final whether the owner authorized them or not. Bitcoin’s network worked exactly as designed. The attackers presented valid keys, and the blockchain processed valid transactions.
See more: AI Collapses Exploit Window in Crypto Wallet Hack
Custody Becomes the Product for Institutional Digital Assets
Self-custody protects users from institutional failure, account freezes and intermediary misuse. But the Coldcard incident demonstrates that it also concentrates technical due-diligence and loss responsibility on individuals who may have no practical means to verify the cryptographic process securing their assets. For institutional investors, custody is becoming less about where private keys are stored and more about how access to them is governed.
True redundancy may require independent hardware vendors, separately generated keys, distinct software implementations and documented recovery procedures. That is expensive and operationally burdensome. It is also why institutional custody providers compete on policy engines, audit trails, insurance arrangements and governance rather than simply promising to keep assets offline.
The custody product is no longer the vault. It is the system deciding when the vault can be opened. No individual, device or system should be able to move assets independently.
The collapse of several crypto companies, most notably FTX and Celsius, in recent years has demonstrated the danger of allowing an institution to commingle assets, obscure liabilities or operate without sufficient controls. The sector’s defining slogan of “not your keys, not your coins” emerged from real failures, not ideology alone.
Also last weekend, blockchain network Wemix announced that an attacker had compromised ownership of its WEMIX$ stablecoin, while cryptocurrency wallet SecondFi last month said it would begin winding down following a breach that allowed attackers to steal $2.4 million.
More here: The Stablecoin Sandwich Is Missing the Trust Layer
ETFs Offer Bitcoin Custody Without Operational Control
The Coldcard failure exposed the danger of treating offline storage as the end of the security discussion. A device disconnected from the internet can still generate a vulnerable key. Open-source software can still contain a flaw. Assets can still disappear without the device ever leaving a safe.
That is what makes the Coldcard crypto incident consequential for institutional custody. It shows that the most important security questions sit outside the blockchain—in the hardware, software, governance and operational controls determining who can produce a valid signature.
“It’s very reminiscent of what happened in the early 2000s with payment innovators,” Citi Global Head of Digital Assets, Treasury and Trade Solutions Ryan Rugg said during a recent episode of “From the Block,” the PYMNTS podcast. “Initially, people thought they were going to put banks out of business. Instead, they ended up running on bank rails.
“Removing reliance on intermediaries can help with improving on speed and fiat settlement,” Rugg said in a separate episode of the podcast, stressing that regulators and industry participants will need clarity on how the new account works, how it will be supervised and how operations will function.
The Coldcard attack may also strengthen the case for spot bitcoin exchange-traded products among investors seeking price exposure rather than direct control of digital assets. A bitcoin ETF does not give an investor the ability to transfer bitcoin, settle a transaction on-chain or use the asset as collateral outside traditional financial infrastructure. The investor owns a security whose value tracks bitcoin, not bitcoin that can be withdrawn to a personal wallet.
Data in “Waiting for Certainty: Why Most CFOs Are Holding Back on Crypto and Stablecoins,” a recent installment of PYMNTS Intelligence’s 2026 Certainty Project, shows that most middle market companies remain cautious about digital assets: 13% of firms use stablecoins and just 5% use other cryptocurrencies.
