CZ Urges Crypto Users to Diversify Wallets After $70M Coldcard Hack

Binance founder Changpeng Zhao (CZ) has warned that even hardware wallets are not immune to vulnerabilities, urging crypto users to spread their holdings across multiple wallets in the wake of a major Coldcard security breach.

In a post on X, CZ reacted to reports of the theft, noting that both new and long-standing hardware wallets can contain hidden bugs. He suggested that diversifying funds across several wallets may help reduce risk, while also acknowledging that no security approach is foolproof and each comes with its own trade-offs.

The incident stems from a firmware flaw dating back to March 2021, which weakened the randomness used in generating recovery seeds on certain Coldcard devices. This allowed attackers to reconstruct private keys offline and access funds without needing physical possession of the wallets.

Early blockchain data indicated that around 594 BTC—worth about $38 million at the time—was drained from roughly 500 wallets within a 25-minute span on July 30. Later analysis by Galaxy Research revealed a larger impact, with 1,082.65 BTC, valued near $70 million, taken from 1,196 addresses over approximately 41 minutes. Many of the affected wallets had been inactive for years.

Coldcard manufacturer Coinkite has since confirmed the vulnerability, issued an apology, and rolled out urgent firmware updates. The company advised users who created seeds using affected versions to generate entirely new ones on updated devices and securely transfer their funds, warning that simply updating the firmware does not fix previously compromised seeds.

The breach has reignited discussions around the limitations of self-custody. While hardware wallets are generally considered one of the safest methods for storing bitcoin offline, the Coldcard incident highlights that even well-established devices can carry undiscovered risks for extended periods. CZ’s call for diversification underscores a broader point: reducing risk often involves added complexity, particularly when managing multiple wallets and private keys.