Binance founder Changpeng Zhao (CZ) has called on cryptocurrency holders to split their funds across multiple wallets following a staggering $70 million exploit of Coldcard hardware devices, according to CoinDesk. The breach, disclosed in late July, exploited a firmware vulnerability dating back to 2021 that compromised the randomness of recovery seeds on specific Coldcard models, allowing attackers to reconstruct private keys offline and drain funds without ever touching the hardware.
The $70M Coldcard Exploit Detail
The theft was first detailed by Galaxy Research in a report on Bitcoin Cold Wallets Drain $70M in Attack That Never Touched Hardware, Galaxy Research Reveals. The flaw, present in certain Coldcard firmware versions since March 2021, undermined the entropy used to generate wallet seed phrases, making it possible for attackers with the capability to derive private keys mathematically. The exploit occurred silently, with no signs of physical tampering, shaking confidence in the very devices designed to offer top-tier security.
The severity prompted an immediate reaction from Coinkite, the maker of Coldcard. In a separate incident covered by BTC-Pulse, Coinkite CEO Tells Coldcard Users to ‘Move Your Funds Now’ Amid Security Alert, BOJ Keeps Rate, the company urged users to migrate funds out of affected wallets. That warning foreshadowed the later discovery of the $70 million coordinated attack, underscoring how quickly flaws can be exploited once identified.
This is not the first time the same firmware weakness has been linked to massive losses. Earlier this year, a related bug drained Coldcard Firmware Bug Drains 594 BTC in 25 Minutes, $38 Million Stolen, showing that the vulnerability had already been exploited in a separate, high-speed heist. The $70 million event now represents the largest documented exploit of the Coldcard platform, further highlighting the risks of relying on a single wallet regardless of its reputation.
CZ’s Diversification Call and Industry Impact
In a statement shared on social media, CZ emphasized that even hardware wallets can have bugs and that no single storage solution is 100% safe. “Split your funds in a few wallets maybe? This has a different set of risks. Nothing is 100%. Stay informed. Stay SAFU!” he wrote, referencing Binance’s Secure Asset Fund for Users. His advice marks an industry shift—where once diversifying crypto assets meant spreading across different coins, now it means diversifying the wallets themselves to mitigate compromise of any one device or provider.
The Coldcard exploit has reignited long-standing debates about the trade-offs between convenience and security in self-custody. While hardware wallets remain essential for large holdings, the incident demonstrates that even air-gapped devices are not immune to software flaws. For users, CZ’s recommendation of multi-wallet strategies—combined with keeping firmware updated and monitoring developer alerts—may become the new baseline for personal security in Bitcoin and beyond.
