Casa CEO Nick Neuman said recent onchain data tied to the Coldcard firmware exploit points to a broader lesson for Bitcoin: self-custody can make the asset more resilient by limiting the damage from any single breach.
In an Aug. 9 post on X, Neuman cited Checkonchain figures showing that in the days after the Coldcard hack, about 22,000 BTC moved to exchanges and 233,000 BTC left long-term holder wallets in onchain transactions. The theft itself involved roughly 2,100 BTC.
「The onchain metrics around the Coldcard incident reinforce how important self-custody is to the resilience of Bitcoin as an asset class,」 Neuman wrote.
Loss estimates range from 1,700 BTC to more than 2,000 BTC
Galaxy Research has tracked confirmed losses from the Coldcard entropy flaw at as low as 1,700 BTC, with estimates running to more than 2,000 BTC. The stolen coins have been followed across multiple waves of attacks starting July 30, and higher-end estimates approach $130 million.
The vulnerability stemmed from a firmware issue dating back to March 2021 that weakened seed generation on certain Coldcard models.
Some holders moved from single-key wallets to multisig
Neuman said Casa’s own conversations with customers suggest part of the 233,000 BTC movement came from holders reassessing single-key risk and shifting from non-Coldcard single-key setups, such as Ledger or Trezor, into multisig wallets.
Other flows came from existing multisig users removing Coldcard devices from their keysets.
「So somewhere between ~10x-100x the amount of bitcoin stolen was moved to safety as people sounded the alarm,」 he wrote.
He added: 「This is a giant flashing neon sign showcasing the resilience that self-custody adds to the network.」
Neuman contrasts the episode with a custodian hack
Neuman argued that the pattern would likely have looked very different if the same bitcoin had been held with a centralized custodian. In that case, he said, only a limited amount of funds might have escaped while the bulk could have been lost in one event.
「If all that BTC was held at a custodian and the custodian was hacked instead, those numbers would have been flipped,」 Neuman said. 「As it was, the thieves had to crack one wallet at a time (and are still going), earning a little BTC each wallet, instead of cracking one wallet and getting a massive payday.」
His conclusion was that self-custody helps individual holders and also supports the Bitcoin network by spreading risk and preserving confidence.
Coldcard incident revives debate over wallet design
Casa, founded in 2018, offers multisignature vault products aimed at higher-value holders and institutions looking for practical self-custody. Bitcoin Magazine noted that it has previously covered the company’s multisig products and Neuman’s views on sovereignty and institutional adoption.
The Coldcard incident has reopened discussion across the industry around single-signature hardware wallets, seed generation practices, the trade-offs between multisig and emerging covenant-based vault designs, and the risks tied to specific devices.
The onchain data cited by Neuman suggests that, whatever the technical shortcomings of a given device, holders’ ability to move funds independently helped contain the systemic impact.
