A severe flaw in how Coldcard hardware wallets handled entropy has led to Bitcoin losses and cast doubt on one of crypto’s longest-standing assumptions: that self-custody offers the strongest line of defense for user funds. Even so, experts speaking at Bitcoin Asia said the answer is not a return to custodial platforms. Their view was that centralized exchanges still expose users to greater counterparty risk than a device-level bug, and that self-custody remains the better option if security practices are upgraded.
A firmware failure described as a “9/11 moment” for self-custody wallets
Participants described the incident as a “9 11 event” for self-custody wallets. The report said the problem came from a deep firmware bug that had remained hidden for five years. When the device linked to an entropy-related library, an operational mistake during a code migration from Python to C unintentionally disabled the built-in secure random number generator, or RNG.
That error caused the wallet, while generating private keys, to fall back without warning to a highly insecure replacement algorithm. As a result, the original 256-bit cryptographic entropy was reduced to just 22 bits. For affected Coldcard Mk3 devices, private-key security dropped sharply, making it much easier for attackers to derive keys through computation.
All known losses in the incident involved BTC. Some of the stolen funds that were moved on-chain have remained dormant for as long as five years, which the report cited as evidence that attackers had known about the vulnerability early and used it to target early Bitcoin holders on a broad scale.
An early warning was made, but no timely fix followed
Security researcher James O Beirne had warned the manufacturer a year before the incident, according to the report. But the warning did not turn into a timely patch. The article linked that failure to weak internal processes, including the absence of strict code review, no bug bounty mechanism, and management issues tied to code licensing changes.
At Bitcoin Asia, the flaw was discussed not only as a technical mistake but also as a maintenance and governance failure. Because hardware wallets sit at the center of the self-custody model, a long-running firmware issue can directly undermine trust in the broader security assumptions users rely on.
Multi-vendor multisig was presented as the clearest safeguard
During panel discussions, participants broadly agreed that a multi-vendor multisig structure is the most effective way to protect crypto holdings against a single point of failure in wallet firmware.
Multisig requires authorization from several independent private keys before a transaction can be completed. The multi-vendor part means mixing hardware devices from different manufacturers, with the report giving Coldcard, Bitkey, and Frostsnap as examples. Under that setup, even if one device generates a low-entropy key because of a firmware defect, the system as a whole can still rely on extra entropy and separate verification from the other vendors’ devices.
Experts also pointed to newer tools aimed at reducing operational complexity for users. One example was Liana, or Liana Bitcoin, which offers a flexible interface and a “Time-Decay Passphrase” feature. The setup lets a user pair a single seed phrase with a custom passphrase, and if it is not reset within a defined period, transaction authority changes automatically, adding theft protection.
Other options include collaborative custody multisig services from Unchained and Casa, where a third party helps hold one of the keys. The report said only about 1% of the roughly 5 million hardware wallet users worldwide currently use multisig. Still, experts urged users to follow the principle of “Don’t trust, verify” and combine passphrases with multisig to limit the damage a single-device flaw can cause.
AI-based auditing is moving into the security workflow
The Coldcard incident damaged confidence in self-custody hardware, but it also pushed Bitcoin developers to revisit security priorities. The report said many teams have paused new feature work and shifted resources toward broad reviews of existing codebases and tighter scrutiny of legacy software.
That shift has helped bring “AI agents” into code-audit workflows. In the account cited by the article, AI can scan tens of thousands of lines of historical code far faster than human engineers and identify buried logic mistakes and downgrade-style vulnerabilities earlier. The goal is to remove security risks that might otherwise stay hidden for years.
Open-source projects have long depended on manual peer review, but large code migrations have exposed clear staffing limits. AI-assisted tools, the report said, can support continuous automated scanning at the commit stage and check whether security claims match firmware integrity. The broader result is a faster push toward standardized AI auditing across blockchain infrastructure development.
Why experts still put self-custody ahead of custodial platforms
Despite the scale of the losses, panelists said users should not respond by moving assets back to centralized exchanges or other custodial services. Their argument was straightforward: centralized operators create counterparty risk. Funds can be misused, internal misconduct can occur, and users may run into liquidity problems when they try to withdraw.
The report pointed to the history of Mt. Gox and FTX as examples where losses tied to centralized platform failures exceeded the damage caused by individual hardware wallet firmware bugs. By contrast, self-custody offers stronger asset isolation. If a defect appears in one hardware wallet model or in a specific software-hardware version combination, the fallout is usually contained to that scope rather than spreading into a system-wide collapse across the crypto ecosystem.
In that sense, the Coldcard episode has raised security awareness across the market and pushed both hardware and software makers to improve multisig configurations and backup design. The conclusion from the experts cited in the report was not that self-custody has failed, but that it now needs stricter implementation. With those safeguards in place, they said, self-custody remains the best way to retain control of digital assets.