- CZ says no crypto wallet is fully safe and urges users to divide funds across devices.
- Coldcard’s seed flaw exposed 1,082.65 BTC across 1,196 wallet addresses in 41 minutes.
- Multi-wallet security limits losses with separate seeds but complicates recovery.
Changpeng Zhao has questioned whether any single crypto wallet can provide complete protection after a Coldcard flaw exposed weaknesses inside seed generation. “Nothing is 100%,” Zhao wrote on X on August 1, urging users to divide funds across several wallets rather than trust one device.
His comments followed a Bitcoin theft linked to predictable seed creation, showing that offline storage can fail before a wallet ever signs a transaction. The incident shifted attention from device theft and phishing toward failures hidden inside firmware, randomness, and recovery design.
Coldcard Seed Flaw Exposes Hardware Wallet Security Limits
Early reports estimated that attackers removed about 594 BTC from roughly 500 wallets during a 25-minute period. However, Galaxy Research later raised the total to 1,082.65 BTC, worth $70 million, across 1,196 addresses in 41 minutes.
Block’s Bitcoin security team subsequently traced the exposure to a firmware integration error affecting how some Coldcard devices generated wallet seeds. Instead of always relying on hardware-generated randomness, affected software could use a predictable fallback under certain conditions.
That weakness allowed an attacker to reconstruct possible private keys remotely without stealing a device or obtaining a recovery phrase. Therefore, the security failure occurred at wallet creation, not during storage or transaction approval.
Coinkite warned that seeds produced on affected Mk3 firmware and older Mk4, Mk5, and Q releases may be vulnerable. Although patched firmware was released, existing weak seeds cannot be repaired through an update.
As a result, affected users must generate a fresh seed and move their Bitcoin, given that the original private keys may remain discoverable. The case demonstrates why crypto wallet security depends on more than keeping a device offline.
Multi-Wallet Security Reduces Risk but Adds Recovery Challenges
Meanwhile, multi-wallet security reduces concentration risk by separating funds across independent seeds, devices, vendors, and intended uses. As a result, a compromised wallet would then expose only part of a portfolio.
For instance, users can keep daily spending funds in a hot wallet, reserves on hardware, and larger balances behind multisig controls. However, copying one seed across several devices does not create real diversification.
Independent seeds, therefore, are necessary, while different hardware or software implementations can further reduce shared failure points. Even then, more wallets create additional recovery phrases, address checks, firmware updates, transfer fees, and inheritance instructions.
Hence, poor records can turn security diversification into permanent loss when owners forget balances or heirs cannot locate backups. For retail holders, simplicity remains essential despite the advantages of layered storage.
Institutions generally require stronger safeguards as they manage larger balances and involve multiple decision-makers. These controls often include multisig or multi-party computation, separate approvers, geographically distributed keys, withdrawal policies, and regularly tested recovery procedures.
Similarly, NIST identifies backup, authorization, inventory, recovery, and compromise response as central elements of cryptographic key management. These measures reinforce the broader principle that secure custody depends on coordinated processes, rather than one supposedly flawless device.
Overall, Changpeng Zhao’s warning does not establish multi-wallet security as a perfect solution. Instead, the Coldcard incident shows that resilient self-custody requires a structure capable of limiting losses when one component fails.
Related: CZ Issues New Warning as Exchange Shutdowns Fuel Custody Debate
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
