Coldcard drain nears $89m, reviving debate over Bitcoin self-custody risk
A widening estimate of losses from a Coldcard wallet flaw has Bloomberg's Eric Balchunas arguing regulated Bitcoin ETFs offer safer exposure.
The estimated cost of a security failure in Coinkite’s Coldcard hardware wallet has climbed to roughly $88.6m in traced Bitcoin, according to fresh figures from Galaxy Research, reigniting a long-running dispute over whether self-custody or regulated exchange-traded products offer better protection for large Bitcoin holdings.
Galaxy’s on-chain investigators say they have now identified 1,367.05 BTC drained across 4,585 addresses in what appears to be three separate attack waves, the most recent of which removed 207.7294 BTC from 1,912 addresses using a distinct transaction pattern. The firm describes the $88.6m figure as an “estimated observed size” rather than a confirmed final total, noting that Coinkite and law enforcement have not independently verified the sum.
Firmware flaw traced to entropy failure
Block’s Bitcoin engineering team, which examined the underlying cause, found that a firmware integration error routed the device’s random-number generation through a deterministic MicroPython fallback rather than its intended hardware source. According to the team’s findings, Mk2 and Mk3 devices running the affected firmware added no genuine cryptographic entropy through that pathway, while later models relied on a more limited secure-element reseed.
Coinkite’s own security advisory covers Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, as well as seeds generated on Mk4, Mk5 and Q devices prior to their patched releases. The company has issued corrected firmware, but has warned that installing an update does not retroactively secure seeds generated before the fix — affected users must generate entirely new seeds and migrate their holdings.
Balchunas: incident bolsters the ETF case
Bloomberg Intelligence’s senior ETF analyst, Eric Balchunas, argued on 2 August that the episode strengthens the case for US spot Bitcoin exchange-traded funds among investors seeking price exposure without the operational burden of managing private keys. “Yes, an ETF fixes this,” he wrote, while acknowledging the irony that some self-custody advocates dismiss ETF-held Bitcoin as “paper bitcoin.”
Balchunas also questioned whether a hardware-wallet manufacturer of Coinkite’s reported size should be entrusted with safeguarding sums that can be life-changing for individual holders, calling the reported staffing level “a red flag.” Coinkite has not publicly confirmed the headcount referenced in his comments, and firm size alone does not determine the adequacy of a security architecture.
Crucially, Balchunas’s remarks reflect his own view on the merits of custodial versus self-custodial structures rather than evidence of any measurable shift in ETF flows. His comments were posted over the weekend while US markets were closed, meaning there is no verified data yet showing investors reacting by moving capital into ETF products.
A recurring test for institutional custody standards
The episode adds to a broader pattern of hardware-wallet failures that have periodically unsettled confidence in self-custody, even as regulators and institutional allocators continue weighing the trade-offs between direct ownership and third-party custodianship. ETF holders forgo direct control of their coins, along with the ability to transact peer-to-peer or interact with the Bitcoin network directly, in exchange for regulated custodial infrastructure and, per Balchunas, comparatively low fees relative to services such as Coinbase or Ledger.
For European regulators and institutional investors monitoring digital-asset custody standards, the Coldcard case underscores that entropy failures and firmware bugs remain a persistent operational risk even in dedicated security hardware — a factor likely to feature in ongoing discussions around custody requirements for regulated crypto products.
Read more: Coldcard hardware wallet theft estimate nearly doubles to $70m, testing custody assurances
