Changpeng Zhao, founder of Binance, issued a stark warning to Bitcoin holders following a significant Coldcard hardware wallet exploit that drained approximately $70 million in BTC. Galaxy Research raised the damage estimate from initial figures, highlighting the severity of the vulnerability.
Zhao emphasized that no security system offers complete protection. "Nothing is 100%," he stated, advocating for portfolio diversification across multiple wallets as a risk mitigation strategy. The warning underscores a persistent challenge in crypto custody, where even established hardware wallet manufacturers face critical exploits.
The Coldcard vulnerability exposed a flaw allowing attackers to extract private keys from compromised devices. Victims lost significant holdings through this attack vector, demonstrating that hardware wallets, long marketed as the gold standard for self-custody, remain subject to sophisticated exploitation techniques.
Galaxy Research's revised $70 million figure reflects the full scope of affected addresses traced on-chain. The exploit affected numerous users who stored Bitcoin on Coldcard devices, ranging from retail holders to larger accumulation accounts.
The incident reinforces Zhao's multi-wallet approach strategy. By distributing holdings across multiple independent custody solutions, users reduce exposure to any single point of failure. This diversification principle applies whether users employ hardware wallets, cold storage, or other custody mechanisms.
The exploit arrives amid broader industry scrutiny over self-custody security practices. While hardware wallets remain superior to exchange custody for most users, the Coldcard incident demonstrates the technical sophistication required to maintain truly secure Bitcoin holdings. Supply chain attacks, firmware vulnerabilities, and physical device compromises represent ongoing attack surfaces that no single solution completely eliminates.
Zhao's comments carry weight given Binance's focus on custody solutions and exchange security infrastructure. His public acknowledgment that "nothing is 100%" contradicts oversimplified marketing narratives around hardware wallet invulnerability.
For Bitcoin holders, the takeaway aligns with long-standing protocol principles: implement defense-in-depth strategies, maintain operational security discipline, and avoid concentrating assets in single custody solutions. The Coldcard exploit serves as a concrete reminder that hardware