COLDCARD theft shows hardware wallets are a risk

Bitcoin holders have lost their assets to the very device that was supposed to protect them. They kept their bitcoin on a COLDCARD, a hardware wallet with an excellent reputation in the bitcoin world. Yet a flaw in the firmware made the seed phrase, the recovery phrase that gives full access to the stored assets, dangerously predictable. It allowed attackers to find vulnerable wallets and drain them.

That hits hard. The victims had not carelessly left their bitcoin on some obscure website. They had done their homework, moved their assets off an exchange, and done exactly what security experts had been advising for years: hold your own keys, on a good hardware wallet.

The theft, which now involves more than 1,300 bitcoin, is about more than COLDCARD. It exposes an uncomfortable truth: self-custody, holding your assets yourself, carries fatal risks of its own. In this case the device itself, on top of all the other links the owner has to keep under control for years on end.
 

With self-custody, you carry every risk yourself
If you hold your own bitcoin, you literally have the keys in your own hands. But the dependencies do not disappear. You still rely on the device, the firmware, and the quality of future updates. Open-source software makes independent review possible, but it does not prevent serious flaws from going unnoticed for years. The COLDCARD theft is painful proof.

A professional custodian also uses technology that clients generally cannot assess themselves. The difference is the organization around it. There, security does not rest on one device, one action, or one person. Technology is combined with specialized staff, segregation of duties, fixed procedures, continuous monitoring, and external audits.

If you manage your own vault, you have to build the entire security chain around it yourself. Backups must stay protected against fire, loss, and theft. Receiving addresses must be checked carefully. Phishing and counterfeit updates must be recognized. Illness, extortion, and death also require a solution that keeps working under pressure. One mistake can cost you your entire holdings.
 

More security can also mean more risk
After an incident like this, advice about extra layers of security quickly follows, such as using passphrases or multiple hardware wallets. Such measures can strengthen security. But they also add new keys, locations, backups, and recovery paths. Every extra step is another step that can go wrong, or that your heirs can misunderstand.

If you hold substantial bitcoin assets yourself, you are effectively running your own security operation. That operation has to keep working day and night, year after year. For many private investors, that is a heavier task than they realize when they buy a hardware wallet.
 

Professional custody is safer for many investors
A specialized custodian is built to carry this responsibility.

Amdax holds a MiCAR license, with the supervision that comes with it, for the custody of crypto assets. Client balances are always held in full and legally segregated from Amdax's own assets. Key controls around custody, administration, access management, and incident handling are additionally examined in rigorous, far-reaching audits. On top of that, our clients can set personal verifications and withdrawal conditions.

Risks never disappear entirely. But they are managed professionally and made verifiable. For people with serious bitcoin holdings, that is often safer than placing all responsibility on one device and one person.
 

Using a COLDCARD?
Check which model and which firmware version your seed phrase was originally created with. If that combination turns out to be vulnerable, proceed carefully:

• create a completely new seed phrase in a secure location;
• verify the new receiving address on the device itself;
• send a small test transaction first, then move the remaining balance;
• never share your seed phrase, private key, or full passphrase with anyone.
   

How to deposit bitcoin at Amdax
If you decide to hand over custody entirely, you do not need to create a new seed phrase. You send your bitcoin straight to your deposit address at Amdax. It works like this:log in to your Amdax account and go to Vault;

• choose 'Deposit', then 'Crypto assets';
• select bitcoin. The first time you deposit, a deposit address is created and permanently linked to your account;
• copy this address and paste it into the wallet you are sending from;
• here too, send a small test transaction first, then the remaining balance.

Once the transaction is confirmed on the blockchain, your bitcoin appears in your account. You can only deposit from a wallet that is registered in your name and under your control. Not a client yet? Open an account first through the website or the app. Questions? Our support team and your relationship manager are happy to help.

The COLDCARD theft is a good moment to reassess your custody setup. Does the responsibility still fit the size of your assets, your knowledge, and your personal situation? Amdax is happy to help you think it through. Schedule an appointment with one of our relationship managers.

Please note: investing in crypto assets involves risks. You may lose all or part of your investment. Please be aware of this and stay informed about the risks.