Exchange or Hardware Wallet: What a 2026 Coldcard Incident Shows About Where Crypto Gets Stolen
A $116 million Coldcard hardware wallet exploit shows self-custody isn't automatically safer than an exchange - it relocates risk instead.
“Not your keys, not your coins” is the standard argument for self-custody over keeping funds on an exchange. It’s directionally correct — exchange collapses have wiped out customer funds repeatedly — but a 2026 hardware wallet exploit is a useful, uncomfortable reminder that self-custody doesn’t eliminate theft risk. It relocates it to a different point of failure, and that point can fail just as badly.
What happened
According to TRM Labs’ analysis, a firmware bug in Coldcard hardware wallet version 4.0.1, released in March 2021, caused affected devices to fall back on a weak software random number generator instead of the device’s dedicated hardware entropy source when generating a new seed phrase. That weakness reduced effective key strength from a secure 128 bits down to as little as 40 bits in the worst cases — weak enough to brute-force without ever physically touching the victim’s device.
The vulnerability sat undetected for years. Exploitation began July 30, 2026, in four coordinated waves over several days, draining approximately 1,816 BTC — about $116 million at the time — from more than 5,200 addresses whose seeds had been generated on the flawed firmware version, reported by Fortune.
Why updating the firmware wasn’t enough
The detail that makes this incident more than an isolated bug report: patching the firmware after discovery does not protect wallets that already generated a seed under the flawed version. A weak seed, once generated, stays weak — the private keys derived from it are permanently compromised regardless of any later software fix. TRM Labs’ guidance for anyone who generated a Coldcard seed between March 2021 and the patch date is unambiguous: don’t wait, generate an entirely new seed on updated hardware and migrate funds to it immediately, because leaving funds on a wallet with a weak seed leaves them exposed indefinitely.
The actual lesson, and it isn’t “avoid hardware wallets”
TRM Labs’ framing is precise and worth taking at face value: “self-custody relocates risk rather than eliminating it.” Keeping funds on an exchange exposes them to exchange-level failure — insolvency, hacks, mismanagement, or an exchange simply freezing withdrawals. Self-custody exposes funds instead to device-level failure: firmware bugs, weak entropy generation, physical loss, or a compromised seed backup. Both are real risks; neither is a solved problem by default.
What actually reduces risk in a self-custody setup is treating the hardware wallet itself as something that needs scrutiny, not something that’s automatically secure because it’s not connected to the internet. TRM specifically recommends multisignature setups using independently designed devices from different manufacturers as meaningfully more resilient than a single hardware wallet — a firmware flaw in one device doesn’t compromise a multisig setup that also requires a second, differently-built device to authorize a transaction.
Practical takeaways
- A hardware wallet is not a “set and forget” security decision. Firmware updates matter, and a wallet’s manufacturer’s security-disclosure history is worth checking before buying.
- A seed generated on old or unpatched firmware may already be compromised even if the wallet itself seems to be working normally — there’s no way to tell by looking at the device.
- Multisig setups across independently designed hardware are a meaningfully stronger posture than a single device, for anyone holding an amount where that added setup complexity is worth it.
- Self-custody and exchange custody are different risk profiles, not a strictly safer and strictly riskier option. The right structure depends on what a specific holder is actually protecting against.
The Coldcard incident doesn’t argue against self-custody. It argues against treating “not on an exchange” as the end of the security question.
If you’re deciding what to do next, see setting up a hardware wallet for the first time and self-custody vs. exchange custody, a practical risk comparison for beginners.