Changpeng Zhao does not panic easily. The former Binance CEO has lived through four complete crypto cycles, bull markets, exchange collapses, regulatory crackdowns, and hacks of every size. W
Changpeng Zhao does not panic easily. The former Binance CEO has lived through four complete crypto cycles, bull markets, exchange collapses, regulatory crackdowns, and hacks of every size. When he posts a warning that draws one million views, it is worth reading carefully.
Responding to the news that 594 BTC worth $38 million had been drained from 500 Coldcard hardware wallets in a 25-minute window, CZ posted four lines that cut through everything.
"Even hardware wallets can have bugs. Even old wallets with long history can have bugs. Nothing is 100%. Stay SAFU."
By the time he posted, the number had already grown. Galaxy Research would go on to identify three separate attack waves, the final tally reaching 1,367 BTC drained from 4,585 addresses worth approximately $89 million.
The exploit traces to firmware version 4.0.0 shipped in March 2021, a five-year-old bug that silently routed seed generation through a weak deterministic fallback rather than the device's hardware random number generator.
Related: Bitcoin has never broken this line in 15 years, it is on it right now
That reduced possible seed values to roughly 4 billion, small enough to reproduce remotely from publicly available data like device serial numbers and clock timings. The attacker never physically touched a single device.
Coldcard models Mk2 through Mk5 were affected. The flaw has since been patched but the damage cannot be reversed.
CZ's suggestion, split funds across multiple wallets, is not a perfect solution. He acknowledged that himself. Diversification across wallets introduces a different set of risks: more seed phrases to manage, more firmware to update, more points of potential failure.
But his broader point is the one that matters most right now. Trusting any single solution completely, whether an exchange, a hardware wallet, or a software wallet, is the real vulnerability.
Strike CEO Jack Mallers called the Coldcard incident "one of the most serious Bitcoin wallet security breaches to date." CZ's response did not contradict that. It simply added the frame that needed adding.
No wallet maker can promise zero bugs. No firmware is immune to a five-year-old mistake surfacing at the worst possible time. The only protection is knowing that, and building accordingly.
