A firmware vulnerability in Coldcard hardware wallets led to the theft of approximately 1,082 BTC (worth around $70 million), prompting Joe Burnett, Vice President of Bitcoin Strategy at Strive, to label the past week as "possibly one of the worst weeks in the history of Bitcoin." The exploit, which targeted weak seed randomness, was present in Coldcard firmware version 4.0.0 shipped by manufacturer Coinkite on March 1, 2021, and later patched in version 4.21. Burnett argued that the incident reveals critical flaws in self-custody setups, especially for large holders, and advocated for institutional custodians like Fidelity and BitGo, claiming they operate with more robust security than individual hardware wallets.
Victims of the attack followed best practices—buying genuine devices and generating seeds offline—yet still lost funds. Burnett stressed that a single point of failure in self-custody can break unexpectedly. His remarks drew a response from Binance founder CZ, who advised spreading coins across multiple wallets, noting that "nothing is 100%." Despite the theft, Bitcoin’s price remained steady near $63,000, though social sentiment hit a record low according to Santiment. Strive, a publicly traded Bitcoin-holding company (Nasdaq: ASST) with 20,000 BTC, sees institutional custody as a safer path forward, aligning with Burnett’s long-term bullish prediction of $11 million per Bitcoin by 2036.
