Jameson Lopp, chief security officer at Casa, has warned Bitcoin holders not to abandon self-custody in favor of exchange-traded funds and third-party custodians after a series of high-profile wallet security incidents.
In an October 22, 2026 open letter to Casa clients and the Bitcoin community, Lopp argued that recent attacks involving AI-assisted vulnerability discovery, compromised hardware wallet supply chains, drained cold wallets and increasingly sophisticated scams do not justify giving up direct control over Bitcoin. He pointed out that many of the attacks now making headlines were already known to security professionals, but their appearance in real incidents has made the risks harder for ordinary holders to ignore.
The security concerns include a Coldcard firmware configuration error dating back to March 2021 that caused affected devices to generate recovery seeds using a weaker source of randomness. An August 3 report estimated suspected Bitcoin thefts of nearly $90 million, and Kraken chief security officer Nick Percoco called for independent testing of wallet seed generation. Coldcard later released corrected firmware, but users with vulnerable seeds had to create new wallets and move funds.
More recently, an October 13 investigation detailed compromised Ledger hardware wallets distributed through Southeast Asian reseller CryptoBilis. Ledger confirmed an unauthorized hardware implant in one affected device but said its own systems and direct sales channels were not confirmed compromised. On October 18, Qubic disclosed a wallet security breach involving about 2.94 trillion QU worth $1.4 million stolen from 1,404 wallets because of insufficient randomness in certain recovery seeds. The debate over self-custody has also been shaped by exchange failures, including the Bybit hack in 2025 with more than $1.4 billion stolen and record OKX inflows after the Coldcard exploit as some users moved toward managed custody.
Lopp took particular issue with the idea that moving Bitcoin into ETFs or managed custody is a simple solution. He argued that Bitcoin ETFs provide price exposure without direct control over the underlying coins, leaving investors dependent on the fund, its custodian and other parties, and vulnerable to freezes or seizures by authorities. He stressed that Bitcoin’s defining properties come from its fixed supply, publicly verifiable rules and the ability to access holdings without permission from an intermediary.
His recommended approach centers on multisignature wallets, which require multiple private keys to authorize transactions, reducing the risk that a single compromised key provides full access. Lopp encouraged Bitcoin holders to review their existing setups, distribute keys across different geographic locations and hardware supply chains, and plan for inheritance. Casa, which provides assisted self-custody services, positions itself as helping users manage these arrangements without taking possession of their private keys.
For Bitcoin holders who choose not to use a hardware wallet such as Ledger, the security spectrum ranges from software wallets like Electrum, Trust Wallet and Rabby, to delegated custody on exchanges, paper wallets, software multisig, and seed phrases engraved on metal and stored in air-gapped locations. Security experts stress that none of these methods is automatically secure; protection emerges from good digital hygiene, verifying software sources, testing recovery procedures and matching the setup to the holder’s risk profile.
