A vulnerability in Coldcard hardware wallets has been exploited, draining over $83 million in Bitcoin. The incident, which came to light this week, puts the security of single-signature self-custody under a harsh spotlight. It may also accelerate the industry's move toward multi-signature wallets as a safer alternative.
The $83 million hole
The exploit targeted Coldcard devices, a brand of hardware wallet designed for Bitcoin storage. The exact method used by the attackers hasn't been disclosed, but the scale of the loss—more than $83 million—is one of the largest single exploits in the hardware wallet space. Users who relied on a single Coldcard to secure their funds found their Bitcoin drained without warning.
Self-custody under fire
The breach strikes at the core promise of self-custody: that holding your own keys keeps your coins safe from exchange hacks and third-party risk. This exploit shows that the hardware itself can become the weak link. For Bitcoiners who have long championed self-custody as the gold standard, the event is a sobering reminder that no single device is invulnerable.
Multisig on the rise
In the wake of the exploit, many in the crypto community are rethinking their setup. Multi-signature wallets, which require multiple keys to authorize a transaction, offer a way to spread risk across several devices or locations. The incident may drive increased adoption of multisig as a default security practice, especially for larger holders. Whether this becomes a lasting shift depends on how quickly users adapt and whether hardware makers respond with better safeguards.
