Binance founder Changpeng Zhao (CZ) waded into the self-custody versus exchange debate this week, citing data that shows more bitcoin has been lost through self-custody than on exchanges — but he warned that no wallet setup guarantees full protection. The comments come days after a Coldcard hardware wallet vulnerability drained BTC from users, with one victim losing $1.6 million despite following standard security steps.
The numbers behind the debate
According to analyst Willy Woo and River's 2025 industry report, 1.57 million BTC have been lost through self-custody, compared to 1.51 million BTC lost on exchanges — a gap of less than 60,000 BTC. CZ argued that self-custody losses are underreported because lost private keys, forgotten passwords, and destroyed hardware wallets rarely make headlines, while exchange hacks are widely tracked. The data suggests the two custody methods are closer in risk than many assume.
Exchange-side losses and BitMEX's shutdown
Not all exchange losses come from hacks. CZ noted that some exchange-side losses stem from platforms that no longer operate, such as BitMEX, which announced its shutdown in July 2026 after 11 years. Industry hack tracking shows that exchange hack incidents rose roughly 50% in the first half of 2026, even though total stolen amounts decreased. That means more attacks, but smaller hauls per incident.
Binance's SAFU and the Coldcard incident
Binance has expanded its Secure Asset Fund (SAFU) into a $1 billion Bitcoin reserve, and CZ stated the exchange consistently covers user losses from hacks. But the Coldcard vulnerability, disclosed in early August 2026, shows that self-custody isn't bulletproof either. One user lost $1.6 million despite following standard security steps. CZ warned that no wallet setup guarantees full protection, but he stopped short of recommending exchanges over private wallets, framing the choice as one of risk tolerance and product fit.
The choice between custody and self-custody
Bitcoin traded near $60,347 at the time of writing, up roughly 1.2% over 24 hours. The Coldcard incident may push some users to reconsider their setup, but CZ's message is clear: there's no one-size-fits-all answer. The question now is whether the industry can improve both custody models fast enough to keep pace with rising threats.
