Binance CEO Changpeng Zhao (CZ) this week urged cryptocurrency holders to diversify their storage methods after a $70 million exploit targeted Coldcard hardware wallets. The attack, which drained funds from users who relied solely on the popular cold-storage device, underscores a growing tension in crypto security: the more you consolidate, the bigger the single point of failure.
The $70 million wake-up call
Details of the Coldcard exploit remain sparse, but the scale is clear. Attackers managed to siphon roughly $70 million from wallets secured by Coldcard hardware. CZ took to social media to recommend that users split their holdings across multiple wallets and devices — a strategy that limits the damage if any one layer gets compromised. The advice is blunt: don't keep all your eggs in one cold wallet.
Why CZ spoke up
Binance's CEO rarely comments on third-party hardware incidents, but the size of this one forced his hand. The exchange itself wasn't hit, but many of its customers were. CZ's warning is less about Coldcard specifically and more about the broader risk of single-vendor dependency. He didn't name the exploit's perpetrators or offer a timeline for recovery — just a practical note for anyone holding meaningful amounts of crypto.
Diversification vs. convenience
The tension is real. Hardware wallets like Coldcard are marketed as the gold standard for security. But this incident shows that even the best hardware can have vulnerabilities — whether in the supply chain, firmware, or user implementation. Splitting funds across multiple devices, or mixing cold storage with multi-sig setups, adds complexity. CZ's point is that complexity is worth the trade-off when the alternative is losing everything in one shot.
What users should do now
For anyone still relying on a single Coldcard — or any single hardware wallet — the message is clear: move some funds. CZ didn't specify a preferred alternative, but the logic is straightforward. If you have $100,000 in crypto, consider splitting it across two or three different hardware wallets from different manufacturers, or using a multi-signature setup. The exploit's technical details haven't been fully disclosed, so the exact attack vector isn't public yet. That makes waiting risky.
