A serious vulnerability in Coldcard Bitcoin hardware wallets has shattered a core assumption in cryptocurrency: that moving assets from an exchange to a personal wallet automatically removes custodial risk. The exploit, which affected thousands of users and resulted in confirmed losses exceeding $100 million, has triggered record inflows back to centralized exchanges as people reconsider whether self-custody is truly safer.

What Went Wrong With Coldcard's Security Model?

The Coldcard vulnerability involved a critical flaw in how affected devices generated private keys, the cryptographic credentials that unlock cryptocurrency holdings. Instead of producing genuinely random keys, the vulnerable devices generated predictable ones that attackers could reconstruct. This meant users could follow the entire self-custody process correctly, believe their assets were secure, and still have their cryptocurrency stolen because the underlying security mechanism was compromised at the hardware level.

Galaxy Research linked the vulnerability to the theft of more than 1,300 Bitcoin, initially valued above $80 million, from thousands of addresses. Subsequent estimates placed confirmed losses above $100 million. The scale of the incident underscores a uncomfortable reality: self-custody eliminates dependence on a centralized company, but it introduces a different chain of trust, one that extends to hardware manufacturers, firmware developers, and the assumption that random number generation actually works as advertised.

Why Are Hacked Tokens Struggling to Recover?

The Coldcard incident arrives alongside broader research showing that security breaches leave lasting damage to cryptocurrency projects. Immunefi, a blockchain security platform, examined 425 publicly disclosed incidents between 2021 and 2025, involving combined losses of approximately $11.9 billion. The findings paint a sobering picture of recovery prospects.

Approximately 84% of hacked tokens remained below their pre-incident prices six months after an attack, with affected tokens recording a median decline of 61% during that period. This isn't merely a temporary price dip; it reflects fundamental damage to a project's ability to function and recover.

• Treasury Depletion: A 61% token price decline reduces the value of a project's treasury precisely when expenditure on security, communications, and customer support is rising.
• Compensation Limitations: Projects holding much of their treasury in their own tokens become unable to compensate affected users or fund recovery efforts.
• Operational Constraints: Falling token prices force staff and development cuts, delay planned product releases, and trigger leadership changes.
• Market Contagion: Interconnected decentralized finance (DeFi) systems create additional risks, where a loss affecting one protocol, collateral provider, or stablecoin can spread through lending markets and liquidity pools that depend on the compromised asset.

Attack frequency has remained persistently high. The industry recorded 94 incidents in 2024 and 97 in 2025, with those 191 breaches producing approximately $4.67 billion in losses. The median value stolen per incident has declined to around $2.2 million, but the average loss has risen to approximately $25 million, showing that a small number of catastrophic incidents account for a disproportionately large share of total damage.

How to Strengthen Crypto Security Before Disaster Strikes

• Prioritize Pre-Deployment Security: Address security vulnerabilities before deployment rather than treating security as an emergency expense after an exploit occurs, following frameworks like the OWASP Smart Contract Top 10 2026.
• Develop Incident Response Plans: Create clear recovery mechanisms and incident plans that outline how a project will respond to and remediate security breaches.
• Diversify Treasury Holdings: Avoid holding the majority of a project's treasury in its own token, which creates vulnerability to price collapse during recovery efforts.
• Monitor Infrastructure Continuously: Implement ongoing monitoring of infrastructure and systems rather than relying solely on periodic audits.

Centralized exchanges were attacked less frequently than decentralized protocols but suffered considerably larger losses. Twenty exchange compromises produced approximately $2.55 billion in losses, around 55% of the total recorded across 2024 and 2025. This concentration reflects the economic logic of attackers: a successful compromise of one large custodian can provide access to assets belonging to thousands or millions of users.

The Coldcard incident has created an ironic outcome. Users seeking to escape exchange custodial risk by moving to hardware wallets discovered that self-custody introduces its own chain of trust vulnerabilities. The result has been record inflows back to centralized exchanges, suggesting that many users now view the regulatory oversight and insurance protections of major platforms as preferable to the hardware and firmware risks of independent custody.

This shift reflects a broader recognition that blockchain's next phase will be defined not only by what the technology can support, but also by whether its institutions, devices, and communities can earn durable trust. The Coldcard vulnerability exposed a gap in that trust, one that extends beyond any single product to the fundamental question of how users can verify that the tools they use to secure cryptocurrency actually work as intended.