$89 million gone from cold storage: what the Coldcard exploit means for corporate bitcoin custody due diligence
When a corporate treasury team signs off on self-custody for its bitcoin allocation, the conversation almost always ends the same way. Someone says "not your keys, not your coins," the group nods at the FTX reference, and the hardware wallet gets approved as the conservative, institutional-grade option. The due diligence file closes.
That file needs to be reopened.
In late July 2026, reports began circulating of a significant key-generation vulnerability in Coldcard hardware wallets. According to Galaxy Research's analysis published on July 31 and August 1, approximately 4,500 addresses had been drained, with total losses reaching around 1,000 BTC, roughly $89 million at prevailing prices. The vulnerability was not a physical compromise. Nobody broke into a safe. The weakness was in the key generation process itself, meaning wallets that had never been touched, never connected to a suspicious site, never exposed to any of the threat vectors that custody checklists typically screen for, were draining anyway.
Affected holders are now moving funds back onto exchanges. That is worth sitting with for a moment. The entire post-FTX institutional narrative pushed assets off exchanges and into self-custody. This event is running that logic in reverse.
The asymmetry in how we think about custody risk
Exchange counterparty risk has been stress-tested by the industry for years. After Mt. Gox, after Bitfinex, after FTX, institutional frameworks developed real structure around it. BitGo's custody whitepapers, Fidelity Digital Assets' published security architecture, Anchorage's qualified custodian model under the OCC (Office of the Comptroller of the Currency) charter, all of them address exchange and custodian counterparty risk with some rigour. Insurance requirements, proof-of-reserves expectations, capital adequacy, counterparty concentration limits. The frameworks are imperfect, but they exist.
Hardware vendor risk has never received equivalent treatment. I have reviewe
