Binance founder CZ calls for wallet diversification after $70 million Coldcard exploit

Binance founder Changpeng Zhao, known as CZ, has urged crypto holders to split their funds across multiple wallets following a major security failure in popular Coldcard hardware devices.

In a post on X Saturday responding to reports of the theft, CZ wrote: “Even hardware wallets can have bugs. Even old wallets (with long history) can have bugs. How to mitigate? Split your funds in a few wallets maybe? This has a different set of risks. Nothing is 100%. Stay informed. Stay SAFU!”

The incident involved a firmware flaw dating to March 2021 that weakened the randomness used to generate recovery seeds on certain Coldcard models. An attacker was able to reconstruct private keys offline and drain funds without ever physically accessing the devices.

Initial on-chain reports flagged about 594 bitcoin (roughly $38 million at the time) swept from around 500 wallets in a roughly 25-minute window on July 30. Subsequent analysis by Galaxy Research expanded the scope to 1,082.65 bitcoin—valued at approximately $70 million—taken from 1,196 addresses over about 41 minutes. Many of the affected wallets had sat dormant for years.

Coldcard maker Coinkite has acknowledged the bug, apologized, and released emergency firmware updates. The company has advised users who generated seeds on affected versions to create entirely new seeds on patched devices and carefully migrate funds, noting that simply updating firmware does not secure an already-created vulnerable seed.

The episode has renewed debate over the limits of self-custody. Hardware wallets are widely viewed as one of the strongest options for securing bitcoin offline, yet the Coldcard case shows that even long-established devices can harbor critical flaws that remain undetected for years. CZ’s suggestion of diversification acknowledges that spreading risk comes with its own practical challenges, including more complex key management.