Recently, a firmware vulnerability in Coldcard hardware wallets led to a large amount of Bitcoin being stolen, sparking heated discussions about cryptocurrency security. BlockTower Capital founder Ari Paul believes this incident once again proves that "cryptocurrency simply cannot be stored securely."
Earlier reports indicated that a firmware vulnerability affecting multiple generations of Coldcard hardware wallets allowed attackers to steal approximately 1,082.65 Bitcoin (worth about $70.2 million at the time) in just 41 minutes.
Entrepreneur Jonathan Goodman revealed on X platform that his Coldcard wallet had Bitcoin worth $1.6 million stolen. He said: "My Bitcoin was stored in cold storage, with private keys kept on a Coldcard device that never connected to the internet, and placed in a bank safe deposit box."
Paul believes the Coldcard incident exposes an uncomfortable reality that has long existed. He said: "The Coldcard incident has been downplayed, but that's not surprising because it reveals nothing new. It reminds us that there is simply no secure way to store cryptocurrency."
Paul pointed out that neither self-custody nor third-party custody can provide absolute protection. "If you custody your coins with Coinbase or other custodians, they are frequently hacked, and you get no compensation. If you fully self-custody, you may face risks similar to the Coldcard vulnerability."
He believes this fundamental vulnerability is not limited to a single hardware wallet manufacturer, because all custody solutions ultimately rely on hardware and software that may have vulnerabilities. "The sad reality is that in most developed countries, the current legal system can protect financial assets more reliably than cryptography," Paul said.
However, he acknowledged that in countries with weaker legal systems and property rights protections, cryptocurrency may still be a more reliable option.
In response to Paul's pessimistic view, ShapeShift founder Erik Voorhees countered that the Coldcard incident does not prove that cryptocurrency cannot be stored securely. He acknowledged that no storage solution is risk-free, but argued that each method of storing wealth involves a trade-off of different risks, not identical risks. He also noted that over the years, hundreds of billions of dollars worth of cryptocurrency has been stored securely.
