After the Coldcard incident, a question has been raised again: if hardware wallets can also make mistakes, and may even leave hidden dangers from the moment the keys are generated, why should we still custody our own assets?
Our assessment is: self-custody is still important. It allows users to have the final authorization for on-chain operations and retains the possibility of independent migration when platforms or services fail. Coldcard has not changed this value, but it has made us re-examine "how to securely own control."
Security cannot be judged by a single label
According to the Coldcard official announcement and Block's technical analysis, a firmware integration error caused some devices to not use hardware random numbers as expected, but instead fell back to a predictable software random number path. Seemingly normal mnemonic phrases may not have reached the expected security level from the key generation stage.
In many public cases, users did not click phishing links or leak their mnemonic phrases; they simply created wallets following the product's default process. The problem occurred at the source of key generation, and no matter how carefully they stored the keys afterwards, the gap could not be filled.
This incident broke a common cognitive shortcut: hardware, offline, or open source can all improve security, but no single label can alone constitute a security conclusion. Ordinary users cannot audit firmware line by line. Making the default path reliable is the responsibility that security products should bear.
After the incident, OKX said the platform saw a large influx of funds. CZ subsequently cited a set of historical data, suggesting that "statistically, keeping assets on exchanges is safer than self-custody." It is not surprising that this statement gained approval.
Mature custodial institutions can invest more resources to establish professional security and recovery systems. For those lacking key management experience, having institutions take on this part of the work may indeed reduce the difficulty and risk of individuals managing keys alone. Acknowledging this does not weaken the value of self-custody; instead, it brings the discussion back to the real user situation.
But historical loss figures are hard to directly provide today's answer. The River research cited by CZ also shows that early BTC permanent loss data is difficult to accurately attribute, with the vast majority occurring before 2020; exchange losses are also impossible to fully count, and some compensations have not been deducted. These cumulative figures have not been adjusted for asset size and holding time. They show that both methods have suffered huge losses, but they are insufficient to measure today's actual risk.
More importantly, such comparisons usually only count "whether assets were lost," but rarely answer "whether they can be withdrawn when needed" and "whether one can leave after a platform problem." Custody can reduce the pressure of personal key management, but it also makes users dependent on the institution's continued operation, fulfillment of redemption obligations, and provision of account access.
Self-custody preserves another path
Self-custody is essentially an arrangement of control. For common self-custody accounts, users hold the private keys or the key conditions required to complete signatures, and wallet developers and other service providers cannot unilaterally complete valid authorization.
As long as users still hold valid keys or backups, even if the original wallet stops service, they can usually recover the account through compatible tools; when users need to transfer assets or use on-chain applications, they do not have to wait for a platform to open withdrawals first.
This independent path is the most important value of self-custody.
It certainly has boundaries. Network and contract rules may still affect asset usage. What self-custody preserves is that the final authorization for on-chain operations does not have to rely entirely on a single institution, not absolute control over all external conditions.
This value is not obvious when the platform is operating normally. It is a bit like a backup: it does not make daily operations faster, but when the original path fails, it determines whether users still have options.
Therefore, there is no one-size-fits-all answer between custody and self-custody. For those who are temporarily unable to securely manage keys, choosing a carefully evaluated custodial service is reasonable; for those who want to reduce dependence on a single institution, establishing a path that can be independently recovered and migrated is equally important. The key is not which side you stand on, but being clear about what risks you have handed over and what capabilities you have retained.
Control should not be a burden on users alone
Users controlling private keys does not mean product providers can take less security responsibility. Ordinary users cannot verify the entire process from key generation to firmware construction of a device. Products need to verify critical paths, expose anomalies in a timely manner, and respond transparently after problems occur. Security should come from reliable default design, not rely on users discovering hidden technical risks.
Users also need to confirm that backups can indeed be restored, understand what they are authorizing before signing, and know in advance how to migrate if major tools fail. But these capabilities can be built gradually. Self-custody should not be a qualification exam that requires everyone to immediately transfer all assets, nor should it require everyone to become a cryptography expert.
For imToken, supporting self-custody starts with making this choice more reliable. Users need to be able to understand what they are authorizing, know how to recover, and be able to migrate to compatible tools when needed. Only then can control be more than just a slogan.
The Coldcard incident has not made self-custody less important; on the contrary, it has made security responsibilities more concrete. The next phase of the problem to solve is how to make security, recovery, and user experience more reliable while retaining user control.
Users can choose custody, and can leave custody when needed; they can have control, and do not have to bear all the complexity alone. This is the significance of re-discussing self-custody after Coldcard.
