Binance co-founder Changpeng Zhao has called for a more balanced approach to Bitcoin custody, weighing in on a debate that intensified after the Coldcard hardware wallet exploit drained hundr
Binance co-founder Changpeng Zhao has called for a more balanced approach to Bitcoin custody, weighing in on a debate that intensified after the Coldcard hardware wallet exploit drained hundreds of millions of dollars from thousands of users.
The incident has rattled confidence in self-custody solutions. Since last Thursday, Bitcoin owners who store their crypto with Coldcard, which offers a form of hyper-secure storage known as a hard wallet, have experienced four waves of thefts affecting more than 5,200 individual addresses.On-chain analysis by Galaxy Research revealed that hackers moved approximately 1,816 Bitcoin, worth nearly $116 million, off those wallets.
A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator instead of the STM32 hardware random number generator.The software bug may have made some recovery phrases predictable enough for sophisticated attackers to figure out, potentially allowing them to steal Bitcoin without ever physically touching the wallet.Galaxy Research says losses could rise to about 2,055 Bitcoin, worth nearly $130 million, if a suspected fourth wave is confirmed.
Zhao pointed to River's 2025 Bitcoin custody report, which puts the scale of losses in broader context. River's 2025 custody report estimates 1.57 million $BTC permanently lost through self-custody, with 98% of those losses occurring before 2020. The report also estimates 1.51 million $BTC lost on exchanges, meaning the two figures are broadly comparable across the history of Bitcoin.
Zhao noted that exchange hacks are easier to track because they are public events, while self-custody losses often go unreported entirely. He also highlighted that Binance has reimbursed users for exchange-related hacks over the years, pointing to the protections that custodial platforms can offer. His conclusion was straightforward: different custody methods carry different risks, and a balanced approach is likely the best option for most holders.
In 2025, many exchanges provide a level of security and professionalism that is difficult to replicate independently, with systems designed with multiple layers of redundancy to eliminate single points of failure and reduce the risk of insider theft, hacks, or operational mistakes. Even so, in 2022 alone, more than 100,000 BTC worth over $2 billion were lost by exchanges that offered yield on Bitcoin holdings, many of which became insolvent after suffering losses on Bitcoin loans.
The broader takeaway from Zhao's remarks is that no single custody method is risk-free. For most retail users, diversifying across custody options rather than relying entirely on either self-custody or a single exchange may offer the most practical protection.
Sources:Fortune: What we know about the Coldcard exploitBleeping Computer: Coldcard wallet RNG flaw linked to Bitcoin theftRiver: Bitcoin Custody Report 2025
