Binance founder Changpeng Zhao (CZ) has cautioned that hardware wallets are not failproof, urging crypto users to distribute their assets across multiple wallets after a major Coldcard security breach.

In a post on X, CZ pointed out that even widely trusted and long-standing wallets can contain hidden vulnerabilities. He suggested splitting funds to reduce exposure, while acknowledging that diversification introduces its own risks and that no solution offers complete security.

The breach traces back to a firmware flaw introduced in March 2021, which weakened the randomness used to generate recovery seeds on certain Coldcard devices. This allowed attackers to reconstruct private keys offline and access funds without needing physical possession of the wallets.

Initial blockchain data showed that about 594 BTC—valued at roughly $38 million at the time—was drained from around 500 wallets within a 25-minute window on July 30. Further analysis by Galaxy Research later expanded the масш of the attack to 1,082.65 BTC, worth approximately $70 million, stolen from 1,196 addresses over about 41 minutes. Many of the affected wallets had been inactive for years.

Coldcard manufacturer Coinkite has acknowledged the vulnerability, issued an apology, and rolled out emergency firmware updates. The company advised users who generated seeds on affected versions to create entirely new seeds on updated devices and securely transfer their funds, warning that simply updating firmware does not protect already compromised wallets.

The incident has reignited debate over the limits of self-custody. While hardware wallets are widely regarded as one of the most secure ways to store bitcoin offline, the Coldcard exploit shows that even established devices can harbor critical flaws for years. CZ’s call for diversification underscores a key trade-off: spreading risk can improve safety, but it also increases the complexity of managing multiple wallets and private keys.