A self-custody loss reported at $116 million has sharply focused attention on Bitcoin wallet security, shifting the discussion away from exchange failures and toward operational risks that rest entirely with individual holders. The incident comes as security researchers examine weaknesses in the firmware that powers popular hardware wallets. Self-custody's appeal broadened after the collapse of the FTX exchange in 2022, which renewed the industry's “not your keys, not your coins” ethos, and the current scrutiny shows the operational burden that ethos carries.

The renewed spotlight on Bitcoin self-custody follows a disclosure from Block's security team — Block is the fintech company formerly known as Square — describing a predictable random-number-generator fallback and a 32-bit reseed weakness in Coldcard firmware, a hardware wallet built by Coinkite. Weak randomness during key generation is one of the few flaws that can compromise an otherwise properly stored wallet: a private key is only as strong as the entropy behind it, and in cryptographic terms a 32-bit space is small enough to be searched exhaustively with ordinary computing resources, which is why weaknesses of this kind are treated as severe. For related coverage, see Bitcoin Slips After U.S. Inflation Data, ETFs See 2-Day Outflow.

Bitcoin educator BitcoinPierre also drew attention to the issue, flagging the firmware findings on X as a reason for holders to review how their keys were created and where they are stored. For related coverage, see Another Bitcoin Miner Sells Off BTC to Fund AI Data Center Pivot.

Key points

• A reported $116 million self-custody loss has reframed wallet security as an operational-risk issue rather than a market one.
• Block's security team disclosed a predictable RNG fallback and a 32-bit reseed weakness in Coldcard firmware.
• Self-custody removes counterparty risk but places key generation, storage, and recovery entirely on the user.

Why the incident is a self-custody problem, not a market one

Self-custody gives holders full control of their coins, but that control comes with full responsibility. There is no support desk, no chargeback, and no counterparty able to reverse a mistake once funds move.

That is what distinguishes self-custody from the ETF route many investors now use — a route that widened after U.S. regulators approved spot Bitcoin ETFs in January 2024 — where custody is outsourced to regulated managers. Institutions have increasingly leaned into that model, with JPMorgan boosting its Bitcoin and Ether ETF positions and issuers such as Cboe seeking approval for leveraged Bitcoin futures ETFs. Those products reintroduce counterparty risk in exchange for removing the burden of key management.

How to reduce self-custody risk after a loss of this size

The Coldcard firmware findings point to the first weak link: how a wallet generates its keys. Holders using hardware devices should confirm that they are running patched firmware and understand how the device sources randomness before trusting it with meaningful balances.

Seed-phrase discipline is the second. A recovery phrase — the typically 12- or 24-word backup defined by Bitcoin's BIP39 standard — stored digitally, photographed, or kept in a single location reintroduces the very single point of failure that self-custody is meant to eliminate.

For larger balances, multisignature setups spread signing authority across multiple devices or locations, so a single compromised key or faulty device cannot drain a wallet. The trade-off is added complexity in both spending and recovery.

The broader lesson is that self-custody removes counterparty risk but not user error, and even trusted hardware can contain flaws. Independent researchers have probed hardware wallets before, but the Coldcard findings concern the moment a key is first created. The same scrutiny is now being applied across the ecosystem, with a Bitcoin red team using AI tooling to hunt for potential flaws in the software the network depends on. For holders, the practical developments to monitor are vendor firmware updates that address disclosed weaknesses and security research from teams outside the wallet vendors themselves.

Additional source references: source document 1.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.