Bloomberg's Eric Balchunas Questions Coldcard Security, Argues Larger Custodians Justify Higher Fees

The debate over cryptocurrency custody has resurfaced after Bloomberg Senior ETF Analyst Eric Balchunas publicly questioned the security model behind Coldcard, one of the most widely recognized hardware wallets among Bitcoin enthusiasts. Manufactured by Toronto-based Coinkite, Coldcard is designed as a Bitcoin-only, air-gapped hardware wallet—meaning it operates without direct internet or USB connectivity, relying instead on removable storage media for transaction signing. His remarks have reignited discussions across the digital asset industry about whether self-custody always provides the highest level of protection, or whether larger custodial providers can offer superior security through greater resources and institutional oversight.

Balchunas suggested that Coldcard's relatively small team—reportedly consisting of only five people—raises legitimate concerns about the company's capacity to defend against increasingly sophisticated cybersecurity threats. He contended that larger organizations such as Coinbase, Ledger, and custodians supporting U.S. spot Bitcoin exchange-traded funds (ETFs) may justify charging higher fees because of the extensive security infrastructure they maintain.

The comments rapidly gained traction across social media and cryptocurrency communities after being highlighted by Cointelegraph on X, reviving one of the industry's most enduring debates: Should investors trust themselves with self-custody, or rely on large institutional custodians?

Source: X Post

Security Remains the Most Critical Question in Crypto

Unlike traditional financial institutions, cryptocurrency enables investors to directly control their own assets without depending on banks or intermediaries. This concept, frequently encapsulated by the phrase "not your keys, not your coins," has become a foundational principle of the Bitcoin movement.

Hardware wallets like Coldcard were purpose-built to support this philosophy, allowing users to store private keys offline and thereby reducing exposure to online attacks and exchange hacks. For many Bitcoin advocates, self-custody is synonymous with financial independence.

However, managing digital assets independently also places the full burden of security on the individual. Lost recovery phrases, damaged hardware devices, phishing attacks, or operational errors can result in the permanent loss of cryptocurrency holdings.

Balchunas' comments introduce a different perspective, emphasizing that the security posture of the wallet manufacturer itself is an additional factor that investors should weigh.

Why Company Size Matters

According to Balchunas, the relatively small size of Coldcard's development team raises questions about long-term operational resilience. A company with only a handful of employees may have fewer resources dedicated to cybersecurity monitoring, software audits, customer support, compliance, infrastructure management, and emergency incident response.

While a small team does not necessarily indicate weaker security, Balchunas contends that scale matters when confronting increasingly advanced cyber threats targeting digital asset companies. Larger organizations often employ hundreds or even thousands of engineers, cybersecurity specialists, compliance professionals, and risk management experts who work continuously to identify vulnerabilities before they can be exploited.

This level of organizational investment, he argues, may justify the fees charged by institutional custody providers.

Coinbase's Institutional Infrastructure

Coinbase has grown into one of the world's largest cryptocurrency custodians, securing digital assets for millions of retail users as well as institutional investors. Through its regulated custody arm, Coinbase Custody Trust Company, the platform serves as the primary custodian for the majority of U.S. spot Bitcoin ETFs approved by the Securities and Exchange Commission in January 2024, a role that has made it central to the broader institutional adoption of Bitcoin. The company provides custody solutions for hedge funds, asset managers, corporations, family offices, and several issuers of these ETFs.

Its custody division operates under strict regulatory oversight while implementing multiple layers of physical and digital security. These safeguards include cold storage systems, geographic key distribution, multi-signature authorization procedures, operational controls, insurance arrangements, and dedicated cybersecurity teams.

Supporters of this model argue that maintaining such infrastructure requires substantial financial investment, which helps explain why institutional custody services command premium pricing.

Ledger Remains a Major Hardware Wallet Provider

Ledger has also become one of the largest manufacturers of cryptocurrency hardware wallets worldwide. Its devices are used by millions of customers and benefit from years of security research, firmware updates, penetration testing, and independent audits.

Although Ledger has faced criticism over certain product decisions and data-related incidents in previous years, the company continues to invest heavily in improving device security and expanding enterprise-grade solutions. Balchunas suggested that companies operating at this scale possess resources that smaller firms may find difficult to match.

Spot Bitcoin ETFs Add Another Layer

The emergence of U.S. spot Bitcoin ETFs has drawn increased attention to the custody question. Unlike individual investors who manage their own private keys, ETF shareholders depend on institutional custodians to securely hold the underlying Bitcoin. These custodians operate within regulated financial frameworks and are subject to extensive operational requirements, compliance standards, external audits, and ongoing regulatory oversight.

For many traditional investors, this institutional structure reduces operational complexity while providing familiar legal protections. Balchunas argued that these safeguards contribute to the fees charged by ETF providers.

The Self-Custody Philosophy Remains Strong

Despite Balchunas' concerns, many Bitcoin advocates continue to defend self-custody as the safest long-term approach. They argue that centralized custodians introduce counterparty risk, as users ultimately depend on third parties to safeguard their assets. History offers numerous examples of exchanges collapsing due to fraud, poor risk management, or cybersecurity failures—the November 2022 collapse of FTX, which resulted in billions of dollars in customer losses, and the 2014 Mt. Gox hack, in which approximately 850,000 bitcoins were stolen, remain among the most prominent.

Supporters of self-custody maintain that controlling one's own private keys remains the only reliable method of eliminating dependence on centralized institutions. For them, the added responsibility is a reasonable trade-off for complete financial sovereignty.

Experts Emphasize Risk Management

Security experts generally agree that there is no universal custody solution suited to every cryptocurrency investor. The appropriate model typically depends on an individual's investment size, technical expertise, trading activity, and risk tolerance.

Active traders frequently keep assets on regulated exchanges for liquidity. Long-term Bitcoin holders often prefer hardware wallets. Institutional investors generally require regulated custodians capable of meeting legal and compliance obligations. Each approach carries its own advantages and potential vulnerabilities.

Institutional Demand Continues Growing

The custody debate has become increasingly relevant in light of the rapid expansion of institutional cryptocurrency investment. Asset managers, pension funds, corporations, and investment advisers have allocated billions of dollars toward digital assets in recent years. These organizations typically require highly regulated custody providers capable of satisfying internal governance standards and regulatory requirements.

As institutional participation grows, demand for enterprise-grade custody solutions is expected to continue expanding.

Cybersecurity Threats Continue Evolving

The cryptocurrency industry remains a primary target for cybercriminals. Attack methods continue to grow more sophisticated, encompassing phishing campaigns, supply-chain attacks, ransomware, social engineering, insider threats, malware targeting hardware wallets, and cloud infrastructure compromises.

Both hardware wallet manufacturers and institutional custodians invest heavily in defending against these evolving risks. Analysts emphasize that security should be viewed as an ongoing process rather than a one-time product feature. Regular software updates, independent security audits, employee training, and transparent disclosure practices all contribute to maintaining investor confidence.

Transparency Matters

One reason Balchunas' comments generated widespread discussion is their focus on transparency. Investors increasingly want to understand how custody providers secure assets, manage operational risks, conduct security testing, and respond to vulnerabilities.

Large organizations frequently publish extensive security documentation, compliance reports, and independent audit results. Smaller companies may offer comparable protections but often communicate them differently or possess fewer public resources. Industry observers say transparency will become increasingly important as cryptocurrency adoption continues to expand globally.

The Future of Digital Asset Custody

The custody industry is expected to undergo significant change in the coming years. Emerging technologies—including multi-party computation, biometric authentication, advanced hardware security modules, artificial intelligence, and quantum-resistant cryptography—could fundamentally reshape how digital assets are protected.

Competition among hardware wallet manufacturers, institutional custodians, banks, and fintech companies is likely to accelerate innovation while improving security standards across the sector. Ultimately, investors will continue to balance convenience, control, cost, and security when determining how to safeguard their digital assets.

Looking Ahead

Eric Balchunas' remarks have reignited an important conversation about one of cryptocurrency's most fundamental issues: custody. While Coldcard remains respected among many Bitcoin users for its security-focused design and commitment to self-custody, Balchunas maintains that company size and organizational resources should also factor into the security equation.

His perspective reflects the broader institutionalization of digital assets, where regulated custodians, enterprise security infrastructure, and operational resilience increasingly influence investment decisions. As cryptocurrency adoption continues to expand across both retail and institutional markets, the debate between self-custody and institutional custody is unlikely to fade. Instead, it will remain central to the industry's efforts to balance decentralization, security, accessibility, and investor protection in an increasingly mature digital asset ecosystem.