Binance founder Changpeng Zhao, widely known as CZ, has called on cryptocurrency users to make wallet security a top priority, drawing attention to the distinct risks associated with both hardware and software wallets. The reminder carries particular weight in self-custody, where safeguarding private keys and recovery phrases falls to the individual rather than an exchange or custodian.

In an October 10 post on X, Zhao voiced support for self-custody and pointed to YZi Labs' investments in hardware wallet manufacturers OneKey and SafePal, alongside mobile wallet provider Trust Wallet. He urged users to “Stay SAFU out there” — invoking the industry's familiar shorthand for fund security, an acronym drawn from Binance's Secure Asset Fund for Users emergency reserve — and to understand the security implications of the different wallet types available.

Stay SAFU out there! FWIW, I am not against hardware wallets, or self-custody. Different wallets/product for different use cases. All have different security implications and best practicies. YZiLabs invested in OneKey, SafePal (hardware wallets), TrustWallet (mobile), etc.

— CZ 🔶 $BNB (@cz_binance) October 10, 2026

The message combines an endorsement of holding one's own assets with a reminder that every wallet category carries its own security trade-offs and best practices. Hardware wallets keep private keys offline, while software and mobile wallets run on internet-connected devices — a distinction that shapes their respective attack surfaces.

Zhao Advises Patience With New Wallets

Zhao has previously advised users to keep newly purchased hardware wallets and newly downloaded software wallets separate from their main funds for several weeks. He also recommended monitoring security reports before transferring large amounts of cryptocurrency to a new device or application. The caution reflects how seed phrases work: these word sequences restore access to a wallet, and whoever obtains them can control the funds.

The advice follows reports of $86 million to $87 million in losses linked to a third-party Ledger reseller in Southeast Asia. According to those reports, attackers allegedly replaced instructions containing seed phrases. Ledger stated that its manufacturing process, firmware, and official software had not been compromised. The episode illustrates supply-chain risk, where tampering occurs outside a manufacturer's official distribution channel.

Suspicious Ledger Device Raises Questions

Former Mt. Gox CEO Mark Karpelès — best known for leading the Tokyo-based Bitcoin exchange that collapsed in 2014 — reported discovering a small component inside a Ledger device shipped from Malaysia, describing it as a “spy SIM card.” Its function remains unclear, and no confirmed link to the reported losses has been established.

My spy-implanted ledger came from Malaysia, and had flawless shrink wrap. Even opening it, at first you don't see the implant which is cleverly hidden where the screen's padding is supposed to be. Follow Ledger's guidance to check yours: pic.twitter.com/D8mixF1o9L

— Mark Karpelès (@MagicalTux) October 9, 2026

The finding does not, by itself, prove that hardware wallets are inherently unsafe. It instead underscores the importance of verifying the source of any device and carefully protecting recovery phrases. With the component's purpose still unexplained, further technical findings from Karpelès or official statements from Ledger are the details to watch as the story develops.