Bitcoin Faces Self-Custody Debate as CZ Warns of Wallet Risks
Bitcoin is undergoing a new scrutiny after on-chain analyst Willy Woo posted on social media platform X today, August 4, 2026, and emphasized on data suggesting 1.57 million BTC has been lost through self-custody. It was also compared with 1.51 million BTC that had been lost on exchanges. His comments arrive at a time when the self-custody sector, following a major cold card wallet incident, has been witnessed where 1,300 Bitcoin was stolen.
Further, this conversation was joined by Binance co-founder Changpeng Zhao. He stated that hardware wallets are not immune from technical issues. He further commented that that ‘nothing is a 100% safe’ and users must bifurcate their revenue across different wallets to reduce the risk of cluster.
Probable Risks Behind Bitcoin Self-Custody
Willy Woo’s remark brought out a less discussed nuance. While self-custody reduces dependence on financial institutions and intermediaries, losing access to a private recovery would lead to a subsequent loss of Bitcoin. As per the figures, approximately 1.57 million BTC was lost through non-custodial, more than 1.51 million BTC occurred through exchange losses.
However, it also brings out a disadvantage. Exchange-related losses are easily witnessed as they receive public attention. On the other hand, non-custodial losses remain undocumented where users lose access to wallets and lose recovery phrases. He has mentioned that Bitcoin’s autonomous nature is a huge advantage. Unlike institutional assets, individual Bitcoin does not rely on a financial intermediary.
He also emphasized that custodial solutions and ETFs can yield advantages, especially merging with conventional financial institutions. His point of view states that users should understand the trade-offs involved rather than treating one method as universal. The X post also mentions that hardware wallets are not safe from technical failures.
Binance co-founder Changpeng Zhao said that ‘nothing is 100%’ safe. He further suggested users should diversify the funds across different wallets to reduce risks. He was a major part of this discussion issuing an advisory that hardware wallets are not safe from technical collapses.
Coldcard Incident Puts Up Another Roadblock
The Coldcard ecosystem brings a grave safety incident involving a vulnerability from 2021. Galaxy Research estimated that approximately 1,367 BTC, costing $88.6 million were stolen. This was found out during the analysis. The malicious attack occurred several times, with the latest one targeting small wallets. The underlying issue was linked to the generation of recovery seeds. A software bug affected Coldcard devices to depend on a weaker software-based random number generator instead of the hardware number generator to create secure seeds.
Those exposed on the matter said that the problem reduced the effect entropy of recovery seeds generated on affected devices. This made it possible for attackers to redevelop vulnerable wallet seeds without accessing the hardware. The first major wave reportedly drained more than 1,082 Bitcoin from 1196 wallets within 41 minutes.
A second wave brought the stolen amount to 1,158 BTC, while Galaxy Research identified a third wave involving 207.7 BTC. This nuance emphasizes self-custody security, where updating the device does not necessarily make an old, compromised recovery seed safe. Users who face this issue need to create a completely new recovery seed and transfer the Bitcoin.
CoinKite launched a firmware update to deal with the issue and asked the users to take preventive action. Wallets generated using sufficient dice rolls to create the recovery seed were said to be outside the scope of the issue. The incident also garnered concerns over the quick launch of the security update, while some users said that soldered devices were bricked.
AI Safety Steps in the Coldcard Debate
The incident sparked a massive debate about how software safety should be developed. This is necessary as the attacks become complex. As per Managing Partner of Dragonfly, Haseeb Qureshi, the teams should inculcate frontier AI models for security screening. He argued that projects that do not undergo advanced checks are lagging behind. Qureshi mentioned using Anthropic’s Claude models to nitpick vulnerabilities at less cost. This shows how the cyber safety dynamics are evolving.
He argues that AI-centric safety would be a key mechanism for software teams. Organizations with better security tactics who conduct continuous testing would be ahead of the curve. The cold card incident opens a new nuance. Self-custody does not remove the risk; it changes where the risk appears. The Willy Woo data therefore does not establish that exchanges are safer than self-custody. It emphasizes how distinct custody models produce different failures. While the cold card incident shows that hardware can also possess vulnerabilities capable of putting users’ funds at risk.
