Coldcard Firmware Flaw Tied to 2,000 BTC Theft, Reignites Debate Over Bitcoin Custody

A firmware vulnerability affecting the Coldcard hardware wallet was linked to the theft of roughly 2,000 BTC, with reported losses of about $1.3 billion. Following the incident, U.S. spot Bitcoin ETFs recorded net inflows of around $626 million over several days. Bloomberg ETF analyst Eric Balchunas said the breach appeared to push capital toward ETFs as investors sought an alternative custody setup. Casa cofounder Jameson Lopp cautioned that third-party custody introduces its own risks. Peter Todd, an early Bitcoin Core developer, countered that self-custody has historically shown a stronger security record than centralized institutions. Onramp cofounder Michael Tanguma suggested a multi-custody approach, a proposal that has revived arguments over how such models fit with decentralization principles.