(Bloomberg Opinion) — Finding a place to stash the keys to your cryptocurrency hoard has never been easier, thanks to options that run from putting them in a retired Swiss nuclear bunker to the humdrum use of digital-asset exchanges. It’s also never been harder to keep them safe from thieves.
Cold storage — using physical offline devices such as hard drives, safe-deposit boxes or USB sticks — is the gold standard in crypto security. To transfer Bitcoin or similar from your electronic wallet, you need to know the string of random words that makes up its de facto password, known as a seed phrase. And rather than write them down or keep them somewhere digital that’s connected to the internet, you store them in a place hackers can’t reach. Or at least that’s the theory.
Unfortunately, an attack last week has shown once again that no method is ever 100% reliable. Coinkite is a Canadian firm that hosts people’s Bitcoin wallets and has developed a physical device — Coldcard, which looks like a pocket calculator — to create customers’ private keys to those wallets and then keep them secure.
But it was exploited by hackers who found a flaw in the way the company generated the seed phrases. Instead of completely random generation, the wallets had a failsafe that resulted in some keys using predictable information such as serial numbers. So the hackers were able to use that knowledge to brute force their way into thousands of online wallets. More than $100 million has been stolen from Coldcard users so far, despite their best efforts to keep their passwords hidden.
This isn’t the first time the physical storage of crypto keys has failed to keep wallets secure. There are many stories of people losing or forgetting passwords, falling for phishing scams, and the tale of a hard drive holding the keys to more than $500 million in Bitcoin ending up in a Welsh landfill site. Crypto owners surely know by now that this asset class comes with its own set of alarming security risks.
But it’s hard to say how Coinkite’s customers could have avoided this situation. Should every crypto trader be expected to pore over a cold-storage provider’s base computer code before they use it, for fear of being hacked? While many such companies have their systems vetted by security experts and proudly tout their certifications as evidence of surety, these are often just snapshots in time and no guarantee when technology is constantly evolving.
In this case, Coldcard’s firmware was available to anyone as open-source code, standard practice in crypto because of the evangelical commitment to decentralized systems. Plus it allows so-called white-hat hackers to look for vulnerabilities and report them in exchange for a reward. But as the adoption of digital tokens expands, the ratio of those of us technologically savvy enough to parse the quality of a wallet provider’s code will only dwindle.
And the risks are spiraling as criminals learn to innovate. The rise of artificial intelligence has created new ways to attack, with tools such as Anthropic PBC’s Claude able to scour crypto platforms’ code for flaws. (That’s not to say AI is infallible. Coinkite says several frontier models it asked to check its work failed to spot any issues before the hack was uncovered).
Even in the real world, old-school villainy can work. Wrench attacks, where criminals violently coerce victims into handing over tokens or passwords, has resulted in a staggering rise in muggings and kidnappings around the world. France has suffered a wave of gang-coordinated attempts, accounting for 38% of all documented wrench attacks since the start of 2025, according to a database compiled by Bitcoin security expert Jameson Lopp. The crypto elite has ramped up bodyguard spending, while this year’s Paris Blockchain Week saw VIPs shepherded to a Versailles dinner by a police escort. Retail investors obviously can’t afford such protection.
It’s true that traditional money has similar security flaws. A bank can be robbed at gunpoint, call-center scams can trick people into making fraudulent transfers, cash can be counterfeited. But a forgotten PIN number or fat-finger transaction is easily resolved by your bank; misplaced seed phrases are usually gone for good. Similarly, stolen tokens are extremely difficult to recover thanks to the nature of blockchain technology, where you don’t know who a true owner is, only who holds the keys when a transfer is made.
Attempts by the industry to get around this problem aren’t always welcomed by traders. One of crypto’s core tenets is its oft-repeated mantra of “not your keys, not your coins” — meaning wallet providers can appear overmighty when trying to bolster security.
Ledger, the developer of another popular cold-storage solution, did unveil a product that split seed codes in three to make them easier to recover. Each fragment would be stored in separate countries by different firms, as an insurance policy. Except most Ledger users had thought their seed phrase was impregnable, so the discovery that it could be shared by the company felt like a betrayal. The product was put on ice, but launched a few months later with extra transparency.
The Coldcard episode could serve as a reminder that spurs traders to favor more centralized custodial methods, but I doubt it. Bitcoin’s libertarian ideals of privacy and autonomy remain heavily ingrained in the industry, and with good reason. The collapses of FTX, Celsius and Mt. Gox are evidence of what can happen when your tokens are entrusted to others.
Still, safeguarding your own seed phrase is not something retail holders should do lightly, which is why storing crypto on the exchange they bought it from often remains the only option they’re aware of. Exchange-traded funds that hold Bitcoin are offered by mainstream asset managers and are a safer alternative, providing essentially the same price exposure with fewer perils. For most casual investors, that’s enough to be getting on with.
More from Bloomberg Opinion:
Want more from Bloomberg Opinion? OPIN
To contact the author of this story:
Emily Nicolle at [email protected]
