TL;DR
The debate over Bitcoin self-custody has intensified after reports that a Coldcard firmware vulnerability allowed attackers to steal approximately $88 million in BTC. While critics argue the incident exposes weaknesses in personal custody solutions, early Bitcoin developer Peter Todd maintains that self-custody remains the strongest protection for long-term Bitcoin holders when compared with centralized alternatives.
> It’s not a time to act as if self custody is risk less and those who promoted it as if it was easy were correct.
QuadrigaCX alone was a ~$200 million USD loss, ~double the size of the cold card hack.
Self custody has a much better track record than third parties.
Self… https://t.co/CtRE2bPI5S
— Peter Todd (@peterktodd) August 3, 2026
According to Todd, the incident deserves analysis but does not change the fundamental security principles that have shaped Bitcoin since its creation. He argues that a hardware wallet failure represents an isolated technical risk, while centralized custody creates broader risks by concentrating control over user funds in a single entity.
Todd responded to criticism from industry figures who suggested the Coldcard event challenges the idea of “being your own bank.” Instead, he pointed to previous exchange failures that resulted in significantly larger losses for customers across the cryptocurrency sector.
One example is the collapse of QuadrigaCX, the Canadian cryptocurrency exchange that left users unable to recover more than $200 million in digital assets. Other failures involving platforms such as Mt. Gox and FTX also showed how centralized custody can create single points of failure affecting thousands of investors at the same time.
From Todd’s perspective, hardware wallet vulnerabilities can be addressed through security reviews, firmware improvements, and responsible disclosure processes. Exchange insolvencies, fraud, or operational failures, however, often leave customers with limited options because they no longer control their own private keys.
Todd believes the biggest challenge for self-custody is not Bitcoin’s technology but human error. He argues that securely managing a recovery phrase is a practical skill that users can learn with proper education and preparation.
He compares storing seed phrases to protecting passports, birth certificates, or other essential documents. While every security method requires responsibility, Todd believes self-custody demands a manageable level of discipline compared with many everyday activities people already perform.
The developer also supports broader educational initiatives focused on wallet management, backup methods, and recovery procedures. Improved user training could prevent many avoidable mistakes without forcing investors to surrender control of their assets.
