Everyone cannot be their own bank · ↗ www.coindesk.com

Over the last few days, numerous Bitcoin wallets linked to the hardware wallet Coldcard have been completely drained. The attacks were first publicly reported on July 30. Since then, one or more attackers have stolen nearly $89 million USD worth of Bitcoin (as of August 1).

Briefly, Coldcard is a hardware wallet designed to keep the private keys controlling bitcoin offline, which should make them harder to attack. But there was a flaw introduced in the firmware in 2021 in how keys were created. This flaw allowed an attacker to reproduce users’ private keys and drain their wallets without ever touching the physical devices.

This latest incident, one in a very long string of security failures linked to Bitcoin self-custody, is another bitter lesson for those who believe Bitcoin is the future of finance. Bitcoin may be “trustless” in the abstract, but using it requires trust all the way down. It is just a matter of picking your poison. Do you trust the developers of a software wallet? Do you trust the developers of a hardware wallet and trust that the device was not tampered with en route to you? Do you trust the stone tablet on which you etched your seed phrase? Or do you trust the centralized exchanges through which the vast majority of Bitcoin trading happens in practice?

The truth is, not everyone can afford to be their own bank. Banks have security audits, fraud teams, and insurance for when things go wrong. Coldcard users were the true believers. They were the guys doing everything they were supposed to do to secure their coins. In the end, they were left with nothing but the assurance that Bitcoin is designed to make it mathematically impossible to recover those coins if there is even the tiniest flaw in the chain of trust.

One reaction on the Bitcoin subreddit to an early report of the theft illustrated this insanity almost comically well:

The amount of disinformation in this thread is crazy, let me clarify some points here:

1. Bitcoin is secure. It’s not trash nor easy to steal. Typically, the only way to steal bitcoin is social engineering the owner of a wallet.
2. It was OP’s own fault. Somewhere along these years, likely recently, he exposed his seed phrase. It would help if the OP actually wrote a post explaining the timeline rather than replying “yes” “no” and “probably” to people.
3. I’m done. It’s a simple case of someone not paying attention when they should have. It’s gut-wrecking for sure, but that teaches you a lot.

In short: shut the hell up, it’s not Bitcoin that failed, you did.

And that’s the whole thing, isn’t it? If you don’t have the physical security of a bank, the operational discipline of a deep-cover spy, and the steely nerves of a professional gambler, you ain’t cut out for this game. And that’s why crypto self-custody will never be mainstream.

Not your keys, not your coins.