A case in which an unauthorized component was inserted into a Ledger hardware wallet has reignited debate over how bitcoin should be stored. The industry is divided over which is safer: self-custody, in which individuals manage assets directly, or bitcoin spot exchange-traded funds (ETFs) managed by professional custodians.

Cointelegraph reported on Oct. 12 that an unauthorized hardware implant attack was recently found in a Ledger wallet, highlighting physical security issues for cold wallets. Some blockchain investigators estimated potential losses from such attacks could exceed $86 million. Hardware wallets have been widely used to store private keys in an environment separated from the internet, but the case showed that trust in manufacturing and distribution processes matters as much as security of the device itself.

Indirect holding through bitcoin spot ETFs is again drawing attention as an alternative. Bitcoin analyst PlanB recently reiterated his decision to move his bitcoin holdings to an ETF in 2025, saying he has no regrets. Citing security issues involving Coldcard and Ledger, he assessed that managing a wallet personally is not necessarily the safer choice.

Moves by institutional investors are also in focus. Ophelia Snyder (오필리아 스나이더), a co-founder of 21Shares, explained that large bitcoin holders have been shifting self-custodied assets into ETFs for years to strengthen security. Using professional custodians can reduce the burden of managing security devices directly or building recovery systems, she said. Snyder called security one of an ETF's main advantages and said recent hardware wallet attack cases are making the discussion more public.

Still, others argue it is difficult to conclude that the security of hardware wallets has fundamentally collapsed. Adam Back (애덤 백), Blockstream's chief executive and the inventor of Hashcash, said hardware wallets can still be a safe way to store assets. The issue is less the existence of the device itself than whether manufacturers sufficiently understand and respond to new types of attacks, he said. He said some manufacturers appear to lack sufficient understanding of common attack methods and stressed the need to improve threat modeling.

Another challenge for self-custody is users' technical understanding. Snyder pointed out that wallet setup, management and recovery procedures vary by individual, which can lead to differences in security levels. Even if a hardware wallet is designed to be safe, an incorrect initial setup or careless handling of recovery information can result in the loss of assets. As individuals secure direct control over their assets, they also take on the security responsibility that comes with it.

Concerns have also been raised that a concentration of assets in ETFs could create new risks. Jameson Lopp (제임슨 롭), a bitcoin security researcher and cypherpunk, assessed that self-custody wallets remain a valid option and stressed caution against hastily moving large amounts of assets solely due to security concerns. A rapid shift from personal storage to ETFs could concentrate asset management in a small number of custodians, creating a new single point of failure.

Ultimately, self-custody and ETFs carry different risks. Self-custody lets individuals exercise direct control over their assets, but requires them to take responsibility for private key management, device security and recovery procedures. ETFs can reduce the management burden through professional custody, but they differ from directly holding bitcoin itself and also limit investors' control over the assets.

The Ledger wallet case shows that the key issue is who bears security responsibility, rather than a conclusion that one method is absolutely safe. The debate over how to store bitcoin is expected to continue, focusing on private key management technology, the security capabilities of hardware manufacturers and the reliability of institutional custody systems.