A hardware wallet vulnerability has led to the theft of more than 1,000 bitcoin, reigniting debate over the limits of how cryptocurrencies are stored. Some industry figures said the incident showed structural risks in self-custody, while other experts countered that a specific product flaw should not be expanded into a broader problem with storage methods.

On Aug. 2 local time, blockchain outlet U.Today reported that a growing security debate followed the theft of about 1,082.65 bitcoin in just 41 minutes through a Coldcard hardware wallet vulnerability.

Ari Paul (아리 폴), founder of BlockTower Capital, said the incident showed there is no way to store cryptocurrencies in a completely safe manner.

The trigger for the incident was a firmware vulnerability that affected multiple generations of Coldcard products. The attacker is known to have exploited the flaw to steal a large amount of bitcoin.

Jonathan Goodman (조너선 굿맨) said on X, formerly Twitter, that bitcoin worth about $1.6 million was stolen from his Coldcard wallet. He explained that the assets were kept in cold storage, and the private key was stored on a Coldcard device that had never been connected to the internet and was kept in a bank safe deposit box.

Paul said the incident was not a new threat but another example of the fundamental limitations of crypto storage structures. He said the Coldcard incident has not drawn major attention, but it ultimately shows how difficult it is to keep cryptocurrencies perfectly safe by any method.

He said neither self-custody nor third-party custody can be a complete solution. Leaving assets with a centralised exchange or custodian carries the risk of hacking or operational failure, while user-managed storage can still be exposed to hardware and software vulnerabilities.

Paul stressed that the issue was not limited to a specific hardware wallet maker. That is because all crypto storage methods ultimately operate on hardware and software foundations where vulnerabilities can arise.

He said in advanced economies, legal systems and property-rights protection may be a more effective way to safeguard financial assets than current cryptography. He added that in countries with unstable legal frameworks and financial systems, cryptocurrencies can still be a powerful tool to replace existing financial systems.

By contrast, Erik Voorhees (에릭 보어히스), founder of ShapeShift, countered that the incident should not lead to the conclusion that storing cryptocurrencies is itself impossible.

Voorhees said there is no risk-free storage method, but each approach has different risks as well as strengths and weaknesses. He said cryptocurrencies worth hundreds of billions of dollars have been stored safely over recent years, and argued the incident should be viewed as a defect in a specific product.

The Coldcard incident has brought back to the forefront a long-running debate over whether self-custody or custodial storage is safer. Discussions are expected to continue over where responsibility for crypto storage should lie, with individuals or institutions, alongside stronger security measures in the hardware wallet industry.