Crypto industry renews debate over who should hold private keys due to $130 million Coldcard wallet theft

Comparatively, a wallet security incident involving the loss of about $130 million in bitcoins is once again triggering discussions in the crypto industry about the asset escrow model: should Bitcoin holders rely on personal self-custody or switch to institutional custody.

Some firmware from hardware wallet vendor Coldcard had random number generation bugs in 2021, causing some mnemonic words generated by the device to be at predictable risk. The vulnerability was discovered many years later. Currently, more than 5,200 addresses and about 2,000 BTC have been stolen, and the scale of losses is about 130 million US dollars.

After the incident, some investors began to switch to Wall Street escrow products. The data shows that the US spot Bitcoin ETF had a net inflow of around $626 million in the days following the incident. Bloomberg ETF analyst Eric Balchunas said such security incidents could further drive money flows to ETFs.

However, the Bitcoin core community still adheres to the concept of self-trust management. Casa co-founder Jameson Lopp said recent events should not diminish users' confidence in self-hosting, pointing out that third-party hosting is also risky. Peter Todd, an early Bitcoin Core developer, also believes that self-hosting's long-term security record is superior to centralized institutions.

Michael Tanguma, co-founder of Bitcoin escrow platform Onramp, believes that both solutions are flawed. He said that concentrating large amounts of assets in a single institution will form a honeypot, while hardware wallets face risks such as supply chain, firmware, and random number generation.

Tanguma proposed a multi-agency hosting solution, that is, multiple supervised agencies hold separate keys through a multi-signature mechanism, and any transaction requires multiple agencies to sign together to reduce the risk of a single point of failure.

However, the model has also sparked controversy. Critics believe that although multi-agency hosting improves security, it also introduces licensing management, which conflicts with the decentralized concept that Bitcoin initially sought.

As Bitcoin gradually enters the fields of pensions, trusts, and institutional asset allocation, the industry is looking for new escrow solutions suitable for long-term wealth management. The Coldcard vulnerability once again highlights how to balance security, decentralization, and ease of use remains a core challenge facing the Bitcoin ecosystem.

This article is sponsored by GENG, Build Your Fortune on GENG (https://geng.one)