{"id":846723,"date":"2026-08-05T07:54:09","date_gmt":"2026-08-05T07:54:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/ca\/846723\/"},"modified":"2026-08-05T07:54:09","modified_gmt":"2026-08-05T07:54:09","slug":"after-140-million-hack-bitcoin-users-soul-searching-over-self-custody","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ca\/846723\/","title":{"rendered":"After $140-million hack, bitcoin users \u2018soul-searching\u2019 over self-custody"},"content":{"rendered":"

A major vulnerability in bitcoin wallets manufactured by a Toronto-based company has brought renewed scrutiny to the security of investments in cryptocurrency<\/a> after hackers exploited the weakness to steal more than $140-million worth of bitcoin in the past week.<\/p>\n

Bitcoin enthusiasts say that the hack, which took advantage of a coding error in hardware wallets made by Coinkite Inc., has shaken the cryptocurrency community and raised doubts over the best way for holders to store their assets.<\/p>\n

\u201cThere is a lot of soul-searching and re-evaluating going on. The bug was just shockingly bad,\u201d said Eric Chennells, a Vancouver-based cybersecurity analyst and cloud computing consultant.<\/p>\n

Coinkite didn\u2019t respond on Tuesday to The Globe and Mail\u2019s questions. <\/p>\n

Many users who see bitcoin as a way to be freed from the constraints of traditional financial systems have believed that self-custody \u2013 holding their own bitcoin in a wallet, rather than on an exchange or other centralized platform \u2013 is the safest way to store the cryptocurrency. That belief has been strengthened by high-profile cases such as the 2019 collapse of Canadian crypto exchange QuadrigaCX, which the Ontario Securities Commission said had led to user losses of at least $169-million.<\/p>\n

Opinion: From nothing bitcoin came, and to nothing it will return<\/a><\/p>\n

Financial regulators have flagged risks around crypto asset custody. In a notice in February, the Canadian Investment Regulatory Organization noted that \u201chistorical failures in the crypto sector, including losses due to hacking, fraud, inadequate governance, and insolvency, have demonstrated that custody arrangements are a critical point of investor vulnerability.\u201d<\/p>\n

Many in the bitcoin community have advised directly holding crypto, said Mr. Chennells, regardless of whether such concentration of risk is appropriate for an individual investor. <\/p>\n

\u201cThe problem is the community can tend to pressure people in one direction \u2013 ideological purity that you should only self-custody,\u201d he said.<\/p>\n

Despite their name, hardware wallets don\u2019t actually store bitcoin. The cryptocurrency exists digitally on a type of distributed ledger, known as a blockchain, with entries to that ledger validated and confirmed by a network of computers. Bitcoin wallets have complex private keys which are used to authorize transactions. Anyone with access to those keys has effective control over the associated bitcoin. <\/p>\n

\u201cCold\u201d wallets store crypto keys offline and can be as simple as a private key recorded on a piece of paper. Hardware wallets add a layer of security by keeping private keys on a dedicated device, requiring users to enter a PIN or password to authorize transactions.<\/p>\n

Opinion: Gold, bitcoin, SpaceX and the dangers of market chameleons<\/a><\/p>\n

A strong recommendation from a cryptocurrency-literate friend was enough to convince Jon Goodman, a Toronto-based author and former personal trainer, to use Coinkite\u2019s Coldcard Mk3 hardware wallet for a sizable bitcoin position he had built up over about a year and a half of steady investing. The bitcoin, one of his four \u201cinvestment pillars,\u201d alongside real estate, stocks and his personal brand, was part of a strategy to \u201cmake sure my family is looked after and we sleep well at night,\u201d he said in an interview.<\/p>\n

In just seven minutes on the evening of July 29, his wallets were emptied of more than 18 bitcoin, worth in excess of $1.6-million. New York-based Galaxy Research estimated on Monday that a total of 1,596 bitcoin has been stolen from Coldcard wallets, worth more than $140-million. <\/p>\n

A blog post<\/a> that Coinkite\u2019s support team shared with Mr. Goodman indicated that hackers had discovered a vulnerability in the part of the Coldcard wallet code used to create seed phrases \u2013 a combination of words used as a kind of master key for the wallet. While seed phrases are meant to be generated with a high degree of randomness from a huge pool of potential seeds, a coding error introduced in 2021 made seed phrases much easier to guess.<\/p>\n

The blog post said that attackers could use the easily-guessed seed phrases to determine wallet keys and find ones containing bitcoin, without requiring access to hardware wallets.<\/p>\n

In a social media post, Mr. Goodman said he never shared his seed phrase with anybody and had kept his devices disconnected from the internet, with his Coldcard wallet stored in a safety deposit box. He has filed police reports and a report with the Ontario Securities Commission.<\/p>\n

\u201cI think that there is a very legitimate chance that whoever is responsible for this will be caught and arrested,\u201d he told The Globe and Mail. \u201cI think that there\u2019s almost no chance that any of the funds are going to be recovered . . . There\u2019s just very little precedent.\u201d<\/p>\n

Vancouver\u2019s crypto-anarchist collective is searching for a new home<\/a><\/p>\n

In a blog post dated Sunday, Coinkite said it had been working directly with customers and \u201cwalking through recovery options together.\u201d It said it had also destroyed the remaining inventory of vulnerable Coldcard wallets, and had issued software patches to prevent the bug from affecting new seed generation.<\/p>\n

\u201cWe also believe this vulnerability is a warning for every company building Bitcoin hardware and software, not only us,\u201d Coinkite said in another post on Monday. \u201cWe\u2019re publishing this now, while the details are still fresh, because other companies need time to check their own code to prevent potential further loss.\u201d <\/p>\n

Recent artificial-intelligence-assisted reviews of the Coldcard software code did not catch the vulnerability, the company said.<\/p>\n

Mr. Chennells said bitcoin holders concerned about security vulnerabilities could consider diversifying their exposure. \u201cHold some in ETFs, some in a smaller vault, some in mining or ecosystem companies,\u201d he said. <\/p>\n

\u201cPeople have to make individual choices based on their risk tolerances and knowledge and principles.\u201d<\/p>\n

Some investors may have already begun to diversify. In response to questions from The Globe, Arturo Rossi, a spokesman for crypto exchange Kraken, said that the trading platform had seen \u201ca meaningful increase in bitcoin deposits during the event.\u201d<\/p>\n

Mr. Goodman says he intends to keep his holdings of a bitcoin fund within his TFSA, but is unlikely to rebuild the crypto pillar of his portfolio.<\/p>\n

\u201cI\u2019m not going to buy any more bitcoin. I\u2019m not going to do cold storage again.\u201d <\/p>\n","protected":false},"excerpt":{"rendered":"A major vulnerability in bitcoin wallets manufactured by a Toronto-based company has brought renewed scrutiny to the security…\n","protected":false},"author":2,"featured_media":846724,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[901,888,902,879,877,903,45,49,48,876,895,896,891,878,875,46,549,295,894,887,914,880,881,893,889,890,884,904,885,909,910,912,907,911,905,908,882,898,899,714,897,906,865,61,900,892,886,883,913],"class_list":["post-846723","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-alberta","tag-arts-news","tag-bc","tag-breaking-news","tag-breaking-news-video","tag-british-columbia","tag-business","tag-ca","tag-canada","tag-canada-news","tag-canada-sports","tag-canada-sports-news","tag-canada-trafficcanada-weather","tag-canadian-breaking-news","tag-canadian-news","tag-economy","tag-education","tag-environment","tag-federal-government","tag-foreign-news","tag-globe-and-mail","tag-globe-and-mail-breaking-news","tag-globe-and-mail-canada-news","tag-government","tag-life-news","tag-lifestyle","tag-local-news","tag-manitoba","tag-national-news","tag-new-brunswick","tag-newfoundland-and-labrador","tag-northwest-territories","tag-nova-scotia","tag-nunavut","tag-ontario","tag-pei","tag-photos","tag-political-news","tag-political-opinion","tag-politics","tag-politics-news","tag-quebec","tag-sports-news","tag-technology","tag-travel","tag-trudeau","tag-us-news","tag-world-news","tag-yukon"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/846723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=846723"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/846723\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/846724"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=846723"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=846723"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=846723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}