Seven thousand three hundred wallets. Up to $130 million. One firmware bug that shipped in March 2021 – and nobody caught it for five years.
Now that the "fortress" has failed you, the people who sold it to you can’t agree on a single thing. Except one: you should hand your Bitcoin right back to them.
Strive says give it to a custodian. ARK says self-custody is "a disaster." Ledger says multisig is overkill. CZ says nothing is 100%. Everybody has an opinion. Nobody has liability.
The Facts
Here’s what actually happened. Coldcard firmware 4.0.0, shipped in March 2021, quietly disabled the hardware random number generator. Instead of the promised 128 bits of entropy, affected Mk2 and Mk3 devices generated seed phrases with as little as 40 bits. Later models? 72 bits. Still a rounding error for anyone with a GPU and a grudge.
Between July 30 and August 10, attackers drained 1,596 to 2,055 BTC – $100 million to $130 million – from more than 7,300 wallets. No phishing. No physical access. No user error. Just a single misconfigured line of code (the story we have covered since day one).
The victims did everything right: genuine device, offline seed generation, the recommended playbook. And they still got wiped. If you don’t know what entropy actually is, this week is your tuition bill.
Then the war started.
Joe Burnett, vice president at Strive – the company holding 20,000 BTC on its own balance sheet – called it "possibly one of the worst weeks in the history of Bitcoin." His fix? Large holders should trust institutional custodians like Fidelity and BitGo MORE than hardware wallets.
ARK Invest’s Lorenzo Valente went further: the entire self-custody hardware space is "a disaster." You’ve just traded counterparty risk for software risk, hardware risk, supply-chain risk, phishing risk and backup risk. Convenient timing – ARK literally sells ETFs. And sure enough, $626 million flowed into spot Bitcoin ETFs in the days right after the attack.
Casa says 233,000 BTC – around $15 billion – moved to safety, some from Ledger and Trezor users, some from multisig users pulling out their Coldcards. Nunchuk had to issue an urgent alert for Coldcard multisig users: if all your keys came from the same broken device, multisig was just brute force with extra steps.
And then Ledger’s CTO, Charles Guillemet, published the rebuttal: don’t rush to multisig. Complexity is a risk in itself. Miniscript, MuSig2, a properly backed-up single-sig wallet – that’s the answer for most people, he says.
He’s not entirely wrong. But read the room.
Why This Is Your Problem
Nobody in this fight is fighting for you.
Strive wants your coins in institutional custody. That’s a company with a balance sheet telling you to outsource your keys. ARK wants you in an ETF – it makes money whether your Bitcoin goes up or down. Ledger wants you in the ecosystem of the wallet it happens to manufacture. And the company that actually lost the money? Coinkite apologized in an email – while its competitors dance on the grave of its reputation.
Every single camp has a product for you. None of them have liability for you.
That’s the tell. The wallet industry’s own entropy audit shows exactly which devices bet your keys and which ones survived. One manufacturer’s bug is not a reason to hand your Bitcoin back to Wall Street – it’s a reason to stop trusting ONE manufacturer.
The Love Is Bitcoin Takeaway
Here’s the uncomfortable truth. Bitcoin didn’t fail. Self-custody didn’t fail. One company’s firmware failed. And the answer was never "give your keys to somebody else" – that’s the same trap you escaped when you left the exchange.
The real lesson is boring, which is why nobody wants to sell it to you: education first, hardware second. Verify where your wallet’s randomness comes from. Spread your risk across vendors. Understand your own setup well enough that a headline can’t scare you into a panic migration.
And if you’re going to buy hardware from a company, buy from one that shows you exactly where its entropy comes from – not one that quietly rolled dice for five years. We wrote about how Blockstream Jade publishes the source of every single bit of its randomness – open source, auditable, no faith required. That’s the standard you should demand from everyone touching your keys.
Stack accordingly: use code LOVEISBITCOIN at loveisbitcoin.com/bull and buy your next wallet from a company that treats your keys like they’re accountable for them. Because right now, the industry that just lost $130 million of your money is trying to sell you a new story. Don’t buy it. Buy Bitcoin – and hold it like you understand it.
So who are you going to trust?
The manufacturer that let $130 million walk? The competitor selling you "simpler" security? The ETF that wants your keys in a vault while it skims fees? Or yourself, with a setup you actually understand?
This article is for education only and is not financial advice.
THE MULTISIG WAR: $130 MILLION GONE, AND NOW THEY'RE FIGHTING OVER YOUR KEYS
