Coldcard Losses Top $100 Million: ARK's Valente Calls Self-Custody A 'Disaster' And Turns More Bearish On Zcash

Ark Invest’s Valente added that the value of Zcash’s privacy lies in self-custody, which remains too risky for most users

• The Coldcard wallet exploit has led to losses above $100 million, according to Galaxy Research 
• The firm estimated that over 2,000 BTC have been drained across multiple confirmed and suspected waves of attacks. 
• The self-custody ecosystem was a “disaster,” ARK Invest’s Lorenzo Valente said, “people have just traded counterparty risk for software risk, hardware risk, and operational risk.”

The crypto industry’s long-standing debate over self-custody has intensified with the Coldcard hardware wallet exploit. According to Galaxy Research, the Coldcard hardware wallet has been subjected to multiple rounds of attacks, with more than 2,000 bitcoins stolen, involving over $100 million in funds. Reacting to it, Ark Invest’s director of research, Lorenzo Valente, called the self-custodial hardware space “a disaster at this point.”

Coldcard Exploit Tops $100 Million

Galaxy Research explained that about 7,300 addresses had been drained of 1,596 BTC in three confirmed waves of attack and 14 smaller events. The first wave on July 30 was the most damaging, with 1,082.65 BTC, followed by a second wave of 76.16 BTC and a third of 208.24 BTC.

The firm said the attacker hadn’t touched any of the confirmed stolen funds, with 100% remaining in the destination wallets in all three waves. Galaxy also identified a suspected fourth wave of 448.73 BTC swept from 709 addresses, as well as a smaller pattern-matched set of 15.27 BTC. The total is about $130 million or 2,055 BTC, including the unconfirmed attacks. Galaxy said 85% of the suspected fourth wave is still in the original addresses.

ARK: Self-Custody Is A Disaster

Users have “traded counterparty risk for software risk, hardware risk, supply-chain risk, phishing risk, backup risk and the chance of losing everything through one mistake,” noted Valente. 

He cited breaches by Ledger, security disclosures by Trezor, and a seed-generation failure by Coldcard as evidence that the industry “has not built tech good enough for consumers to self-custody.” “Quite frankly, users are better off today holding funds in several publicly traded exchanges or ETFs,” he said.

Why Valente Turned Bearish On ZEC

The Coldcard hack also reinforced Valente’s bearish view on Zcash (ZEC). He noted that Zcash’s central value proposition of private, shielded transactions was only realized when users self-custody and transact on-chain. 

Anyone holding ZEC through an exchange, broker, or an exchange-traded product (ETP) was "generally just price exposure" and could not "use any privacy features," he wrote. 

ZEC’s price was up over 1% during the past 24 hours. On Stocktwits, the retail sentiment around ZEC remained in the ‘neutral’ zone, while chatter around it stayed in the ‘normal’ zone over the past day.

Debate Grows Louder

Binance (BNB) co-founder Changpeng Zhao also commented on the development, saying that it was "statistically safer to store coins on exchanges than to self-custody." 

Analyst Willy Woo estimated victims have only a 20-40% chance of partial recovery, and that any recovery would take multiple years.

Bitcoin's price was also up over 1% during the past 24 hours. On Stocktwits, the retail sentiment around BTC remained in the ‘bearish’ zone, while chatter around it stayed in the ‘normal’ zone over the past day.

For updates and corrections, email newsroom[at]stocktwits[dot]com<