In a fresh twist for Bitcoin security debates, early developer Peter Todd has stepped forward to defend self-custody despite a recently disclosed $88 million bug in Coldcard hardware wallets. While the flaw grabbed headlines, Todd argues it doesn't erase the fundamental risks posed by centralized exchanges — pointing to the infamous QuadrigaCX collapse as proof. His message: DIY storage remains the lesser evil, even when hardware isn't perfect.

Understanding the Coldcard Bug and Its Fallout

The bug, which affected certain Coldcard devices, exposed a potential vulnerability that could, in theory, let an attacker siphon funds under specific conditions. The $88 million figure represents the total value at risk, though not all of it was lost. Still, the news sent ripples through the crypto community, prompting questions about whether hardware wallets are truly 'unhackable.'

Coldcard, known for its air-gapped and open-source approach, quickly patched the issue and urged users to update firmware. But the incident served as a stark reminder that no single piece of hardware is infallible. For Todd, however, the reaction to the bug misses a bigger picture: the systemic dangers of trusting third parties with your keys.

Why Peter Todd Still Backs Self-Custody

Todd, a prominent figure in Bitcoin's early development, argued that the Coldcard bug, while serious, does not change the calculus for most users. 'Hardware wallets can have bugs, but exchanges have a track record of catastrophic failures,' he said, referencing QuadrigaCX. In that 2019 case, the exchange's CEO died with sole access to cold wallets, locking users out of roughly $190 million in funds — a loss that dwarfed typical hardware wallet exploits.

His logic is straightforward: self-custody puts the risk in your hands, but it's a risk you can mitigate with redundancy, verification, and careful handling. Centralized platforms, on the other hand, concentrate risk into a single point of failure — be it a rogue employee, a server hack, or a sudden shutdown. For Todd, the choice is clear.

The QuadrigaCX Lesson That Keeps Echoing

QuadrigaCX remains a cautionary tale for anyone tempted to leave funds on an exchange. When founder Gerald Cotten died in India, the exchange's cold wallets were inaccessible, and users faced years of legal battles to recover even a fraction of their assets. The incident highlighted a fundamental truth: not your keys, not your coins.

Todd sees the Coldcard bug as a minor blip in comparison. 'An $88 million bug is scary, but it's a fraction of what's lost to exchange failures every year,' he noted. He also stressed that Coldcard's open-source nature allowed the bug to be found and fixed quickly — a transparency that centralized services rarely offer.

Practical Steps to Harden Your Self-Custody Setup

For those worried about hardware wallet vulnerabilities, Todd suggests a multi-layered approach. First, always verify the firmware you're installing comes from the official source. Second, consider using a multi-signature setup, where multiple devices or keys are required to move funds. This way, a single compromised device doesn't spell disaster.

  • Keep firmware updated — patches are released for a reason.
  • Use a passphrase — adds an extra layer of security beyond your seed phrase.
  • Test recovery — regularly ensure your backup phrase actually restores your wallet.
  • Diversify storage — split funds across different hardware wallets or a multisig scheme.

These steps don't eliminate risk, but they make it manageable. Todd also recommends staying informed about known vulnerabilities for your specific device model, as the crypto security landscape evolves rapidly.

Centralized Exchanges: The Convenience Trap

Despite the bugs, self-custody requires technical know-how that many casual users lack. Exchanges offer ease of use, instant trading, and customer support — perks that hardware wallets can't match. Yet Todd warns that convenience often comes with hidden costs, as seen in multiple exchange collapses and hacks over the years.

He acknowledges that not everyone is ready to be their own bank, but encourages users to at least hold long-term savings in their own wallets. 'If you're actively trading, an exchange might make sense. But for your stack, self-custody is the only way to truly own it,' he said.

Key Takeaways

The Coldcard bug is a valuable reminder that no tool is perfect, but it doesn't invalidate the case for self-custody. Peter Todd's stance, grounded in years of Bitcoin experience, is that hardware wallet flaws are manageable, while exchange failures are often catastrophic. By adopting robust security practices, users can protect their assets without relying on third parties.

Ultimately, the debate isn't about which hardware is flawless — it's about who holds the keys. As Todd put it, 'The only way to avoid the risk of losing everything to a centralized failure is to take control yourself.' For many in the crypto community, that's advice worth heeding.