2415: 1,128 Bitcoin Stolen From ColdCard Wallets - Why Vanguard Bought The Dip Anyway

**Justin Verrengia** (0:00)
Now, some Bitcoiners did everything right. They bought a hardware wallet, they took custody of their own keys, yet still lost everything. Let's get straight into it, fam-a-lam. Everyone's asking the wrong question.
The question isn't whether Bitcoin failed. It didn't. The question is whether years of perfect financial discipline can be destroyed by a single flaw.
Over 71 million worth of Bitcoin has now reportedly been drained from affected Coldcard wallets, making this one of the most devastating incidents ever to hit the self-custody community. The victims were not reckless traders chasing meme coins or leaving coins on the exchanges. They were some of Bitcoin's most security-conscious holders. I want you to really think about that. They bought hardware wallets, this one in particular. This is a Coldcard. Of course, there's different models. I have several of them right here on my desk.
They took custody of their own keys and believed they had eliminated every point of failure, especially as these are advertised as air-gapped. They never touched the internet, the most secure device in the history of Bitcoin. Instead, a single vulnerability turned years of careful planning into irreversible losses. Samson Mow summed it up perfectly when he said this may be worse than an exchange hack because it struck at the core of sovereign Bitcoin holders. These were people who did everything they were told to do. They researched self-custody, rejected custodians and accepted the responsibility that comes with holding their own wealth. For many of them, the damage is irreparable. CZ also weighed in on an important reminder. Every hardware wallet can contain bugs. No security solution is perfect and every setup involves trade-offs. There's pros and cons. His advice was to avoid relying on any single device or vendor and instead think about diversifying security just as investors diversify risk. That distinction matters. Bitcoin didn't fail. Self-custody didn't fail. A reported vulnerability affecting one hardware wallet implementation doesn't change the fundamental principles that have made Bitcoin the hardest money on earth. If anything, there's another reminder that security is a process, not a product. And it's always evolving. There is no magical device that eliminates every possible risk forever. But while Bitcoiners spent the day debating Coldcard, something even bigger was happening behind the scenes. Vanguard, the $12 trillion investment giant, quietly increased its Bitcoin exposure by purchasing more strategy shares. The firm now owns roughly $1 billion worth of strategy and remains the largest institutional shareholder of the company. Right behind them is BlackRock, just FYI.
Vanguard owns roughly 8-10% of the outstanding shares, depending upon the reporting period. And I want you to think about that for a moment. One of the world's largest asset managers remains the largest institutional shareholder of a company that owns more Bitcoin than anyone else in the world. While BitcoinX was consumed by the Coldcard attack, Vanguard was quietly increasing its exposure to strategy. That's a pattern we have seen repeatedly throughout Bitcoin's history. Every major panic creates two very different reactions. One group becomes consumed by fear. The other looks past today's headlines and asks a much simpler question. Is the long-term investment thesis still intact? Vanguard clearly believes it is. At the same time, the political backdrop continues shifting in Bitcoin's favor. President Trump confirmed the Clarity Act remains a top priority. While Treasury Secretary Scott Bessent declared that America intends to remain the global leader in Bitcoin and digital assets. More than 1 million Americans have reportedly contacted their senators, urging lawmakers to pass crypto legislation, showing just how much public pressure is building around regulatory clarity. None of those developments erased the pain felt by those affected by the Coldcard incident, and anyone who lost Bitcoin deserves empathy, not ridicule. Their experience will likely influence how the next generation of Bitcoiners approaches self-custody, multi-sig and hardware wallet security. But markets have a funny way of revealing what really matters. While social media has spent the day focused on a $71 million attack, Wall Street focused on accumulating more Bitcoin. The people closest to the fear were asking how this could happen. The people allocating billions were asking how much more Bitcoin can we buy? History has a habit of rewarding the people who keep buying when everyone else is afraid. You know what I mean? So my question is, has the Coldcard attack changed how you think about self-custody? Now, let's break down today's biggest story, starting with the Coldcard attack and what every Bitcoiner must know. So as of this afternoon, there's 1,128 Bitcoin taken off Coldcard wallets thus far, and the attack is ongoing and it has been continuing now. This is the third day in a row. No Coldcard device is safe. At first, they reported certain models, but as an abundance of caution, I would say all Coldcard users should switch and move their Bitcoin to another device. And I know the next question becomes, but what if I don't have another device? I have to actually order one. Well, you can move your Bitcoin temporarily to a hot wallet, which is going to be more secure in my opinion than a compromised Coldcard because it seems the firmware has been affected and the hackers continue to exploit the defect, unfortunately. So this is an ongoing thing which is still occurring in real time. So if you know anyone using a Coldcard, regardless of the model, whether it's an Mk2, Mk3, Mk4, or MkQ, which is the bigger, sexier looking one, there's been reports of people losing all their Bitcoin completely drained. And it's heartbreaking to even read these stories at this point, but it's real and it's happening in real time. So warn people, spread the word, you know, before it's too late. And I'm going to share some more data with you just in. It gets worse. A third wave in what we suspect are hacks of Coldcard-generated addresses have been identified in which 207 Bitcoin has now been drained, wiped out. Our estimated observed size of the Coldcard hack is now 1367 Bitcoin, 88.6 million at today's value across 4585 addresses.