Hacks and Exploits: Where Should Your Bitcoin Live?
Record losses hit exchanges and cold wallets alike in 2026. Here’s what failed, what wallet makers have changed and why Bitfinex still says users should hold their own keys.
Crypto custody has been attacked from all sides this year, making 2026 an annus horribilis both for investors who self-custody and for those who trust others to keep their funds safe. Bad actors, sometimes powered by AI, sometimes not, have raised the bar for cybersecurity, leading those who believe in self-custody to seek to improve security systems so digital assets can be secured in the years to come.
Crypto security provider CertiK confirmed gross 2026 losses year to date were roughly $9.43 billion at the time of writing. October 2026 was the highest-loss month on record, mainly due to an attack on Binance, which saw $6.3 billion drained, in the largest crypto hack on record. Working with stablecoin issuers and partners, Binance was able to freeze approximately $2.85 billion in assets, subject to reconciliation and market-price changes. Furthermore, it said it would absorb the losses and by 3 November said it had replenished 98 percent of affected token assets. Overall, the amount stolen in 2026 represents a significant increase on the $3.4 billion hacked in 2025, according to Chainalysis.
Centralised exchanges have long been viewed as a suboptimal strategy for storing digital assets long term. Cold wallets, also known as hardware wallets, allow crypto investors to hold their own keys in a secure chip kept offline. They have long been viewed as an essential part of operational security for individual and institutional custodians.
Hardware Wallet Failures Hit Confidence
But confidence in cold wallets has been rocked after major incidents saw hundreds of millions in bitcoin and other assets stolen.
Coldcard, a wallet manufactured by Canadian Bitcoin hardware company Coinkite, was the largest. Starting July 30, 2026, attackers drained roughly 1,082 BTC (about $86 million at the time of writing) from over 5,000 addresses due to a firmware flaw.
Meanwhile, Ledger users lost an estimated $102 million in October, according to onchain analysts, after it emerged that genuine devices sold through CryptoBilis, an authorised reseller in Southeast Asia, had been fitted with hidden implants after leaving Ledger that transmitted users’ recovery phrases to attackers.
Cold wallets work by creating seed phrases, a list of 12 or 24 words generated from a random number drawn from a pool so large that no computer could ever guess it. The problem with Coldcard was a flaw traced back to a March 2021 firmware release.
It caused seed generation to fall back on a weak software random number generator rather than the device’s hardware-based source of entropy, according to blockchain intelligence company TRM Labs. This means that the pool of possible seed phrase formulations fell from about 340 trillion trillion trillion possibilities to roughly a trillion on older models, which was few enough for attackers to search from their own computers.
Coinkite has since released new firmware that requires “one user-sourced entropy method: at least 65 key presses with unpredictable timing, 50 rolls of a physical six-sided die, or 128 physical coin flips.” Adding new sources of randomness works because the result can only be predicted if every input can be predicted. However, it doesn’t help users who already lost their coins.
Multisig and the Push for Better Self-Custody
Multisig wallets have been tabled by the crypto industry as a strong solution and the idea is getting traction. Think of a safe that only opens when two out of three (or three out of five, etc.) keys are turned, but the keys should be made by three different locksmiths.
Using different manufacturers is critical because, in the case of Coldcard, building multisigs from multiple Coldcard devices may not have protected some users. “Multisig quorums built entirely from Coldcard keys were the next most vulnerable [after coins at addresses that had already been spent from],” wallet provider Nunchuk wrote.
For Bitfinex CTO Paolo Ardoino, the year has exposed weaknesses on both sides of the custody debate. Speaking on the Stephan Livera Podcast, he said that recent concerns about hardware wallet security had led some in the industry to view centralised exchanges as a safer alternative.
“And now we have seen … the Binance hack, and so centralised custody has also been subject to a lot of scrutiny and concerns,” he said. The answer, for Ardoino, is to simplify self-custody for the average user. “What I believe we should be doing as Bitcoiners is to promote much better user experiences for multisigs,” he said, referring to wallets that need several independent keys to move funds, so no single compromised device can empty them.
The Bitkey wallet is one attempt to bring the benefits of multisig security to non-technical users. It creates a Bitcoin-only, 2-of-3 multisig wallet, meaning the wallet requires two of three keys to approve any Bitcoin transaction, according to the company website. The user has two keys in custody with a third stored on the Bitkey server, meaning an attacker would need two of the three keys, for example the user’s phone and hardware device, to steal funds.
For Ardoino, the incidents in 2026 do not negate the need for self-custody but are instead a challenge to users and wallet manufacturers to protect themselves against more sophisticated bad actors. “We are a trading platform, we are not a bank,” he said. “We should not be a bank, and people should keep control of their funds.”
