Last week's ongoing Coldcard exploit has already drained more than 1,300 bitcoin (BTC), worth roughly $83 million, from thousands of addresses across multiple waves, making it one of the biggest self-custody failures in Bitcoin history.
The incident is also sparking conversations over how users should approach self-custody.
For Bitcoin security researcher and Casa co-founder Jameson Lopp, the incident doesn't invalidate self-custody, but he does see it as exposing the limits of one of Bitcoin's oldest principles: "Don't trust, verify."
Speaking with The Block on Monday's The Starting Block podcast, Lopp argued that the challenge isn't whether "don't trust, verify" is a worthwhile or valid principle; it's that few users can realistically put it into practice.
"It's a good mantra ... But you have to understand that verification of complex software and hardware is simply not feasible for 99.9% of the population," Lopp said.
