Written by: imToken

After the Coldcard incident, one question was raised again: If hardware wallets can also make mistakes, possibly leaving hidden dangers from the moment of key generation, why should we still custody our assets ourselves?

Our judgment is: Self-custody is still important. It allows users to maintain ultimate authorization over on-chain operations and retains the possibility of independent migration if a platform or service fails. Coldcard has not changed this value, but it has made us re-examine "how to securely possess control."

Security cannot rely on just one label

According to the official announcement from Coldcard and Block's technical analysis, an integrative firmware error caused some devices to not use hardware random numbers as expected, but instead followed a predictable software random number path. Normal-looking mnemonic phrases might have failed to achieve the necessary security level from the stage of key generation.

In many public cases, users did not click on phishing links or expose their mnemonic phrases, but simply created wallets as per the product's default process. The issue occurred at the source of key generation, and no matter how carefully the keys are stored afterward, this gap cannot be filled.

This incident has shattered a common cognitive shortcut: hardware, offline, or open-source can enhance security, but no single label can stand alone as a conclusion of security. Ordinary users cannot audit firmware line by line. Ensuring that the default path is reliable is a responsibility that security products should bear.

After the incident, OKX reported a significant inflow of funds to the platform. CZ subsequently cited a set of historical data, suggesting that "statistically, storing assets on exchanges is safer than self-custody." It's not surprising that this statement would gain agreement.

Mature custodial institutions can invest more resources to establish professional security and recovery systems. For individuals lacking key management experience, allowing institutions to handle this part of the work may indeed reduce the difficulty and risk of managing keys independently. Acknowledging this does not diminish the value of self-custody; instead, it can bring the discussion back to the real circumstances of users.

However, historical loss figures are difficult to directly translate into answers for today. The River research cited by CZ also indicates that early BTC permanently lost data is hard to accurately attribute, with a vast majority occurring before 2020; losses at exchanges are also not completely quantifiable, with some compensation not deducted. These cumulative figures have yet to be adjusted by asset scale and holding time. They demonstrate that both methods have incurred significant losses, but they are insufficient to gauge today's actual risks.

More importantly, such comparisons typically only account for "whether assets have been lost" but rarely address "whether they can be withdrawn when needed" and "whether one can exit after a platform issue." Custodians can lessen the pressure of managing keys personally, but they also require users to rely on institutions to continue operations, fulfill payment obligations, and provide access to accounts.

Self-custody preserves an alternative path

Self-custody is essentially an arrangement of control. For common self-custody accounts, users control the private keys or meet the key conditions required for signing, and wallet developers and other service providers cannot unilaterally grant effective authorization.

As long as users still hold valid keys or backups, even if the original wallet stops servicing, they can typically recover their accounts using compatible tools; when users need to transfer assets or utilize on-chain applications, they do not have to wait for a platform to permit withdrawals first.

This independent path is the most crucial value of self-custody.

It certainly has boundaries. Network and contract rules may still influence asset usage. What self-custody preserves is that the ultimate authorization for on-chain operations does not have to rely entirely on a single institution, rather than an absolute control over all external conditions.

This value is not obvious when a platform operates normally. It's somewhat akin to a backup: it does not make daily operations faster, but it determines whether users still have choices when the original path fails.

Therefore, there is no one-size-fits-all answer for custody and self-custody. For those who currently lack the ability to manage keys securely, choosing a custodial service that has been prudently evaluated is reasonable; for those wishing to reduce reliance on a single institution, establishing a path that allows for independent recovery and migration is also important. The key is not which side to stand on, but understanding what risks you have relinquished and what capabilities you have retained.

Control should not be a burden solely on the user

User control of private keys does not mean that product providers can bear less security responsibility. Ordinary users cannot verify the entire process of key generation to firmware construction in a device. Products need to verify key paths, expose anomalies in a timely manner, and respond transparently after issues arise. Security should derive from reliable default designs and must not rely on users to uncover hidden technical risks.

Users also need to confirm that backups indeed facilitate recovery, clarify what they are authorizing before signing, and understand in advance how to migrate if key tools fail. However, these abilities can be gradually developed. Self-custody should not be an exam that requires everyone to immediately transfer all assets, nor should it demand that each person become a cryptography expert.

For imToken, supporting self-custody begins with making such choices more reliable. Users need to comprehend what they are authorizing, know how to recover, and be able to migrate to compatible tools when necessary. Only then does control become more than just a slogan.

The Coldcard incident has not rendered self-custody unimportant; rather, it has made security responsibilities more concrete. The next phase's challenge is how to enhance security, recovery, and usability while retaining user control.

Users can choose custodianship and can leave it when needed; they can possess control without having to bear all the complexity alone. This is the new meaning we discuss regarding self-custody after Coldcard.