Losses tied to the reported Coldcard wallet attack have climbed toward $89 million, turning what initially looked like a niche hardware-wallet alarm into a serious user-security event. The immediate lesson is uncomfortable: a device designed for self-custody does not protect funds if the buying process, setup instructions, recovery phrase, or connected computer has been compromised.
Cold storage means keeping crypto keys offline, which can reduce the risk of an exchange failure or an online account takeover. It is not a guarantee. Users can still lose funds through tampered devices, malicious software, fake support channels, unsafe backups, or signing a transaction they do not fully understand. The reported loss figure matters because it suggests the damage is no longer isolated to a handful of mistakes.
For holders, this is a reminder that self-custody shifts responsibility from a platform to the user. Buy wallets only from official channels, inspect packaging carefully, generate recovery phrases on the device rather than accepting a pre-made one, and never enter that phrase into a website, app, or support chat. Anyone who recently set up a wallet through a third party or followed unsolicited instructions should treat the setup as suspect and move assets using a safely created new wallet.
This is downside and risk-control news, not a verdict on Bitcoin itself. It matters most to long-term holders with meaningful balances and to wallet makers whose trust depends on secure onboarding.