Casa Security Chief Urges Bitcoin Holders to Keep Self Custody
He says ETFs shift custody to institutions, recommending multisignature wallets, dispersed key storage and inheritance planning as vendors fix exploits.
Overview
- Casa security chief Jameson Lopp published an open letter on October 22 urging holders not to abandon self custody after a string of wallet security incidents.
- A Coldcard firmware configuration error dating to 2021 led affected devices to generate weaker recovery seeds that were linked in reporting to large suspected Bitcoin thefts.
- Ledger confirmed at least one device sold through a Southeast Asian reseller contained an unauthorized hardware implant, and Ledger says its direct sales channels were not shown to be compromised.
- Qubic disclosed that weak randomness in recovery seeds let attackers drain about 2.94 trillion QU tokens from 1,404 wallets and said it fixed the affected software.
- Lopp recommends multisignature wallets, splitting keys across different locations and hardware suppliers, and planning for loss or inheritance while vendors complete patches and investigations, noting that moving coins to ETFs or custodians shifts rather than removes risk.