Beginning 30 July, an attacker started sweeping bitcoin from addresses generated by Coldcard, a bitcoin-only hardware wallet made by Canadian firm Coinkite. Coinkite’s advisory traces the problem to a firmware change in March 2021 that handed key generation to a predictable software randomizer instead of the chip’s hardware one. That narrowed the range of possible keys far enough for an attacker to reconstruct them offline, without ever seeing the device. ”7What a wrapper solves, and what it does notAn exchange-traded product does not abolish key risk. Peter Todd, an early Bitcoin developer, put the counter-case directly: “Self custody has a much better track record than third parties.”