SDE ep. 41: Bitcoin Self-Custody After ColdCard
In episode 41 of Separating Money and State, Matías Mathey returns to the program in emergency mode, days after the Coldcard incident, not as an analyst of the technical failure but as someone who was on the ground attending to scared people: calls, workshops, spaces, a free tutorial on setting up passphrases for eighteen wallets.
His framework for the crisis is urgent versus important: the urgent is not to lose funds ---even if that means temporarily going through an exchange, against the purist reflex of no-KYC--- and the important comes later, when there is time to think about hardware, multi-signature, inheritance. Regarding the underlying dilemma ---how much complexity is too much--- he brings the best material of the episode: the Argentine grandfather who hid dollars under the tiles and took the secret to the grave. The paranoia that destroys wealth was not invented by self-custody.
Matías proposes a concrete and difficult solution: cross-auditing among competitors ---Trezor reviewing Blockstream and vice versa--- with multiple approval processes like ISO standards, and admits in the same sentence why it doesn’t happen: egos and commercial interests.
The most relevant points:
- None of his close clients were affected; several had Coldcard MK4 with passphrase and made migrations or reinforced their configuration.
- Initially, it was believed that the problem was limited to devices with the 2021 firmware, but funds were also taken from MK4 devices.
- Jameson Lopp pointed out that most people will not audit the code of companies and end up trusting.
- According to Coldcard, the company ran its code through various artificial intelligence services and did not detect the vulnerability.
- The attacker is moving funds through a mixer, presumably Wasabi.
- A user identified as Krwed was pointed out on social media as the coordinator of the CoinJoin used, and he positions himself in favor of anti-censorship and non-confiscability.
- According to Matías, there was autonomy at Coldcard for developers to upload certain changes to the code without third-party review.
- About a month ago, a notary in Romania was hacked and property records were deleted; similar situations occurred in Poland, Greece, and Croatia.
- After the incident, record peaks of on-chain transactions were reached by users leaving Coldcard or changing configurations.
- Charles Guillemet from Ledger has pointed out that the cost and effort relationship of reviewing code changes completely when done by an automated agent instead of a human.
- There is a Bitcoin Red Team, with participation from the CEO of Anchor Watch and Calle from Cashu, that reviews code with artificial intelligence.
- According to Calle, that review has found about one critical vulnerability per person per hour in the analyzed projects.
- Matías tests multi-signature configurations, including four of ten schemes with hardware wallets.
- In the same week, Boltz suffered a sustained attack for several days and suspended services before funds were compromised.
- The fall of Boltz had repercussions on other services in the industry.
- Covenants would allow establishing spending conditions, such as restricting the sending of bitcoin only to predefined addresses, something that is currently not possible.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

Dan Koe: The Counterintuitive Truth That You Don't Need to Remember Everything You've Read

BNB Chain sues ex-employee over $628K memecoin trade

Popular Interaction Collection | Axis Robotics 'Zero-Roll' Task; Orbinum Testnet Experience (July 30)

I tested with $10,000: zero wear and tear, annualized 8%, and can earn points (with complete tutorial + screenshots)

Crypto Regulation News Update 2026: CLARITY Act, SEC-CFTC Framework, and 1099-DA Cost Basis Reporting Goes Live
Latest crypto regulation news April 2026: CLARITY Act stalled over stablecoin yield, Senate window closing. IRS Form 1099-DA cost basis reporting now mandatory. SEC-CFTC taxonomy guide. Actionable compliance insights.

Crypto Tax Deadline 2026: How to Generate 2026 Crypto Tax Reports (WEEX & KoinX Fast Tutorial)
Still filing crypto taxes close to the 2026 deadline? Follow this step-by-step WEEX Tax API + KoinX workflow to export data and generate an accurate crypto tax report quickly.

The Cryptographic Past of the Middle East

WEEX-OTC trading launches OSL payment channel
WEEX has officially launched our Quick Buy feature and added OSL Pay channel to help make fiat deposits more convenient and accessible.

SQD adds validated onchain data to Google Cloud BigQuery

Term Finance closes Meta Vaults after estimated $8.5M attack

CryptoQuant's Risk for Bitcoin: Ki Young Ju Identifies the Main Threat to Bitcoin

Judicial Investigation Agency Raids Properties of Alias 'Gato's' Children in Costa Rica Case Expansion

Goldman Sachs backs crypto stocks amid Bitcoin breakout

Fixed-term deposits in dollars: what you earn by investing $2,000

Bitcoin Spot Demand: The Signal That Hadn't Reappeared Since the October 2025 Record

Cofund Maps Over 24 Bitcoin Covenant Use Cases

Purchase of Cryptocurrency Through Intermediaries Will Be Available to Unqualified Investors

Saudi Arabia Leads Mecca Agreement, Oil Dollar System Faces New Trust Test

$1 Billion in 48 Hours: X Prepares Crypto Trading Function on Feed

The forex complex: How retail traders are adapting to volatile 2026 markets

Trump Beats the Fed: How Trading Boom Explodes in the UAE

LayerZero Unveils ATLAS Exchange Engine

Chile Requests the Extradition of Two Venezuelans Who Laundered Nearly USD 19 Million for the Tren de Aragua

Crypto investors should favor systematic strategies over Fed predictions, Moon Pursuit Capital says

MEXC stock futures trading volume in Asia surges over 3,300% in Q2

Operation Lighthouse: 14,000 Leads Delivered to Investigators Against Child Exploitation Networks

Binance founders used ‘The Simpsons’ codenames, former employees share

Crypto: Solana ETFs Record Their Biggest Day of the Year

Ray Dalio Warns of U.S. Debt Crisis and Recommends Gold and Bitcoin as Protection

Xbox and PlayStation Reassess Their Multiplatform Strategy, Emphasizing Exclusivity Again
Dan Koe: The Counterintuitive Truth That You Don't Need to Remember Everything You've Read
BNB Chain sues ex-employee over $628K memecoin trade
Popular Interaction Collection | Axis Robotics 'Zero-Roll' Task; Orbinum Testnet Experience (July 30)
I tested with $10,000: zero wear and tear, annualized 8%, and can earn points (with complete tutorial + screenshots)
Crypto Regulation News Update 2026: CLARITY Act, SEC-CFTC Framework, and 1099-DA Cost Basis Reporting Goes Live
Latest crypto regulation news April 2026: CLARITY Act stalled over stablecoin yield, Senate window closing. IRS Form 1099-DA cost basis reporting now mandatory. SEC-CFTC taxonomy guide. Actionable compliance insights.
Crypto Tax Deadline 2026: How to Generate 2026 Crypto Tax Reports (WEEX & KoinX Fast Tutorial)
Still filing crypto taxes close to the 2026 deadline? Follow this step-by-step WEEX Tax API + KoinX workflow to export data and generate an accurate crypto tax report quickly.







