CZ warns Bitcoin holders after reported $70 million Coldcard exploit

Binance founder Changpeng Zhao told Bitcoin holders that "nothing is 100%" following an exploit that Decrypt put at roughly $70 million involving Coldcard hardware wallets, the outlet reported on August 1.

That is close to the extent of what has been established publicly. Decrypt's report is the account currently circulating, and it does not lay out the mechanics: whether the losses came from compromised or counterfeit devices, a firmware or supply-chain issue, seed-phrase phishing, or something else entirely. Those are very different failure modes with very different implications for anyone holding a Coldcard, and none of them has been confirmed. Coinkite, which makes the Coldcard line, has not issued a public statement matching the report, and no blockchain-forensics firm has been named as the source of the $70 million figure. Where that number originates — victim reports, on-chain clustering, or an estimate — has not been disclosed.

Zhao's remark is a general warning about the limits of any security setup, not a technical disclosure. He does not appear to have claimed knowledge of the attack path.

For context on the day: Decrypt's price ticker at publication showed Bitcoin at $62,936, Ether at $1,854.83 and BNB at $576.76.

Key facts

• ~$70 million — the loss figure attached to the Coldcard exploit (Decrypt, August 1, 2026; underlying source for the figure not identified).
• "Nothing is 100%" — Changpeng Zhao's warning to Bitcoin holders, as quoted by Decrypt.
• August 1, 2026, 16:01 UTC — timestamp of Decrypt's report.
• BTC $62,936 / ETH $1,854.83 / BNB $576.76 — prices on Decrypt's ticker at the time of publication.
• Unconfirmed: attack vector, number of victims, wallet firmware versions affected, and whether Coinkite has acknowledged an issue.

The real-world read

Two things deserve flagging.

First, who is talking. Zhao founded the largest centralized exchange, and a "self-custody isn't foolproof" message from that quarter is not disinterested — the alternative to holding your own keys is holding them at a venue like his. The point may still be true; the messenger has a commercial stake in it landing. Decrypt's headline leads with CZ rather than with the exploit, which puts an exchange founder's commentary in front of an unresolved security incident.

Second, the number is doing a lot of work with nothing under it. A $70 million figure with no named forensic source, no victim count and no described attack path is a headline, not a finding. Hardware-wallet losses are frequently traced to phishing and seed handling rather than device compromise, and the distinction determines whether Coldcard owners need to act at all. Until Coinkite or an on-chain analyst puts specifics on the record, treat both the size and the cause as provisional.

Opinion, and whose

• Changpeng Zhao (Binance founder): no security arrangement is absolute — "nothing is 100%." Attributed opinion, offered without supporting technical detail.
• Cleartext: the incident is under-documented, and the loss figure is unverified pending a primary source.

Sources

• Decrypt — "CZ Warns Bitcoin Holders After $70 Million Wallet Exploit: 'Nothing Is 100%'," August 1, 2026. Provided the $70 million figure, Zhao's quote, the Coldcard attribution and the market prices cited above. Secondary reporting; the outlet did not identify who produced the loss estimate. Not marketing or sponsored.
• No primary sources — no Coinkite advisory, exchange or forensic-firm report, or on-chain analysis has been located to corroborate the figure or the attack vector.

Not financial advice.