The crypto industry is rekindling the debate on “Who Should Hold the Private Key” following the $13 million theft from the Coldcard wallet.

August 10th, a wallet security incident involving around $130 million worth of Bitcoin loss is rekindling the cryptocurrency industry's discussion on asset custody models: should Bitcoin holders rely on individual self-custody or switch to institutional custody.

Hardware wallet manufacturer Coldcard had a firmware vulnerability in 2021 that led to a random number generation flaw, causing some mnemonic phrases generated by the device to have a predictable risk. The vulnerability, discovered years later, has resulted in around 5,200 addresses and approximately 2,000 BTC being stolen, with a loss of approximately $130 million.

Following the incident, some investors started turning to Wall Street custody products. Data shows that the US Bitcoin spot ETF saw a net inflow of around $626 million in the days following the event. Bloomberg ETF analyst Eric Balchunas stated that such security incidents may further drive funds into ETFs.

However, the Bitcoin core community still upholds the self-custody ethos. Casa co-founder Jameson Lopp said that the recent event should not undermine users' confidence in self-custody and pointed out that third-party custody also carries risks. Bitcoin Core early developer Peter Todd also believes that self-custody has a better long-term security record than centralized institutions.

Bitcoin custody platform Onramp co-founder Michael Tanguma, on the other hand, believes that both solutions have flaws. He stated that concentrating a large amount of assets in a single institution creates a "honey pot," while hardware wallets face risks such as the supply chain, firmware, and random number generation.

Tanguma proposed a "multi-institutional custody" solution, where multiple regulated institutions hold keys through a multisig mechanism, requiring multiple institutions to sign off on any transaction to reduce single point of failure risks.

However, this model has also sparked controversy. Critics argue that while multi-institutional custody enhances security, it also introduces permissioned management, conflicting with Bitcoin's original decentralized ideal.

As Bitcoin gradually enters the pension, trust, and institutional asset allocation fields, the industry is seeking new custody solutions suitable for long-term wealth management. The Coldcard vulnerability incident once again highlights that balancing security, decentralization, and usability remains a core challenge facing the Bitcoin ecosystem.