Custody Was Never About the Key

The most striking thing about the Coldcard exploit is what did not happen. Nobody broke into a house. Nobody seized a device or shoulder-surfed a PIN or phished a seed phrase. The attackers never touched the hardware at all. They simply guessed the keys, because a firmware build from 2021 had quietly fallen back to a weak software source of randomness instead of the chip's hardware entropy, collapsing the effective strength of some keys from 128 bits to as little as 40. Forty bits is guessable with ordinary computing power. So over a few days beginning in late July, starting with a sweep of roughly 1,080 bitcoin, about $70 million, drained from nearly 1,200 addresses in 41 minutes, and climbing to a reported $88 million across some 4,600 addresses in the days after, an attacker reconstructed keys that were never supposed to be reconstructable.

I want to start by saying something that usually gets lost in these stories: the people who lost funds did nothing wrong. They chose cold storage. They held their own keys. They followed the most security-conscious advice in the entire space, and Coinkite, to its credit, confirmed the flaw and moved to help users migrate. This is not a story about careless people or a bad product. The people involved were the careful ones. That is exactly why it is worth thinking about clearly, because when the careful path fails, the problem is usually not the people. It is an assumption underneath the path.

The assumption is this: that custody is possession of a secret.

We have run this experiment before

Here is the part that should feel familiar to anyone who has spent time in traditional finance. A signing key on a device, where holding the secret is the whole of ownership and losing it is final, is a bearer instrument. It is the coupon bond in the safe deposit box. It is the paper stock certificate that meant title only because you physically had it. And finance spent most of the twentieth century deliberately getting rid of that model, through immobilization, dematerialization, and client-asset rules, precisely because possession-as-title could not express the positions institutions actually needed to hold, and because a bearer instrument turns every fire, theft, or accident into total, unrecoverable loss.

Self-custody, in the form we practice it today, is bearer form reinvented in firmware. It carries the old model's great virtue, no intermediary standing between you and your asset, and it carries the old model's original sin, that a single secret is the entire relationship between you and what you own.

And notice the reflex the exploit is already producing. Analysts are predicting a rotation out of self-custody and into regulated custodians and ETFs. That is understandable, but it is not a resolution. It is just the other end of the same pendulum. The custodial model solves the fragility of the single secret by handing the asset to an intermediary, and buys a different problem in exchange: the record of what you own now lives in a system separate from the asset itself, kept aligned by reconciliation and segregation policy rather than by structure, which is how client-asset failures happen even at supervised, well-run institutions. Self-custody makes the secret everything. Custodial models make the intermediary everything. Both are still answering the wrong question, which is "who holds the thing," when the question that matters is "what rights exist, and who can prove authority over them."

What custody is actually made of

Strip custody down and it was never one thing. It is a bundle of distinct rights that we have simply been storing in a single physical fact. There is ownership. There is possession. There is the right to use, and the right to dispose. These are not the same, they do not have to sit with the same party, and mature finance treats them as separable all the time: a security can be owned by one entity, held by a custodian, lent to a third, and pledged to a fourth, each right registered and accounted for on its own.

A signing key erases all of that distinction and fuses it back into one secret. Whoever has the secret has everything, and whoever loses it loses everything, because the model has no way to say that ownership might persist even when the ability to act on it is gone.

The alternative is to register the rights themselves rather than a proxy for them. Treat an asset as a graph of decomposable rights, ownership, possession, use, disposition, as independently held nodes, and custody stops being "who has the key" and becomes "what is registered, and to whom." The right lives on the record. The key does not embody the asset; at most it proves an authority to act on it.

That distinction is the whole game, and it is worth being precise about the second half of it, because authority is where this gets concrete. Authority, done properly, is not possession of a secret and it is not a password. It is a cryptographic proof that a specific action is within the scope of a specific permission, granted by a specific principal, and it is evaluated before the action executes. An action outside that scope is not flagged after the fact and unwound. It does not execute at all. There is nothing to reverse, because nothing happened.

Put the two together, rights registered as their own nodes, and authority expressed as a scoped, provable permission, and the meaning of a lost key changes entirely. If your ownership is a registered right and not the key itself, then losing the device is losing a credential, not losing the asset. What you have lost is a current means of proving authority, which is a problem of re-establishing authority, not the silent, total, irreversible disappearance of everything you owned. What that re-establishment should look like is a real design question, and an honest one, it has to be at least as hard to fake as the loss was to suffer. But it is a design question you are only allowed to ask once you stop pretending the secret and the asset are the same thing.

The point is not which pole to pick

This is the work we do at Conduit, and I will keep that part short, because the argument stands without it: model custody as decomposable, registered rights, and authority as a proof checked before execution, on infrastructure where each party keeps its own privacy-preserving record rather than everything living on one shared ledger. Whether or not you ever build it that way, the Coldcard exploit is a clean, costly lesson that the industry should not waste by turning it into a self-custody-versus-custodian argument.

Both of those are answers to "who holds the secret." The people who lost funds last week were failed by that question, not by their own diligence. Custody was never about who holds the key. It is about which rights exist, who owns them, who may act on them, and how far that authority extends. We worked that out for almost every other instrument a century ago. The exploit is a reminder that we quietly un-learned it, and that the fix is not to trust a custodian instead. It is to give custody back the structure it always deserved.