Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong. Take 2 mins to learn more.
It has been a bruising year for Bitcoin security. The headlines have carried the losses without the detail, and the detail is where the lessons are. Five things worth taking from the conversation with what is happening across the market, and what each means for how Xapo is built.
1. How one line of code broke every key
Coldcard is where the year's damage was most visible. The holders who lost Bitcoin had done everything right. They self-custodied on a reputable device and carefully managed their own keys.
Joey Garcia explained why that was not enough. A Bitcoin private key is an enormous random number, and all of its security comes from that randomness: there are about as many possible keys as there are atoms in the visible universe. Guessing one is impossible. But computers are bad at randomness. Software follows instructions, so what it calls random is usually a formula dressed up to look unpredictable. That is why good hardware wallets carry a separate chip whose only job is to collect real physical noise: tiny changes in voltage, electrical interference, shifts in heat.
Coldcard had that chip. According to public reporting of the vulnerability, from March 2021, one character, in one line of code, quietly sent key creation to a predictable formula, and every key made on that firmware could be guessed from the moment it was made.
Joey described the situation using the analogy of a beach. Holders believed their key was one grain of sand taken from every beach on the planet. Because of that line of code, every key came from a single bucket. Once attackers work out which bucket, they start sifting.
The device worked exactly as expected and the keys it produced looked completely random, because randomness is not something you can check by eye. Moderator Robert Baggs pointed out what happened next: "don't trust, verify" was thrown back at the victims by people who could not have tested a random number generator either.
The lesson has nothing to do with one manufacturer. It is that a single seed phrase, a single device, a single piece of software or a single person concentrates all of your risk in one place. Joey also likened the vulnerability to a fleet of five thousand ships built in the same yard, each with the same weakness in the same part of the hull, all sailing together. When one starts to sink, they all do.
2. AI is finding the cracks and widening them
The Coldcard flaw was reported to have been found using AI. And once it was shared publicly, it became easier for other parties to take advantage of the exploit.
Coldcard was not drained by one skilled group. The method was copied, quickly and by many. Finding gets faster, and copying gets faster behind it.
Set up after the incident, Bitcoin Red Team has been running AI models across hundreds of open-source Bitcoin projects and finding weaknesses at a pace manual review would struggle to match. That work makes everyone safer. The same tools, pointed the other way, make attacking easier.
Any piece of technology can be outpaced by a tool that reads code quicker than the people who wrote it. So security cannot rest on technology alone. What holds when the code is outpaced is everything sitting underneath it: regulation, oversight, legal structure, and people checking things by hand.
3. Technology reduces failure. Governance decides who carries risk.
When a regulated company fails, the loss may have somewhere to go. There is a balance sheet, an insurance policy, a court, and rules requiring member assets to be held apart from the company's own money. Someone can be held responsible. When your own setup fails, there is nobody to claim from. Bitcoin has no chargebacks and no reversals, so the loss simply stays with you.
That is the trade, and Joey put it plainly. Holding your own keys means nobody can freeze your Bitcoin, block a payment, or lose it on your behalf. It also means that if you want to be your own bank, you have to be your own compliance team, your own security team, your own insurer, and the one who sorts it out when something breaks.
Hand those jobs to someone else and the work does not disappear. It becomes a set of questions about them: How is your Bitcoin kept separate from the company's own money? Is it held in a way that keeps it out of reach if the business itself gets into trouble? Can any one team, or any one person, move funds on their own?
Those are the questions we would want a member to ask us. Xapo Bank Limited is regulated by the Gibraltar Financial Services Commission as a credit institution, and Xapo VASP Limited as a DLT provider. Member Bitcoin is backed one to one, kept strictly separate from Xapo's own money, and never lent out or used as collateral elsewhere without the member's explicit consent. Being regulated is what turns those promises into obligations.
4. The breach that never touches your keys
Some of this year's worst incidents involved no cryptography at all.
Hardware wallet makers have been breached repeatedly, though not where you might assume. What was breached were marketing databases, outside support systems, and shipping partners. What leaked were names, addresses, phone numbers and order histories. By contrast, no seed phrase was exposed. No private key was touched. The devices did exactly what they were built to do.
For example, a leaked order record points to someone who very likely owns Bitcoin and very likely keeps it at home. That data may be used by an attacker to send a convincing scam email with your name on it, or worse, to turn up at your door. Even those who know better can still fall victim to scams.
As a regulated bank, Xapo can only collect the data it needs to run the service, and has to protect it to a set standard, including while it moves between systems. Those are conditions of holding a licence. Ashley's framing was useful: keeping your data safe is another job you either give to someone accountable for it, or do yourself.
5. Self-custody is a right. Allocation is the real question.
Both speakers were clear on where Xapo stands. We are pro self-custody and are firm supporters of decentralisation and open access.
Joey's worry was the backlash. Every time something goes wrong, an anti-self-custody push follows, and it drifts toward a closed two-tier system: regulated custodians only, anything self-custodial treated as suspect. Restrictions of that shape have been put to authorities before, and legislation in that direction has passed elsewhere. One risk is that it pushes huge volumes of activity out of regulated infrastructure and into arrangements with no oversight at all.
What the panel did insist on is that self-custody is a discipline as much as a right. Devices, backups, recovery, physical security, inheritance. Each one a job with no help desk.
Joey raised the Los Angeles fires as a case nobody plans for, where homes with serious safes inside met temperatures high enough to melt the safes and everything inside them. Even holders who had left instructions for their heirs had not planned for the storage itself failing.
Multisig, where spending Bitcoin needs several separate keys to approve it rather than one, is the strongest answer self-custody has, and Robert noted that reporting after the Coldcard attack suggested multisig wallets were not drained. Joey's caution was that it is not the finish line. The thinking often stops at the setup itself: we hold three keys, three approvals are needed, so we are safe. The questions that matter start after that. Who are the three people, and do they all sit in the same office reporting to the same boss? Who gets brought in when one of them leaves? Who keeps the devices updated, given that a Coldcard flaw survived five years of nobody looking? And the biggest thefts in this industry were not three weeks of work. They took months of planning, of earning people's trust, of quietly placing the right person in the right job. Against that, three signers who can be named become a target list, rather than a defence.
As Ashley put it, every holder faces the same question, and it gets heavier as the number climbs. How much am I comfortable holding where, given what it is now worth? Twenty Bitcoin in 2016 asked very little of you. Twenty Bitcoin today asks a great deal.
At Xapo, security is the foundation the app is built on. There is no single seed phrase, no single key, no single device. Private keys are held as distributed shares using Multi-Party Computation across secure, enterprise-grade servers in military-grade physical bunkers, so the full key never exists in one place.
Transactions clear multi-layered authentication, including two-factor and support for hardware devices such as a YubiKey. For long-term holdings, the Xapo Vault carries a mandatory 48-hour withdrawal timelock that cannot be shortened, once it is set. Every member has a Relationship Manager to speak to. And inheritance takes minutes: designate a beneficiary in the app, and if the worst happens our team guides them through taking custody, with no seed phrases or hardware for a grieving family to work out.
Security by Design
Go back to where the year began. The holders who lost Bitcoin to Coldcard were not careless. Everything rested on one device running one line of code, and when that line failed there was nothing underneath it.
That is the case for building security as layers rather than a single wall. Ashley's image during the panel was an onion: the aim is that an attacker has to peel through layer after layer, each one harder than the last, and that when a layer does give way something is still standing behind it.
Those layers are not all technical, which was the thread running through the hour. They run from key material to governance to legal structure to somebody who answers when you call.
Where you place them is your decision. Self-custody is a right, and for part of what you hold it may well be the right answer. For the part you would rather not audit, maintain, insure and bequeath on your own, that is what Xapo is built for.
