Binance founder Changpeng "CZ" Zhao has issued a public warning to cryptocurrency holders following two hardware-wallet security incidents — an $86 million theft linked to Ledger and a $112 million exploit tied to Coldcard — that together put nearly $200 million in user funds at risk.

The warning from Zhao, who stepped down as Binance CEO in November 2023 and remains one of the industry's most-followed voices on operational security, lands at a moment when hardware wallets are widely marketed as the safest way to hold digital assets. Two separate incidents involving the category's best-known brands now challenge that assumption directly.

What happened?

According to the reports behind Zhao's warning, attackers made off with approximately $86 million in crypto connected to Ledger users. Separately, a vulnerability affecting Coldcard hardware wallets enabled an exploit that drained roughly $112 million.

The combined figure — just under $198 million — ranks the pair of incidents among the largest self-custody losses recorded, and it places hardware-wallet security alongside exchange hacks and smart-contract exploits as a first-order risk for the asset class.

Neither incident involved a blockchain protocol failure. The losses sit at the intersection of device supply chains, firmware and user key management — layers that hardware-wallet vendors have historically positioned as their core advantage over exchange custody.

Why does CZ's warning matter?

Zhao framed the incidents as a call to action for holders to review how they store private keys. His audience is substantial: since leaving the CEO seat at Binance, he has increasingly used public channels to flag security incidents, and his warnings routinely circulate widely among retail holders.

The business consequence extends beyond individual victims. Ledger and Coldcard are two of the most established hardware-wallet brands in the industry. Security failures attached to their names carry reputational spillover across the entire self-custody segment, which competes with regulated exchange custody and with institutional custodians for user trust.

For the vendors themselves, the incidents raise immediate operational questions:

• Whether the attack vectors stemmed from firmware, supply-chain tampering or user-side compromise;
• How quickly patches or recalls can be deployed to affected devices;
• Whether reimbursement or recovery programs will be offered to affected holders.

Neither company has disclosed full technical post-mortems in the initial reports, leaving the root-cause question open.

What does this change for self-custody?

The incidents arrive as regulatory scrutiny of custody arrangements intensifies across major jurisdictions, and as more users hold assets outside exchanges following a decade of platform collapses. Hardware wallets sit at the center of that shift.

Security researchers have long argued that hardware wallets reduce, but do not eliminate, key-theft risk. A device can protect keys stored on it, yet compromised firmware, a tampered supply chain or tricked transaction-signing flows can still drain funds once a user approves a malicious action.

At this scale — nearly $200 million across two vendors — the events are likely to accelerate demand for independent security audits of wallet firmware, clearer disclosure standards from device manufacturers, and multi-layer storage setups such as multisig or passphrased wallets among larger holders.

Institutional custody providers may also use the incidents to reinforce the case for qualified custody with insurance and regulated controls, sharpening the competition between self-custody tooling and third-party custodians.

Zhao's warning, and the technical detail that follows from vendor investigations, will shape how the industry reassesses hardware-wallet risk in the coming weeks.