Find a Lawyer
Book an appointment with us, or search the directory to find the right lawyer for you directly through the app.
Find out more
Al Adalla
Read MoreA complete spectrum of legal services across jurisdictions in the Middle East & North Africa.
Your Keys, Your Coins, Whose Problem?
7 min 57 sec Written by
m.davis@tamimi.com 
View LinkedIn Profile
Trusted third parties are security holes – Nick Szabo
Wallets powered off in safety deposit boxes were emptied in minutes. Attackers drained more than $116 million in Bitcoin from over 5,200 addresses without ever touching, accessing or compromising a single device. This is every self-custodian’s nightmare.
The Coldcard exploit exposes the gap between the promise of blockchain technology and the architecture of digital asset markets as they presently exist. Blockchain technology was intended to eliminate counterparty risk posed by a single or concentrated group of intermediaries. Although decentralisation is meant to reduce reliance on intermediaries, digital asset markets remain heavily intermediated. Tokens are held by custodians, platforms facilitate trading, and issuers make promises. Hardware manufacturers can also become single points of trust. Those dependencies create unique risks for digital asset owners and give rise to legal issues that lawmakers, lawyers and industry participants continue to grapple with.
Understanding the exploit
The incident, which began on 30 July 2026, resulted from a firmware flaw in Coldcard hardware wallets. Certain devices generated wallet seed phrases using predictable software randomness rather than the hardware random number generator they were supposed to employ.
The issue was particularly unnerving for cybersecurity professionals and advocates of self-custody solutions because it was not an inherent flaw identifiable from the outset. Coldcard was created in 2017 and included a true random number generator (TRNG) as part of the product. The problem arose from a 2021 firmware upgrade that generated an error that unintentionally resulted in bypassing the TRNG and defaulting to a pseudorandom number generator instead. This happened without any notification to the user. The output looked the same, the TRNG was present and was operating properly when called, and the product had previously functioned for years as intended. It was only an almost imperceptible and inadvertent change that created a major vulnerability, which was subsequently identified and exploited.
The practical effect was that predictable seed phrases allowed attackers to reconstruct private keys without ever touching, accessing or compromising a single device. Wallets sitting powered off in safety deposit boxes were emptied in minutes. The hack proved Szabo’s point: the risk extends beyond centralised intermediaries to any single point of trust, including hardware manufacturers.
The incident exposes a set of legal questions that existing frameworks have not answered with sufficient clarity: who bears the loss when a security product fails at the most fundamental level, what rights do affected holders actually possess, and through what mechanism can they seek recovery?
The Institutional Safety Net
For institutional participants, the risks identified above do not present themselves in the same way. Institutions operating within frameworks such as those established by the DFSA in the DIFC or the FSRA in ADGM hold digital assets with regulated custodians, being entities subject to capital adequacy requirements, operational resilience standards, governance controls and, critically, obligations regarding asset segregation. In Dubai, outside the DIFC, VARA requires VASPs providing Custody Services to hold the relevant Licence, which includes mandatory insurance requirements. These custodians do not rely on a single hardware device or a single entropy source. Their security architecture is layered and audited and, where applicable, supported by insurance.
Asset segregation is the load-bearing wall of custodial protection. Where a custodian holds client assets on a properly segregated basis, whether through omnibus structures with clear sub-accounting or individual wallets, those assets should, in principle, not constitute the property of an insolvent custodian. The client retains proprietary rights. The custodian’s creditors cannot reach them, nor can any insolvency practitioner appointed to the custodian.
This is well-understood in traditional finance. Securities held by a custodian bank are not available to that bank’s liquidator. The question is whether digital assets receive equivalent treatment, and the answer depends on jurisdiction, the precise custodial arrangements, and, uncomfortably, the quality of the documentation. But for institutional clients, at least the framework exists. There is a counterparty. There is a contract. There is recourse.
Retail Holders: The Gap in the Framework
For retail holders, the position is materially less secure. Even where users act with caution, take responsibility for their own assets and deploy a reputable self-custody solution that kepts their private keys offline, there is still risk. In the above case, users lost everything because of a firmware defect introduced after the product had been on the market for four years and left undetected for more than five years.
The ubiquity of, and ease of access to, frontier AI models capable of identifying and exploiting zero-day vulnerabilities mean that this is unlikely to be the only example of losses occasioned in this way. In the absence of insurance, claims to recover losses are likely to be complex and time-consuming, and prospects of success may vary depending on the location of the provider and the user.
For example, there is no custodial relationship in the traditional sense, since the user held their own keys. There is no intermediary to claim against, because no one was holding their assets. The loss occurred not through misappropriation but through a product defect that rendered private keys reconstructable. The legal characterisation of that claim, be it product liability, negligence, or breach of express or implied warranty, will vary by jurisdiction and may face significant barriers to recovery, such as limitation and exclusion of liability defences.
Insurance as a Partial Answer
Insurance represents perhaps the most immediately actionable mechanism to address this gap. Many institutional custodians carry comprehensive crime and specie policies that may respond to this type of loss, for example the theft of digital assets through the exploitation of security vulnerabilities. These policies exist because institutional clients demand them. Across the UAE’s common-law and civil-law jurisdictions, VARA, the DFSA and the FSRA prescribe custody safeguards through authorization and licensing requirements, although their approaches to insurance and compensation arrangements differ. They may also provide cover where a loss event gives rise to claims against the institutional custodian.
For retail users, no equivalent protection exists. A hardware wallet manufacturer is unlikely to carry insurance that responds to end-user losses arising from firmware defects. Even where a retail user holds assets on a platform that maintains insurance, coverage typically extends only to assets held on the platform itself, and not to losses incurred through self-custody products.
The development of retail-facing insurance products for digital asset storage, whether structured as standalone policies, embedded coverage bundled with hardware purchases, or mandatory protection schemes analogous to deposit insurance, would not solve the underlying structural problem. But it would provide a funded recovery source that does not depend on successfully pursuing a product liability claim against a manufacturer that may lack the resources to satisfy thousands of concurrent claims. Some digital asset exchanges are already providing dedicated asset funds to reimburse victims of frauds and hacks or specialized account protection features that include reimbursement of eligible unauthorized transactions where users complied with the security requirements of the platform.
Enforceability and the Cross-Border Dimension
Recovery, however, is not merely a question of identifying a source of funds. It requires enforcement. In the case of a platform or custodian hack, the affected users can be globally located. The stolen assets sit in attacker-controlled addresses that on-chain analysis firms can identify but that no single jurisdiction can freeze without coordinated action. A UAE-based holder pursuing recovery faces immediate questions: where to sue and under what law. The holder must also consider how to enforce any judgment obtained against a foreign entity, assuming one can be obtained in the face of jurisdictional barriers and before limitation periods expire across the relevant jurisdictions.
The DIFC and ADGM courts have positioned themselves as sophisticated forums for precisely these disputes. Both benefit from common law foundations, internationally experienced judges, and enforcement arrangements that provide reach beyond the UAE. Freezing orders, proprietary claims, and Norwich Pharmacal relief are all available in principle. But the practical barriers for retail claimants remain significant: the cost of multi-jurisdictional proceedings relative to individual losses, uncertainty regarding applicable law, and the speed at which on-chain assets can be layered through mixers and bridges before any order takes effect.
Greater protection = Greater adoption
What this analysis reveals is that, if the sector wishes to continue to drive adoption and illustrate the myriad benefits and efficiencies of blockchain technology and digital assets more broadly, users would benefit from greater protections that account for the specific characteristics of digital asset storage and transfer. This is not straightforward, but some areas that could form part of that progression could include:
- Mandatory security standards and audit requirements for self-custody solutions and custodial service providers;
- Insurance mandates proportionate to user exposure;
- Clear statutory treatment of digital assets in insolvency and product liability contexts; and
- Streamlined cross-border recognition mechanisms for freezing orders and tracing claims involving on-chain assets.
Blockchain technology still retains the potential to make trust unnecessary. For many retail users, even digital asset optimists, however, there is still a trust gap. That trust gap must be bridged to achieve genuinely mass adoption.
To do that, users of platforms, custodians and self-custody solutions need certainty that when (not if) systems are breached, the law and regulatory environment provide a swift and simple route to restitution. Institutional participants are leading the way. The sector must ensure that retail users are brought along with them.
This article was co-authored by Max Davis, Legal Director, and Tayler Wright, Associate. Both are members of Al Tamimi & Company’s International Litigation Group, based in Dubai, and specialize in disputes involving digital assets. The team has industry-leading experience acting on digital asset recovery and enforcement matters before both the common and civil law courts.
Written by
Next Article
