Jonathan Goodman: Losing $1.6 Million in ColdCard Hack, Why He Isn't Angry and the Bigger Lesson Learned

— Jonathan Goodman lost over 18 Bitcoin (valued at $1+ million at time of theft) due to the Coldcard hardware wallet vulnerability that allowed seed phrase entropy to be compromised.

— All three of Goodman's redundant security measures—separate Coldcard devices, metal-stamped seed phrases, and safety deposit box storage—failed against the same vulnerability, exemplifying "common cause failure."

— Coldcard's vulnerability appears to have affected multiple waves of victims with increasing sophistication; Goodman was in the first wave and believes the hack may still be ongoing.

— Police and detectives have been respectful but direct: their priority is catching perpetrators, not recovering stolen funds, and prospects for asset recovery are minimal.

— No class action lawsuit is likely because Coldcard is a small private company with insufficient assets to justify legal funding; smaller group suits are being pursued by law firms seeking 10–15 million dollar settlements, but victims must pay retainers with uncertain returns.

— Goodman maintains faith in Bitcoin and self-custody philosophy despite the loss; he views the incident as a test and is rebuilding rather than abandoning the asset class.

— Diversify hardware wallet manufacturers rather than buying multiple devices from the same company; using a single manufacturer created common-cause failure risk that affected all backups simultaneously.

— Avoid concentrating life savings in a single asset or custody method, even in asymmetric bets with high expected value; Goodman preserved part of his wealth by also holding QBTC in registered tax-advantaged accounts, preventing total loss.

— File police reports if victimized by cryptocurrency theft to create a digital paper trail for potential future law enforcement action and future litigation, even if immediate recovery is unlikely.