Bitcoin Self-Custody in Africa: Two Hacks, One Lesson
Two major hacks in under two months have put Bitcoin self-custody in Africa to the test. First, a flaw in a trusted hardware wallet drained thousands of addresses. Then one of the world’s largest exchanges froze withdrawals after a theft.
However, the lesson is not to give up on holding your own keys. Instead, we need tools that are simpler, cheaper and built for how Africans live.
What the two hacks had in common
In late July, attackers began draining Bitcoin from Coldcard hardware wallets. The cause was a firmware bug from 2021 that made seed phrases far easier to guess. As a result, the attackers never needed to touch a device.
Within a week, roughly 1,816 BTC had left more than 5,200 addresses, according to figures in TRM Labs’ analysis of the Coldcard hack. That was worth about $116 million, and later estimates run higher. Afterwards, Decrypt reported that about 22,000 BTC moved to exchanges as worried holders looked for safety.
Then, on 24 September, the exchange Bitget suspended withdrawals after a theft of $387.5 million. The exchange says user balances are unaffected and its protection fund covers the loss. However, Bitcoin withdrawals only returned four days later, with fiat and peer-to-peer services scheduled for 2 October.
On the surface, these are opposite stories. One is a self-custody failure, while the other is a custodial failure. Yet both share the same weakness: a single point of failure.
In the first case, everything depended on one device and one seed phrase. In the second, everything depended on one company.
Why Bitcoin self-custody in Africa still matters
For many Africans, Bitcoin is not a side bet. Instead, it is savings, remittance and working capital. Therefore, a freeze of several days is more than an inconvenience.
It can mean missed rent, stalled stock or a late school fee. Moreover, we have seen worse close to home. In 2023, Nigerian platform Patricia suspended withdrawals after a breach, and Techpoint Africa found many customers still locked out a year later.
So the case for Bitcoin self-custody in Africa remains strong. Still, the Coldcard hack calls for honesty. Self-custody does not remove risk. Rather, it moves that risk onto the user and the tool.
If the tool fails or the seed phrase goes missing, nobody refunds you. That is why “not your keys, not your coins” is true but incomplete.
The tools were not designed for us
The strongest defence against a single point of failure is multisig. Multisig, short for multi-signature, means a wallet needs several keys to approve a payment. For example, a 2-of-3 wallet needs any two of its three keys.
Because of this, one weak device or one stolen seed phrase cannot empty the wallet. Unsurprisingly, interest in multisig rose sharply after the Coldcard hack.
However, multisig today serves a narrow kind of user. It usually assumes several hardware devices, a laptop and careful backups. A single Coldcard costs roughly $150 or more before shipping and customs.
Most Africans, meanwhile, meet Bitcoin on a low-cost Android phone. Many also share a room, a device or a data plan. In that setting, a paper seed phrase is hard to keep secret.
In short, the safest setup was designed for someone else.
What better Bitcoin self-custody in Africa looks like
Fortunately, the idea behind multisig is already familiar here. Think of a cooperative society in Nigeria, a chama in Kenya or a stokvel in South Africa. Many keep a group account that needs two or three signatories.
That is multisig in everyday life. Therefore, builders should start from that mental model, not from technical jargon.
In practice, a wallet built for this market should:
- Work fully on a low-cost Android phone, with little data.
- Spread keys across people or devices, so no single failure is fatal.
- Offer recovery that does not depend on one sheet of paper.
- Explain each step in plain words and local languages.
- Cost little or nothing to start.
Some projects already point this way. Nevertheless, none is yet the obvious first choice for a new saver in Kano or Kisumu.
One lesson for builders
Neither hack proves that exchanges are safe or that self-custody is broken. Instead, both show that a single point of failure will eventually fail.
The goal for Bitcoin self-custody in Africa is therefore clear. We need multisig that feels as simple as joining a savings group. African designers and developers are well placed to build it.