Trust no one in Bitcoin (Coldkey story)

[Helena Yu]

yogg was very known trusted user in this forum, he was once a Chipmixer participant, but he choose to leave it and promote his project [ANN] Coldkey™ -- Secure cold storage wallet cards.

There's no problem about it until this thread was created My Cold Keys Just Got Swiped! All Halving Sets!!, this user lost all of his coins since yogg was swiped his funds, there's a user said yogg was saved the private keys of at least one specific series of pre-funded coldkeys.

What can we learn from this story?
1. Don't trust anyone including the most highest trusted user in this forum!
2. Don't buy cold wallet/hardware wallet from second hand user e.g. not from official seller.
3. Only buy the popular, open source and secure cold wallet/hardware wallet e.g. trezor.
4. If you buy or get collectibles in this forum, just use it as a collection.
5. Don't need to worry and afraid if you think the firm/company which created the cold wallet/hardware wallet will save your seeds or private keys because it's generated randomly Seed Generation in Hardware Wallets.

Is there anything else I missed? feel free to give any suggestions 

[mk4]

but he choose to leave it and promote his project [ANN] Coldkey™ -- Secure cold storage wallet cards.

Taking a quick look at Coldkey, isn't this pretty much something like the Ballet Wallet? Pretty much like trusting a person/manufacturer to generate a paper wallet for you? Yikes.

[Charles-Tim]

Taking a quick look at Coldkey, isn't this pretty much something like the Ballet Wallet? Pretty much like trusting a person/manufacturer to generate a paper wallet for you? Yikes.

With the look of it, it is. The reason we should not trust anyone or anything. Bitcoin was created to be trustless. I can never use such wallets, I can never call it cold wallet when I was even not the one that generated the keys myself and I can never trust anything like or related to me not generate my keys myself.

[NeuroticFish]

Taking a quick look at Coldkey, isn't this pretty much something like the Ballet Wallet? Pretty much like trusting a person/manufacturer to generate a paper wallet for you? Yikes.

It is. But the manufacturers pretty much try to sell them like art (imho). There are unloaded and DYI ones which imho they make much more sense, but the loaded ones bear much higher premium, plus the owner will think twice before redeeming the "paper wallet" because it decreases its value more than just with those bitcoins it was holding.

But yes, at the end of the day, they're just nicer paper wallets made by somebody else.
Even more, while 95% of the cases the manufacturers can be trusted (at least until now), the more hands the collectible pass on, the bigger the chance somebody has found a way to unseal it and copy the private key for "future use".

As minerjones said it very good:

Our "hobby" of loaded coins is inherently a bad idea and against everything bitcoin stands for!!!

[Rikafip]

Gotta say that as a big fan of everything card related I really liked the Coldkey and even thought about getting some for myself and as a present for others, but the idea of someone else having an access to bitcoin on it eventually put me off. Anyway, what happened sucks big time and yes, yet another proof that you simply can't trust anyone with your own bitcoin.

Is there any estimate how much yogg stole so far?

[NeuroticFish]

Is there any estimate how much yogg stole so far?

I think that's "only" these addresses:

Go to https://mempool.space/tx/c073634c862353b7a90303d52806defba55cac63a86762213fcb949b74a5573b
Press show all 86
All the red ones are gone  

Still, that's over half a BTC. Plus the premium lost for those beautiful collectibles... Plus the many who may have unpeeled more of their collectibles to check them 

[Rikafip]

Go to https://mempool.space/tx/c073634c862353b7a90303d52806defba55cac63a86762213fcb949b74a5573b
Press show all 86
All the red ones are gone  

Still, that's over half a BTC. Plus the premium lost for those beautiful collectibles... Plus the many who may have unpeeled more of their collectibles to check them  

Thnx.

Half a BTC (for now) is far from nothing but when you look at the big picture, its not that much considering everything that he ruined with his act...

[LoyceMobile]

What can we learn from this story?
1. Don't trust anyone including the most highest trusted user in this forum!

I'm not into Bitcoin to trust people, but there are a few people I trust by now on Bitcointalk. I consider trust to be flexible: someone who's trusted now may not be trusted tomorrow. With collectible coins you have to trust someone long term, and they could always be building up for an exit scam. As they say: opportunity makes the thief. Add financial problems to the equation and you have a motive.

There are unloaded and DYI ones which imho they make much more sense, but the loaded ones bear much higher premium

The problem with DIY is that if you sell it, the buyer has to trust you instead of the manufacturer. There is no perfect solution.

[NeuroticFish]

There are unloaded and DYI ones which imho they make much more sense, but the loaded ones bear much higher premium

The problem with DIY is that if you sell it, the buyer has to trust you instead of the manufacturer. There is no perfect solution.

That's correct. Imho if one wants to keep that DYI like forever, then he loads it; else (or if unsure) it can just stay unloaded as a DYI "kit", no biggie.
Of course, a collectible that's not loaded doesn't also hold the bigger and bigger premium over time. But there are always pluses and minuses.

[348Judah]

The security to one's wallet is not as hard and people thought it was but because they lack the technical know how to how they can arrived at this with maximum safety, many people have also got it wrong by sourcing for security from a third party authorization techniques to their ouw wallet just as in the case of yogg and every other user to his own development, they all ended having the same experience at the end, if one never had a good understanding to how the wallet can be secured then falling into hands like this will be inevitable.

[NeuroticFish]

Is there any estimate how much yogg stole so far?

As an update, I've just read this overly saddening topic from Krogoth hence I think that I may have been wrong and there may be other tx and more amounts that were stolen.

[stompix]

Even more, while 95% of the cases the manufacturers can be trusted (at least until now), the more hands the collectible pass on, the bigger the chance somebody has found a way to unseal it and copy the private key for "future use".

I was thinking, in cases like this, when you have already auctioned or sold one of those cards privately if the manufacturer wouldn't have acted like yogg and swiped all the funds but just randomly scammed one user in a collection after a year or so, you might end up in trouble and it's going to be a pain the ass to avoid getting dragged in court if the sum is anything significant like 1BTC funded ones that were auctioned years ago!

Sad story and an eye-opener, but we could have lived without it!
Try starting a business like that now, I wonder how many customers you're going to get!

[Lucius]

Something in this story doesn't make sense to me, because why would such a member who was highly respected in Collectibles pull off such a scam, which in terms of value considering his previous reputation is nothing but dust? In addition, the whole business that he led is regulated in such a way that it is very easy to reach him as a person, and one of the links from the OP even has his photo.

Is it possible that the private keys were leaked from some other source, assuming that someone else had access to them?

[NeuroticFish]

Is it possible that the private keys were leaked from some other source, assuming that someone else had access to them?

No. Normally he should have destroyed those keys long ago. And he seems to have (at least) a gambling problem.
Imho the relevant posts are this, this and this.

It's an incredibly sad shit show. And the last post I've linked shows a tiny bit of its dimension, especially if you take it together with the number of posters in the first topic.
I am really really sorry for the loses of these guys 

[Rruchi man]

1. Don't trust anyone including the most highest trusted user in this forum!

For two major reasons you never know when their accounts become compromised or when their motives change. So don't easily trust.

2. Don't buy cold wallet/hardware wallet from second hand user e.g. not from official seller.

I personally do not like second handed properties, it is always cheaper to buy a new original one than buy a second handed property that you are not sure of the status.

3. Only buy the popular, open source and secure cold wallet/hardware wallet e.g. trezor.

There's no need doing trial and error with your bitcoins, buy popular cold wallets and buy from verified vendors.

[Distinctin]

Taking a quick look at Coldkey, isn't this pretty much something like the Ballet Wallet? Pretty much like trusting a person/manufacturer to generate a paper wallet for you? Yikes.

With the look of it, it is. The reason we should not trust anyone or anything. Bitcoin was created to be trustless. I can never use such wallets, I can never call it cold wallet when I was even not the one that generated the keys myself and I can never trust anything like or related to me not generate my keys myself.

Bitcoin is decentralized, which means we need not to trust anyone but only ourselves since it’s a self generating system. If you think you are not capable to secure your wallet, or not responsible to manage your bitcoin, then it’s better that you should not let other person too to do it for you because you are allowing third party to control your bitcoin. Otherwise, you should force yourself to learn on how to protect your bitcoin because that’s the only way you’ll never be scammed and never end up losing.

[hatshepsut93]

It's a good reminder to everyone that the manufacturer of Casascius and all similar products could potentially have kept the keys, and there's absolutely no way to know that they did not.

What can we learn from this story?

What we can learn is that if you are using a system that is theoretically unsafe, you need to be ready to lose your money.

3. Only buy the popular, open source and secure cold wallet/hardware wallet e.g. trezor.

How do you verify Trezor's hardware? How can you know that it generates random seeds and not pulls them from a hard-coded list that would allow the manufacturer to eventually pull a similar scam?

[owlcatz]

It's a good reminder to everyone that the manufacturer of Casascius <snip>

Mike Caldwell and or smoothie are literally the least of our worries trust me. They have no reason to scam because they are already rich and their products were and are 💥🔥🤷‍♂️. Also they were and are actual registered businesses in the USA.

You should be pointing out examples like Tim Fillmore of Titan mint instead etc. Thanks

[Darker45]

2. Don't buy cold wallet/hardware wallet from second hand user e.g. not from official seller.

How is this a lesson from this unfortunate event, especially in the collectibles community?

Yogg owns Coldkey, a duly registered company that sells loaded cold wallets in the form of cards with art works on them. They are limited in number and are collectible pieces. Yogg is not selling something that is created by somebody else. He is not a reseller. Although he had collaborations with other individuals, artists for example, he is the official seller. He owns the company; he owns the product.

[hatshepsut93]

Mike Caldwell and or smoothie are literally the least of our worries trust me. They have no reason to scam because they are already rich and their products were and are 💥🔥🤷‍♂️. Also they were and are actual registered businesses in the USA.

You should be pointing out examples like Tim Fillmore of Titan mint instead etc. Thanks

I don't really care how stellar someone's reputation is, if they have seen the keys, they could have copied them. My point is that users need to understand this risk, and if they are willing to take it because they like the product, that's okay, it's their right. But there needs to be full disclosure about the risk when such product is advertised/recommended. Because it's very different from Bitcoin's security model where your security depends 100% on your own actions.