Large-scale Coldcard compromise (1360.23 BTC stolen so far)

[LoyceV]

The community in general is still "lucky" that the stupidity came from the ColdCard developers.

This is one of the reasons I'm always careful paranoid when a new wallet (be it hardware or software) is released. It took me years to trust Ledger (until they broke that trust), and now I only have Trezor left on my personal preferred list of hardware wallets.
The fact that this Coldcard flaw was around for 5 years makes it only harder to trust anything.

Personally I don't consider saving cost is important when I buy a hardware wallet because I understand its importance and there are free open source software wallets to use. If I spend money to buy a hardware wallet, I buy a best one and don't mind to save cost that possibly puts my fund at risk if I buy a bad hardware wallet.

Paying more doesn't guarantee a better hardware wallet, Coldcard wasn't cheap.

Verify, don't trust. Easier said than done.

[EstherBtc]

Got this from X https://x.com/COLDCARDwallet/status/2084596971268956161

Someone's comment on this post made me sad, he said "Thank you cold card and coinkite for destroying trust in hardware device manufacturers for an entire class of Bitcoiners. Your lesson will be taught for decades to come".

Coldcard should just refund those affected. Unfortunately, some users who are not online don't even know that their bitcoin is under attack and has been wiped or about to be.

[asUHWEceyc]

This certainly appears to be an exit scam with good plausible deniability when you look back at JWWeatherman_ badgering coldcard to add external entropy via dice rolls to their quick start guide in the 2020-2021 period, which they refused to do.

It also casts a shadow on their podcast promoters, who were most likely mere useful idiots.

The company is obviously done, through reputational damage and/or lawsuits, but someone has the coins

[Cookdata]

I have seen some creepy tweets of old posts from Coldcard but I don't think this company is worth defending.



https://x.com/coldcardwallet/status/1447213375398846473

I don't think I'm overreacting right!

[Lucius]

What's wrong with a laminated paper wallet rolled up in a sealed PVC pipe filled with rice and buried in backyard?

It's okay if you don't have a dog that likes to dig, and you haven't dug deep enough - or if you have a neighbor who watches you just for fun and decides to dig around your yard when you're not home. In addition, in some countries there are laws that say that the owner of the land is the owner of what is found up to a certain depth, and everything else is owned by the state. This is how they protect oil and gas deposits from ordinary people.

The ground settles over time, so if you bury something to a depth of, say, half a meter, it will slowly sink over time, especially if the soil is moist and there is a lot of rainfall.

[philipma1957]

This certainly appears to be an exit scam with good plausible deniability when you look back at JWWeatherman_ badgering coldcard to add external entropy via dice rolls to their quick start guide in the 2020-2021 period, which they refused to do.

It also casts a shadow on their podcast promoters, who were most likely mere useful idiots.

The company is obviously done, through reputational damage and/or lawsuits, but someone has the coins

lets say inside job.

the issue is any other wallet company can do the same.

firmware 2027 for ledger makes a bug
and in 2028 ledger hacked.

right down the road.

so  back to core only?

since if core is bad it is all dead.