Large-scale Coldcard compromise (1596 BTC stolen so far)

[joker_josue]

I have a question for the people who want maximum security for their Bitcoin and built them selves a SeedSigner or similar, why SeedSigner and not the classic offline airgapped computer with Electrum?

The Seedsiger is the easier and more affordable route of the two. The individual components probably cost around $70. I know it was a device marketed to be under $50 back in the day but it's probably more now. If you don't have a spare computer/laptop laying around, you would have to buy one and use it only as your offline and airgapped signer. The initial investment is higher than that for the Seedsigner.

Then we have to look at the operating system on that airgapped computer. Sure, it can be Windows, but Linux is recommended. Not everyone has experience using a Linux distro and are perhaps not interested in learning just to use a bitcoin wallet on it. Then there is the recommendation that the airgapped computer shouldn't even possess the ability to connect to the internet and have no network card. The component is easier to remove from a desktop PC, but it's different for laptops and each laptop brand is different.

Another thing I realized upon analysis is that the project could disappear or never be updated again, and still function as intended. This is because its basic function will always remain the same: generating offline seeds and signing transactions.

I was still able to buy the parts for under $50. There's just one detail to consider, which I don't recall reading on the project page. Not all webcams have the focus needed to read QR codes that closely. So it might be necessary to buy another camera for the PC with a closer focus, which will cost about $15 more.

[avp2306]

I am pretty sure that they have thought of possible situations like this and their legal team has made it clear in company documentations that Coinkite can't be held responsible for losses and unforeseen incidents.

Even if this lawsuit is a success, how much money can they have? They didn't sell that many devices, they spent a lot, so I don't expect them to be sitting on even a fraction of the lost money.

Even if they had a lot of money in their account, I bet the first things they did is to make that money to disappear.
They are of course liable or what happened for their users, no matter what they wrote anywhere, but they will be walking away almost untouched from any possible lawsuits.

Even if they attempt to do that, their liability will probably not going to vanish. Also the court would still look at if the victims suffers from their mismanagement or a total negligence.

But sad that usually they get protected by great legal team. And sometimes with help of those professionals they can possibly avoid getting heavy penalties.

That's why I'm also curious to know on where this case heading, then want those victim get a justice from negligence done by Coinkite.

[Pmalek]

Another thing I realized upon analysis is that the project could disappear or never be updated again, and still function as intended. This is because its basic function will always remain the same: generating offline seeds and signing transactions.

That's what happened to Krux if I am not mistaken. I think the software is no longer being updated and maintained. I could be wrong, but I remember reading something like that. Still, the Krux firmware installed on a supported hardware device does what it's supposed to do even if it becomes outdated. As long as a vulnerability doesn't get discovered that would make it unsafe, it can be used. New features and improvements will not be added, though, unless someone forks it and continues its development.

[ryzaadit]

That's what happened to Krux if I am not mistaken. I think the software is no longer being updated and maintained. I could be wrong, but I remember reading something like that. -snip-
New features and improvements will not be added, though, unless someone forks it and continues its development.

New maintainers came in, Jean Do on GitHub: jdlcdl
Pretty fast for Krux got a new maintainers, started from Jeff, to Odudex, and now Jean Do.
In about 2 months, and the new maintainers released his first release update Version 26.09.0 3 weeks ago:.