Large-scale Coldcard compromise (1596 BTC stolen so far)

[joker_josue]

I have a question for the people who want maximum security for their Bitcoin and built them selves a SeedSigner or similar, why SeedSigner and not the classic offline airgapped computer with Electrum?

The Seedsiger is the easier and more affordable route of the two. The individual components probably cost around $70. I know it was a device marketed to be under $50 back in the day but it's probably more now. If you don't have a spare computer/laptop laying around, you would have to buy one and use it only as your offline and airgapped signer. The initial investment is higher than that for the Seedsigner.

Then we have to look at the operating system on that airgapped computer. Sure, it can be Windows, but Linux is recommended. Not everyone has experience using a Linux distro and are perhaps not interested in learning just to use a bitcoin wallet on it. Then there is the recommendation that the airgapped computer shouldn't even possess the ability to connect to the internet and have no network card. The component is easier to remove from a desktop PC, but it's different for laptops and each laptop brand is different.

Another thing I realized upon analysis is that the project could disappear or never be updated again, and still function as intended. This is because its basic function will always remain the same: generating offline seeds and signing transactions.

I was still able to buy the parts for under $50. There's just one detail to consider, which I don't recall reading on the project page. Not all webcams have the focus needed to read QR codes that closely. So it might be necessary to buy another camera for the PC with a closer focus, which will cost about $15 more.

[avp2306]

I am pretty sure that they have thought of possible situations like this and their legal team has made it clear in company documentations that Coinkite can't be held responsible for losses and unforeseen incidents.

Even if this lawsuit is a success, how much money can they have? They didn't sell that many devices, they spent a lot, so I don't expect them to be sitting on even a fraction of the lost money.

Even if they had a lot of money in their account, I bet the first things they did is to make that money to disappear.
They are of course liable or what happened for their users, no matter what they wrote anywhere, but they will be walking away almost untouched from any possible lawsuits.

Even if they attempt to do that, their liability will probably not going to vanish. Also the court would still look at if the victims suffers from their mismanagement or a total negligence.

But sad that usually they get protected by great legal team. And sometimes with help of those professionals they can possibly avoid getting heavy penalties.

That's why I'm also curious to know on where this case heading, then want those victim get a justice from negligence done by Coinkite.

[Pmalek]

Another thing I realized upon analysis is that the project could disappear or never be updated again, and still function as intended. This is because its basic function will always remain the same: generating offline seeds and signing transactions.

That's what happened to Krux if I am not mistaken. I think the software is no longer being updated and maintained. I could be wrong, but I remember reading something like that. Still, the Krux firmware installed on a supported hardware device does what it's supposed to do even if it becomes outdated. As long as a vulnerability doesn't get discovered that would make it unsafe, it can be used. New features and improvements will not be added, though, unless someone forks it and continues its development.

[ryzaadit]

That's what happened to Krux if I am not mistaken. I think the software is no longer being updated and maintained. I could be wrong, but I remember reading something like that. -snip-
New features and improvements will not be added, though, unless someone forks it and continues its development.

New maintainers came in, Jean Do on GitHub: jdlcdl
Pretty fast for Krux got a new maintainers, started from Jeff, to Odudex, and now Jean Do.
In about 2 months, and the new maintainers released his first release update Version 26.09.0 3 weeks ago:.

[Lontor]

That's what happened to Krux if I am not mistaken. I think the software is no longer being updated and maintained. I could be wrong, but I remember reading something like that. -snip-
New features and improvements will not be added, though, unless someone forks it and continues its development.

New maintainers came in, Jean Do on GitHub: jdlcdl
Pretty fast for Krux got a new maintainers, started from Jeff, to Odudex, and now Jean Do.
In about 2 months, and the new maintainers released his first release update Version 26.09.0 3 weeks ago:.

I have a family member who happened to have purchased ColdCard hardware wallet before the attack that happened last time, he showed me some hours ago and he hasn't deposited any amount of crypto coins in it.

It's why I find this thread to ask this question, is it still a good idea to keep using Cold card? Are you saying here that someone new takes over the company or it's just new maintainers you are talking about?

What do you have to say about this advice? Should I tell him to avoid using the hardware wallet and get Trezor or he should keep using this Coldcard hardware wallet? What would you do if it's someone close to you?

[tvbcof]

I have a family member who happened to have purchased ColdCard hardware wallet before the attack that happened last time, he showed me some hours ago and he hasn't deposited any amount of crypto coins in it.

It's why I find this thread to ask this question, is it still a good idea to keep using Cold card? Are you saying here that someone new takes over the company or it's just new maintainers you are talking about?

What do you have to say about this advice? Should I tell him to avoid using the hardware wallet and get Trezor or he should keep using this Coldcard hardware wallet? What would you do if it's someone close to you?

I would not use any hardware device to store anything that was actually critical, and especially any BTC that I could not afford to walk away from.  For semi-spending-money I might use it if I had one on-hand (and I do), but I would actually get in the habit of using a solution which did not rely on hardware to store keys.  At least look up vids from the guys who use pretty remarkable methods to dig secrets out of hardware.

The best advice I've heard is from that Meuserna guy who has made some pretty clear arguments about why.

Edit:  As I was writing the above, I got my ROM reader stuff so I can, hopefully, hack kid's printer cameras to be stateless air-gapped signing devices.  When I have the time.

[Pmalek]

I have a family member who happened to have purchased ColdCard hardware wallet before the attack that happened last time, he showed me some hours ago and he hasn't deposited any amount of crypto coins in it.

It's why I find this thread to ask this question, is it still a good idea to keep using Cold card? Are you saying here that someone new takes over the company or it's just new maintainers you are talking about?

What do you have to say about this advice? Should I tell him to avoid using the hardware wallet and get Trezor or he should keep using this Coldcard hardware wallet? What would you do if it's someone close to you?

According to Coldcard and its team, the entropy vulnerabilities that resulted in the hacks have been fixed in the latest firmware releases. Coldcard is source-verifiable, but whether or not this can be checked is not for me to say. Regardless of what they claim, I would personally never use a Coldcard for anything. It's good that your friend never used it and stored his bitcoin on any addresses it generated. Especially without a complex seedphrase.

I would forget about the Coldcard forever. Trezor is ok but it's a downgrade compared to another airgapped hardware wallet. Devices that belong to the same class as Coldcard but work include Passport Foundation, Seedsigner, Shieldsigner (fork of Seedsigner), Krux and its fork Kern (I am not sure about the name), Jade and a few others.

Considering the latest problems with supply chain attacks, it's better to purchase directly from the manufacturer than a reseller, even an official one. Going down the DIY path and building one yourself is the best option right now. That and generating your own entropy with dice and coin tosses.

[LoyceV]

is it still a good idea to keep using Cold card?

No. Better safe than sorry.