So with the cold wallet hack I am thinking about using core 29 to store.

[philipma1957]

OKAY i  have hardware wallets. I am a bit nervous they can get cracked like cold wallet hack has happened.

So I have a core 29 with a tiny amount of btc in it.

How to make the core 29 wallet be safe is the question.

I never encrypted it.

So I suppose I can make a long passhrase.

Like:

 abcdefgh87654321HGFEDCBA

Encrypt it.

Then test that I can get into the wallet.

Then make 5 backups of the  wallet.

I WOULD guess that is safer than a hardware wallet.

Also should I upgrade to core 30 or stay on core 29

Or use core 28.

I DO NOT WANT KNOTS .


So  ideas of setting up a  core to store a few btc.

[Charles-Tim]

I do not know much maybe Bitcoin Core can be offline while you still run it as a node. If possible the wallet can be offline, it will be better.

You can have your own Electrum server and still have an Electrum wallet setup on an airgapped device and make use of your server on a watch-only wallet for transactions.

I am not a node runner, but there is option to use Electrum with Tor and have a seed phrase (+passphrase) set up on it.  This has been the option for me.

You would have seen on some of my posts that I do not like hardware wallet because it can reduce people's privacy. But getting one and setup a wallet with passphrase to extend the seed phrase will make that kind of Coldcard attack not possible.

[retaur]

Airgapping and cold storage is superior to everything.

Next is multisigging with different hardware wallets.

If you've not got much to store, you can use core and other software wallets. If you know what you're doing you can use software only with a decent amount of funds but it's really not recommended (I just used to do it with electrum though).

[LoyceV]

I never encrypted it.

Is it an online hot wallet? If so, I wouldn't use it to replace a Trezor.
For cold storage, I find Electrum easier for offline signing than Bitcoin Core (read my sweep method to get an idea).

So I suppose I can make a long passhrase.
 abcdefgh87654321HGFEDCBA

abcdefgh and 87654321 are very easy for a (dictionary) attack.

Then make 5 backups of the  wallet.

Make them on different storage media: different brand USB stick, HDD or even CDrom. If one of them has a limited shelf life, another one might last longer.

Then test the backups of your wallet!

I WOULD guess that is safer than a hardware wallet.

It's a lot more difficult. How about a combination of both: offline signing with Electrum connected to a hardware wallet?

Also should I upgrade to core 30 or stay on core 29
Or use core 28.

As far as I know, they're all safe. I'm still using an older version.

[OgNasty]

Is the coldcard bug really a reason to panic if you aren’t using one? It seemed like an exploit for that service only. I’m not sure I understand the panic. Am I not worrying enough to be planning to do absolutely nothing? My private keys were generated more than a decade ago. I’d like to think they’re battle tested by now.

[philipma1957]

Is the coldcard bug really a reason to panic if you aren’t using one? It seemed like an exploit for that service only. I’m not sure I understand the panic. Am I not worrying enough to be planning to do absolutely nothing? My private keys were generated more than a decade ago. I’d like to think they’re battle tested by now.

og my fear would be  if one company can be exploited  due to a 40 bit vs a 256 bit search

then maybe other wallets may do short cuts.  making shorter search areas for a pc to crack the wallet.

[nc50lc]

Also should I upgrade to core 30 or stay on core 29

Or use core 28.

If you're using a descriptor wallet anyways, go for 30.2+ (skip 30.0 and .1).

And if you're using a descriptor wallet, you can use a Cold-Storage Bitcoin Core setup by exporting the no-secrets descriptors to a watch-only Bitcoin Core wallet.
Transaction creation, export and signing procedures are supported by the GUI so it should be easy.
The only complicated part is the first time setup
Or wait for this in the next release version: github.com/bitcoin/bitcoin/pull/32489

[LoyceV]

if one company can be exploited  due to a 40 bit vs a 256 bit search then maybe other wallets may do short cuts.

If that's your fear, why don't you use dice rolls or coin tosses to create your seed?

[NotATether]

Is the coldcard bug really a reason to panic if you aren’t using one? It seemed like an exploit for that service only. I’m not sure I understand the panic. Am I not worrying enough to be planning to do absolutely nothing? My private keys were generated more than a decade ago. I’d like to think they’re battle tested by now.

That's right, there's no panic unless you used Coldcard hardware wallets to generate your seed.

If your seed was generated from non-coldcard hardware, you are safe.

If it was generated with coldcard hardware with firmware preceding v4, you are also safe.

Multisig is superior to all this anyway, and it is the method you should be using when you have a bunch of hardware wallets.

[Lucius]

OKAY i  have hardware wallets. I am a bit nervous they can get cracked like cold wallet hack has happened.
~snip~

Given that you are a Trezor user, the simplest thing would be to create a new account in the same device, choose passphrase as additional protection (a unique password of 10+ characters, letters, numbers) and then transfer all your coins to that protected account. A seed generated with such low entropy is not something that users of other hardware wallets should worry about, because this is obviously an isolated case.

I think there is no room for panic, everyone can protect their coins today in the very simple way already mentioned. Additionally, an air-gapped wallet + strong passphrase are more than enough protection to allow you to sleep peacefully until super quantum computers and some perhaps still unknown threats appear.

[Satofan44]

Airgapping and cold storage is superior to everything.

Superior by far yes, but not recommended for those that don't know what they are doing which represents a majority of users. Perhaps you or other users of this forum would be surprised how many people are not able to create proper backups of 24 words -- which is literally among the easiest things in the world, therefore we need to be careful what we suggest and to whom. I can completely see cases of people using a cold storage airgap system, eventually getting frustrated with it and entering their wallet details on onlinecoldstorage.com. 

OKAY i  have hardware wallets. I am a bit nervous they can get cracked like cold wallet hack has happened.
~snip~

Given that you are a Trezor user, the simplest thing would be to create a new account in the same device, choose passphrase as additional protection (a unique password of 10+ characters, letters, numbers) and then transfer all your coins to that protected account. A seed generated with such low entropy is not something that users of other hardware wallets should worry about, because this is obviously an isolated case.

I think there is no room for panic, everyone can protect their coins today in the very simple way already mentioned. Additionally, an air-gapped wallet + strong passphrase are more than enough protection to allow you to sleep peacefully until super quantum computers and some perhaps still unknown threats appear.

Correct. People keep over complicating these topics because of anxiety and fear. The attack vector that was used here is completely mitigated by using a passphrase. Nobody is going to be brute-forcing all the seed phrases that they have managed to re-generate from a vulnerability with the hope that one of them will have a matching passphrase before the Sun runs out of fuel. Always use a strong passphrase with every hardware wallet, it could not get more simple than that. This prevents the low entropy attack vector, and it does not require additional hardware, knowledge, or multisig. It does not require anything at all. People, don't be a modern day NPC overthinking machines, and just solve problems with the best and simplest solutions.