For nontechnical people, how are we supposes to know Trezor, Ledger, are safe

[RoseAPT]

Based on what I’ve read, it seems non coldcard wallets are safe. But how do we know if these other mainstream wallets are safe from other exploits that we currently are not aware of?

Luckily, I do not have a coldcard. But I am not sleeping easy right now with my setup.

Has there been real academics or non crypto related researchers (unbiased) that have published findings on the open source Trezor software?

[Charles-Tim]

Ledger secure element is close source. It is among the wallets that I can not recommend.

Trezor is open source. Its code will be checked from time to times by some other developers. But in case if any bad like this happens, just make sure you use passphrase or go for a multisig wallet to avoid it.

[promise444c5]

If you’re using ledger then you’re already sitting on a time bomb..

Well, any thing beyond entropy would likely need your wallet to be  actively connected to the internet.. otherwise, you’re safe with a cold storage in that aspect. If you don’t have that , consider migrating.

As for the entropy issue ,  you can should consider extending your wallet with a passphrase or Multisig [if you’re comfortable with it.. otherwise, you can focus on passphrase ], that should serve.

[X-ray]

The problem of ColdCard lies on entropy bug which is isolated to ColdCard, after this incident some hardware wallet are publicly stating that they aren't affected by the ColdCard entropy bug like Trezor, Bitkey, and so on. You're going to be fine if you're not using ColdCard.

However for nontechnical people I think it's better to use hardware wallet that is known to have large users which means more money allocated to security audit, which also means lesser chance of bug as critical as this to happen but it's just my opinion.

After all, funds allocated for security don't lie. The better funded the security department is, the higher the security with continuous monitoring, and more.

But, as others said, Ledger is a no go though, it's closed source and the Ledger Recover is problematic, on top of that avoid the one that have history of customer data breaches.

[Karl_3000]

However for nontechnical people I think it's better to use hardware wallet that is known to have large users which means more money allocated to security audit, which also means lesser chance of bug as critical as this to happen but it's just my opinion.

I do not agree with this because Trezor and Ledger Nano takes almost 65% of the total hardware wallets that are sold while Ledger is sold than Trezor. Ledger is having like 37% of it but which you also said it is not a good hardware wallet which I will also accept.

Keystone takes around 4%, BitBox takes around 3%, Passport takes less than 1% but they are good hardware wallets.

It is not about the hardware wallets that are sold most.

[Darker45]

It's probably valid to say that they're safe until they aren't. Ledger was once highly recommended by experts, so was Coldcard. As for Trezor, there were models claimed to be secure but were eventually proven to be not.

I'm as confused as you right now. It seems to me there's something fundamentally wrong when you're trusting somebody else to generate the seed phrase for you. So, I thought I'd rather randomly pick my backup from the thousands of words available. But then I found out it's actually a more dangerous approach because accordingly our brains can't actually be truly random. Now, there's the recommended dice-rolled entropy.

For the time being, I'm making do with a long passphrase. At least I'm generating it myself. But my layman's mind can't fully erase the doubt that it's absolutely safe considering that it's typed on a device that's connected to an online computer. Despite the guarantee that it's completely safe, I'm thinking it indeed is until it isn't.

[bbc.reporter]

If the unsafeness on the Cold card wallet was not noticed by the developers for 5 years, we in this forum certainly cannot know the real safeness of these other hardware wallets. We will only need to trust the people who created these devices.

Also, there is this very headshaking news hehehehe.



Unlike the FTX collapse, the $89 million Coldcard exploit has investors sending bitcoin back to exchanges

Security issues in the crypto market often push investors in predictable directions. For instance, following the collapse of the FTX exchange in November 2022, investors rushed to withdraw large volumes of coins from centralized platforms and move them into self-custody solutions, including hardware wallets and personal devices.

Now they are doing the opposite by moving coins to exchanges, as the ongoing multi‑million‑dollar Coldcard hardware‑wallet incident, which began Friday, has raised fresh questions about the safety of self‑custody.

Read in full https://www.coindesk.com/markets/2026/08/02/unlike-the-ftx-collapse-the-usd88-million-coldcard-exploit-has-investors-sending-bitcoin-back-to-exchanges

[BlackBoss_]

Based on what I’ve read, it seems non coldcard wallets are safe. But how do we know if these other mainstream wallets are safe from other exploits that we currently are not aware of?

Luckily, I do not have a coldcard. But I am not sleeping easy right now with my setup.

Has there been real academics or non crypto related researchers (unbiased) that have published findings on the open source Trezor software?

You and most users who are not wallet developers are all unable to check things in wallet codes (even codes are open source or public for verification). We have to rely on reviews from wallet developers, security experts but developers and experts can make mistakes or bias.

But if you still want to know where to get wallet reviews, here.
https://walletscrutiny.com/
Type a wallet brand and find reviews

You have to trust wallet manufacturers, wallet reviews while bad things can still happen. Sayings are like "don't trust, verify", but because you can not verify wallets by yourself in security, you have to trust third-parties like wallet reviewers.

At a n00b on firmware, it's shocking to read a firmware update can change such basic functionality. I guess it makes sense, without firmware no working hardware wallet, but still....

I've never owned a Coldcard, but have used hardware wallets. One of the things I dislike about them is the "black box" feeling it gives me: I have no idea what it's doing in there, and I basically have to trust the manufacturer (and some reviewers). And "trusting" is what I don't like when it comes to Bitcoin.

[cryptoaddictchie]

Based on what I’ve read, it seems non coldcard wallets are safe. But how do we know if these other mainstream wallets are safe from other exploits that we currently are not aware of?

Surprisingly most hardware wallet advertise as safe haven for crypto to store the funds but since the recent issue I umderstand the OP question. Honestly to answer how to know if they arent safe is when they establish some red flags based om technical people. Non tech user can only rely to that as basis and plausible recommendation.

[shinratensei_]

Treat hardware wallet as an ever evolving device, you don't buy one and use it forever but if you can, buy the latest for the sake of security and keep updating it. Honestly it's confusing because the bug was there for years and only got exploited now, even worse is we've been seeing the same pattern ever since the massive use of AI to scan the security of codes and the fact that it's available to anyone will result in increased wave of attacks.

Back then only genuinely good programmer able to scan for exploit, now with $20 subscriptions even without cybersecurity experience you can at the very least do a small scan. However, I heard the coldcard users who generated phrase by adding dice rolls aren't affected (idk if it's true), that is another thing to note, 100 rolls according to keystone should suffice.

[SeriouslyGiveaway]

Surprisingly most hardware wallet advertise as safe haven for crypto to store the funds but since the recent issue I umderstand the OP question. Honestly to answer how to know if they arent safe is when they establish some red flags based om technical people. Non tech user can only rely to that as basis and plausible recommendation.

Solutions can be spreading your bitcoin storage into some wallets that are from different brands, either hardware wallets or software wallets, only choose biggest and most trusted brands.

Like Bitcoin Core, Electrum with software wallets
Like Trezor with hardware wallets

Use strong passphrase
Set up and use multisig wallets

With the hack on Coldcard hardware wallets, I am thinking about risk with people who have to trust Bitcoin Spot ETFs, trust custodians like Coinbase. Trust third parties in Bitcoin storage is very dangerous.

[m2017]

Based on what I’ve read, it seems non coldcard wallets are safe. But how do we know if these other mainstream wallets are safe from other exploits that we currently are not aware of?

Hardware wallet paranoia is gaining momentum?

Hackers will help us find out which wallets are vulnerable and which are not.

Luckily, I do not have a coldcard. But I am not sleeping easy right now with my setup.

Or unfortunately. Because the Coldcard incident is over (it seems), but other devices will likely have to face something similar. Just kidding, just to heighten the fear.

Use the multi-signature feature to improve your sleep.

It seems the scale of this incident (the impact on crypto owners) will only grow, as fear and doubt have been sown in users' minds.

Has there been real academics or non crypto related researchers (unbiased) that have published findings on the open source Trezor software?

It looks like we now know which wallet you own.

Ledger secure element is close source. It is among the wallets that I can not recommend.

Trezor is open source. Its code will be checked from time to times by some other developers. But in case if any bad like this happens, just make sure you use passphrase or go for a multisig wallet to avoid it.

Coldcard was also open source, wasn't it? So, in light of current events, it's unclear what could be safer.

[rbynxx]

If I'm non-technical I think I'd be having PTSD over this, but I think not rashing on anything or monitor the situation is best thing to do and bitcointalk is the right place for that to reduce the noise. You're fine as long as you have no balance or never used COLDCARD.

However, this recent event definitely shattered trust on hardware wallets. I'm thinking is there a way you make your own hardware or software wallet or just use open source? What are the pros and cons if I make my own?

[Catenaccio]

Coldcard was also open source, wasn't it? So, in light of current events, it's unclear what could be safer.

Coldcard is close source. The source code of Coldcard is only for verifiable but not open source.
nvk is against open source too.

nvK c0inkite c0ldacrd is Anti-OpenSource nutcase.

It's more pathetic that Coldcard knew about this security issue reported by their hardware wallet users but they silenced them while kept moving onward without fixing anything.

An old post is now resurfacing where someone reported that their bitcoin was stolen from a Coldcard Mk4 back in 2022. Other people apparently confirmed that the same thing happened to them but they were blocked and silenced. It just keeps getting worse and worse. Someone could have discovered this vulnerability years ago before the draining of wallets began a few days ago. Same individual/group or a different one... who knows.

https://x.com/Zenul_Abidin/status/2083756420843839872

[Zaguru12]

Now they are doing the opposite by moving coins to exchanges, as the ongoing multi‑million‑dollar Coldcard hardware‑wallet incident, which began Friday, has raised fresh questions about the safety of self‑custody.

This is not any surprise I don’t take it as anything it’s simply just people panicking and nothing more, they moved their bitcoins out of centralized wallet to self custodial wallets when bybit was compromised last year and this is another round circle movement which is actually based on fear and nothing more.

I will rather have trust on many people verifying a wallet code (open source) than trusting a wallet which only the owners can verify.

But to be sincere, I don’t see the difference between someone using closed source wallets with someone using centralized exchanges, To be more brutal they are even better off with ETF because all three are in one category which is blindly trusting the institution or manufacturer

.
However, this recent event definitely shattered trust on hardware wallets. I'm thinking is there a way you make your own hardware or software wallet or just use open source? What are the pros and cons if I make my own?

The create your own cold/offline  wallet remains the best option until date for me. Just get an airgapped device and then use electrum in offline mode or any reputable open source wallet and then create your seed phrase, add passphrase and then broadcast your  transaction from watch only software wallets.

PROS: you’re not trusting anybody but rather yourself.
CONS: the point of failure is your set up wasn’t actually offline, you might have used a bad device which is not totally cold device

[Somegory]

Based on what I’ve read, it seems non coldcard wallets are safe. But how do we know if these other mainstream wallets are safe from other exploits that we currently are not aware of?

Luckily, I do not have a coldcard. But I am not sleeping easy right now with my setup.

Has there been real academics or non crypto related researchers (unbiased) that have published findings on the open source Trezor software?

I hope you will listen to what Charles - Tim said....

Abandon Ledger, go for Trezor or other airgapped devices
Then apply Passphrase to your recovery seed.

Trezor and Keystone supports Passphrase.
I just applied one to my Keystone and man, I clearly understand why this is necessary.

One way or the other if my recovery seed got leaked, they still aren't getting anything, because the welcome wallet address they will see is completely empty, just use a very strong passphrase and write is down offline.

Now you have two responsibilities, keeping Passphrase safe and also keeping recovery seed safe too.
Make sure you don't lose either, cos one is useless without the other, you lost one you lost everything.
Even a simple space bar makes a difference, * @ # ✓π{}$×¥ all make a difference, create a very strong passphrase.

[montaga]

I used my hardware wallet once to test, that was it. Never used it again, just a no no for me.
Paper wallet engraved in steel (alu) plate is still the best after all those years.  
People who talk it bad are most likely the once profiting from the cold wallet exploits.
https://99bitcoins.com/bitcoin-wallet/paper/

[MusaMohamed]

I used my hardware wallet once to test, that was it. Never used it again, just a no no for me.
Paper wallet engraved in steel (alu) plate is still the best after all those years.  
People who talk it bad are most likely the once profiting from the cold wallet exploits.
https://99bitcoins.com/bitcoin-wallet/paper/

Paper wallet is like a method for your wallet backup. The possible issues are with the sites or softwares you use to create your wallet, before making backups on paper or steel plates.

[Guide] Bitcoin cold storage. They still have yet removed Coldcard from recommended hardware wallet list.

Paper Wallets

Before hardware wallets existed, people generated key pairs on an offline computer and printed them as QR codes on paper. This was the original form of cold storage.

Paper wallets have largely been replaced by hardware wallets because they are difficult to create securely and easy to make mistakes with. Generating a truly random key on a clean offline computer, printing without saving to disk, and spending from a paper wallet without exposing the key all require significant technical care.

For most people, a hardware wallet is simpler and more secure than a paper wallet.

Bitcoin Q&A: Using Paper wallets.
For the Last Time, Stop Using Paper Wallets!

If you don't want paper, but want steel.
Securing Your Seed Phrase with Washers.
Metal Bitcoin Seed Storage Reviews.
Crypto Security - Additional Protection For Your Seed/Private Keys.
n0nce's Steel Washer Backup jig (customisable).
Stainless steel Bitcoin Recovery Seed Plate.

[PostQuantumBTC]

Coldcard was also open source, wasn't it? So, in light of current events, it's unclear what could be safer.

Coldcard is not an open source wallet, it is close source but it is reproducible

Use the multi-signature feature to improve your sleep.

You can also use passphrase if multisig look difficult to have.

It is also good to stop using any close source wallet. I saw a post that dkbit98 complained about the wallet, that people should not use it again, but many people can see similar post but they will not listen.

[rbynxx]

.
However, this recent event definitely shattered trust on hardware wallets. I'm thinking is there a way you make your own hardware or software wallet or just use open source? What are the pros and cons if I make my own?

The create your own cold/offline  wallet remains the best option until date for me. Just get an airgapped device and then use electrum in offline mode or any reputable open source wallet and then create your seed phrase, add passphrase and then broadcast your  transaction from watch only software wallets.

PROS: you’re not trusting anybody but rather yourself.
CONS: the point of failure is your set up wasn’t actually offline, you might have used a bad device which is not totally cold device

So basically, the only thing that will make this bad is yourself and how you set it up, and you really need to be a tech-savvy individual to DIY or probably knows basic safety and can read instructions to do this. Never done this before tbh but curious and might make one. This hack was all over my X timeline so was curious if there's a possibility.