For nontechnical people, how are we supposes to know Trezor, Ledger, are safe

[arwin100]

Ledger secure element is close source. It is among the wallets that I can not recommend.

Trezor is open source. Its code will be checked from time to times by some other developers. But in case if any bad like this happens, just make sure you use passphrase or go for a multisig wallet to avoid it.

Indeed ledger is not recommendable, since no one can verify how they secured our private keys.

This is what I like about Trezor, since they let community verify those safety protocols that they have done. Also adding those multi sig and passphrase will truly heal people to have more stronger protection even if there's some flaws or troubles shows up.

So with all of this things I believe having good security practice and being transparent is more better than those closed source set ups.

[suhadi88]

Price and storage security are two separate decisions. It's important to remember not to assume any single device is perfect. No secure system is always a matter of initial entropy; everything has weaknesses. Regardless of how clever we are, the key is that storage should be based on risk tolerance.

[TedMosby]

It's a good question and it makes this thread worth reading.

Ledger secure element is close source. It is among the wallets that I can not recommend.

Trezor is open source. Its code will be checked from time to times by some other developers. But in case if any bad like this happens, just make sure you use passphrase or go for a multisig wallet to avoid it.

I think what OP meant is how do we know if a wallet is safe or not when we don't even have technical-related skills? Not everyone in the crypto space has that knowledge. Most people choose a wallet based on what other people use or recommend as safe. It's more about trust. Even if they know a wallet is open source or closed source, it doesn't mean much to non technical users. It's difficult for them to verify.

Also, for me, open source is not a guarantee that a wallet is safe or safer than a closed source wallet. It still depends on the people who contribute to the project. Imagine if the developers behind a closed source wallet are a group of elite developers and white hackers with 20 years of cyber security experience. Meanwhile, the open source wallet is developed by mid tier developers with contributions from thousands of other mid tier developers. In that case, how would people with no technical-related skills choose?

Sorry if my thinking is flawed or anything. I just find it interesting and I'm genuinely asking.

[Charles-Tim]

Also, for me, open source is not a guarantee that a wallet is safe or safer than a closed source wallet.

Yes, but just as I have posted, open source code is available for the public to review, the chance of seeing a bug or vulnerability in open source wallets is far higher than seeing it in close source wallets. Open source wallets are the way to go in my opinion, but only the reputable ones should be used. Open source wallet can be malicious, the reason the ones that are not reputable yet should be avoided.

[buwaytress]

When creating a wallet, click on Options and choose "Extend this seed with custom words".
Type the custom words you want, and you have to back up (write down) both wallet seed words and your custom words.

Yes! lso something I used recommend to people from where I come from (there is almost no interest now). My native language isn't spoken by many, does not have a full formal dictionary, and does not have a very ambiguous latinised spelling. I think most local dialects are similar, and that makes it a natural defence against major language brute force.

If we were to compare the differences between these two wallets, it really comes down to radically different approaches to open-source and transparency. Electrum operates under standard, OSI-approved open-source licenses. Anyone can fork, inspect, modify, host, or re-distribute the code without restriction. A true Open Source. Because it is used as the codebase for countless wallet integrations, and thousands of independent developers regularly fork, test, compile, and stress-test the code.

Coldcard, on the other hand, has the "source available" facade. They transitioned their firmware to a proprietary license with a commons clause. This prevented independent developers from using their code, commercially or non-commercially. Because of this, developers outside of Coinkite had little incentive to actually build with, maintain, or deeply test the firmware.

This is exactly what brought them to their doom, in my opinion. The sheer arrogance and poor licensing decisions of their founder and CEO, Rodolfo Novak (aka nvK).

Then my suspicions, laid out in non-technical terms, are well-founded.

Battle-tested is what I have said before as my preference. A base source that so many people used (when I started out, using alt wallets, I even thought this was simply default, understanding later that almost everything I used simply derived from Electrum). Without needing to know much, just basic observation over the 10+ years I've used Electrum tells me I'm in safe(r) hands than switching to something that, even when open source, is at the bottom limits of the definition.

[YellowSwap]

Everyone on here are all once nontechnical, they learn and listen to advices on here they are lost who they once were yesterday and turned to new leaves, you can do the same if you are ready to learn.

Avoid any wallet that's not fully open source, like Ledger.
Avoid wallets that have proven to always give problems here and there,, and that's Ledger.

Do you know that ColdCard is new to me? I've never heard the name before until they got hacked.
I am still surprised that someone many people are using ColdCard and I don't know about it.

If those people just decided to stick with Trezor which is completely open source but of those losses will happen to them, ColdCard don't know what they are doing.

[MusaMohamed]

I second that stance on Ledger. I hate that company with a passion for several reasons.
They had some major f-ups in the past: Their user-data got leaked exposing over one million e-mail addresses and associated names and address info of people that purchased Ledger wallets.
See https://haveibeenpwned.com/Breach/Ledger

You can use that site to check history of wallet brands but I feel unsafe to use it to check emails. That site has this feature but I feel risky to enter my email address and check with them.

If I am unsure about my email security, I can reset its password, make a new strong one, reset 2FA for that email, that's enough.
Additionally, if I still feel unsafe, I can abandon that email.

The check for passwords is not helpful with me too.
https://haveibeenpwned.com/Passwords

I will check my password with
Are your passwords in the green (2026)? If I feel my passwords are weak, I will change them with password managers, and no longer manually create my passwords.
[GUIDE] How to Create a Strong/Secure Password.

Also their feature to restore a wallet is extremely shady and was criticized by the whole Bitcoin-sphere.

It was discussed a lot like a very hot topic in 2023.
Ledger Recovery - Send your (encrypted) recovery phrase to 3rd parties.

[Kavelj22]

However for nontechnical people I think it's better to use hardware wallet that is known to have large users which means more money allocated to security audit, which also means lesser chance of bug as critical as this to happen but it's just my opinion..

And your opinion is very misleading because popularity doesn't surely mean security. Coldcard was widely used (proven by the number of transactions broadcasted by the hacker from infected wallets) and nobody doubted its integrity until Boom everything is gone. We already have millions of users sitting on a bomb called Ledger. Don't follow them.

For nontechnical users, their only hope is to follow opinions from devs community who can facilitate things at a basic level. The only community I can mention is bitcointalk technical boards where experts discuss everything especially critical parts. Here everybody can use technical boards to ask about any wallet and every detail without the need for deep knowledge level. Stay tuned.

[vapourminer]

Just keep it simple and use Electrum and backup your wallet to a flashdrive. Keep it simple.

big nope here. flashdrives go bad to easily.

 

[Stalker22]

Just keep it simple and use Electrum and backup your wallet to a flashdrive. Keep it simple.

big nope here. flashdrives go bad to easily.

I totally agree. Flash drives will degrade over time and experience hardware failure. They can also suffer from bit rot if left unpowered. If you use Electrum, always write your seed phrase down on physical paper or stamped stainless steel, never just a USB flash drive.

[bbc.reporter]

Now they are doing the opposite by moving coins to exchanges, as the ongoing multi‑million‑dollar Coldcard hardware‑wallet incident, which began Friday, has raised fresh questions about the safety of self‑custody.

This is not any surprise I don’t take it as anything it’s simply just people panicking and nothing more, they moved their bitcoins out of centralized wallet to self custodial wallets when bybit was compromised last year and this is another round circle movement which is actually based on fear and nothing more.

I will rather have trust on many people verifying a wallet code (open source) than trusting a wallet which only the owners can verify.

But to be sincere, I don’t see the difference between someone using closed source wallets with someone using centralized exchanges, To be more brutal they are even better off with ETF because all three are in one category which is blindly trusting the institution or manufacturer

Yes, it very much appears that these creators of coldcard are bitcoin maximalist larpers who very headshakingly created a hardware wallet that connects to a battery because they declare that your usb port cannot he trusted heheheheh!

These coldcard bitcoin maximalist larpers also declare do not trust, you verify, however, these creators  did not verify the function of their own creation! This certainly makes it appear that similar to some of the people in this forum, there are many larpers in this community!

[X-ray]

Just keep it simple and use Electrum and backup your wallet to a flashdrive. Keep it simple.

big nope here. flashdrives go bad to easily.

 

Confirmed it myself that flashdrive is really bad to store long term thing like seed phrases.

I actually own 3 small ext SSDs and 2 flash drive to store my seedphrase, 5 storage is for the sake of redundancy because I don't write my seed phrase to a paper because I can't encrypt a paper and I'm not sure I can keep prying eyes off it.

2 of the flash drive go bad the first year and the SSDs still going strong today even after 3 years. if anyone want to store seed phrase, be sure to choose the storage type correctly like SSD even SSD with TLC NAND is preferable, but the catch is to connect the ssd once in a while.

[MusaMohamed]

big nope here. flashdrives go bad to easily.

They are still can be one of backup methods and tools. As it is recommended to make multiple backups, and flash drives can be used too but it is only terrible practice if people only have one backup on a flash drive, it's a red flag for high potentially loss in the future.

Confirmed it myself that flashdrive is really bad to store long term thing like seed phrases.

I actually own 3 small ext SSDs and 2 flash drive to store my seedphrase, 5 storage is for the sake of redundancy because I don't write my seed phrase to a paper because I can't encrypt a paper and I'm not sure I can keep prying eyes off it.

2 of the flash drive go bad the first year and the SSDs still going strong today even after 3 years. if anyone want to store seed phrase, be sure to choose the storage type correctly like SSD even SSD with TLC NAND is preferable, but the catch is to connect the ssd once in a while.

You must store your flash drives carefully to avoid losing them to someone else. With flashdrives, they can technically die so regularly checkups is important. It is helpful to detect which drives were dead and replace them in order to make sure that you will have one to use for wallet recovery.

In addition, flash drives can be used for Tail OS.
How to Install Tails OS on USB flash drive for Wallet Purpose.

[decodx]

<...>
 I don't write my seed phrase to a paper because I can't encrypt a paper and I'm not sure I can keep prying eyes off it.

Technically, you can. It's called a BIP-39 passphrase.

You can write your 12 or 24 seed words down on paper (or stamp it on metal). If prying eyes find that paper, it is completely useless to them without the custom passphrase, which you store separately or memorize.

Other possible solutions are multisig and Shamir's Secret Sharing.