Self custody is not reliable

[Ayers]

and it's why my friends believe that this attack was planned to make people have doubts about self custody.

Come to think about it, who benefited the most out of this attack?, exactly...

i have never stored my Bitcoin on centralized platform, nor do I support using them for custody. however, we should be fair here. whether this attack was planned in advance and intentional or not, it doesn't change the fact that the vulnerability existed and went undetected for years until it was finally exploited.

coldcard should take responsibility and compensate the people who placed their trust in the company.
as for us, this should be a reminder that there is no such thing as absolute security. every solution has its own risk, and we should do everything we can to improve our security instead of becoming complacent just because we are using a solution that is widely considered secure.

[Smartvirus]

NOT YOUR KEYS, NOT YOUR COINS. Exchanges are never the best options, there have been series of serious hacks in history like FTX, MTGOX, BYBIT, etc and the fact that exchanges breeds centralization and trusting a third party which is still the same thing Bitcoin came to eliminate. Exchanges are tools of the government and can seize your funds upon request and deprive you of the right to use your money whenever you want.

Risks from centralized exchanges as a fund storage are truly existing and big too but if people don't know how to create and secure their wallets, backups and funds properly, they can choose biggest and most trusted centralized exchanges to use for trading and fund storage. Of course, it's only temporary solution and they must learn to become self custodians properly.

That brings you back right where you started and what it simply means is that, self custody remains the only reliable means to ensure the safety of your Bitcoin(s).

At times, we tend to make the idea of self custody a lot more complicated than it actually is. It’s simply keeping your seed phrase or private keys safe.
Should you own an account on a centralized exchange, you are still responsible for keeping the logins of that account safe, its password included. Same applies to self custody except for one twist, the possibility of password recovery.

Self custody all comes down to one thing, a reliable means that suits you to keep what you deem important private and safe.

[Miles2006]

Come to think about it, who benefited the most out of this attack?, exactly...
This message might look too early but I'm sure that what's going to be pushed from now on is people needs to trust centralised platforms more.

Self custody remains the best, I mean letting a third party hold our coin is very dangerous probably you might think the centralized exchange is reliable and it has been for long still anything can happen at any time when dealing with centralized platforms.
I don’t see this hack situation going on with COLDCARD as a means to start viewing centralized exchange as an option, we get this hack almost all the time with centralized platforms so there’s nothing new I guess anyone who’s threaten by this don’t know how bad storing bitcoin in a centralized exchange can be, non custodial is still the best but, we must be very careful when choosing which wallet is reliable enough in other to avoid stories like hack and the rest.

[SeriouslyGiveaway]

At times, we tend to make the idea of self custody a lot more complicated than it actually is

Two complicated is not good as it is warned in How to back up a seed phrase?

Seed Backup Threat Model

We already know why we are creating seed backups - to protect against loss of whatever devices (if any) we are storing the keys on for regular use. But what do we need to worry about protecting the backups themselves against?

    Loss due to destruction
    Loss due to complexity / not being able to restore from backup
    Loss to an attacker

It’s simply keeping your seed phrase or private keys safe.
Should you own an account on a centralized exchange, you are still responsible for keeping the logins of that account safe, its password included. Same applies to self custody except for one twist, the possibility of password recovery.

Self custody all comes down to one thing, a reliable means that suits you to keep what you deem important private and safe.

It only requires people to do two main things rightly.

Choose a good wallet to use: it must be secure in creating private keys/ mnemonic seeds with enough entropy (128 bits at least).
Do other steps in wallet download, installation, verification, creation, backup, recovery and practical use from storage to transactions securely.

All sub steps in the second thing list are all important but they are meaningless if the first step was not chosen and done well. Coldcard hack is an example, people can do many things rightly as security advice but they chose a bad hardware wallet, then funds were stolen by hackers.

[NotATether]

When Bybit was hacked, people were moving their coins from exchanges to noncustodial wallet. When a noncustodial wallet was hacked, people were moving their money from noncustodial wallet to exchanges.

And every time someone says self-custody is not reliable or exchanges are not reliable or whatever, both are slightly valid points but they're just beating around the bush.



"Insanity is doing the same thing over and over again and expecting different results" - Einstein

The truth is that nothing is going to change if we do not increase the security of our wallets.

[hd49728]

And every time someone says self-custody is not reliable or exchanges are not reliable or whatever, both are slightly valid points but they're just beating around the bush.



"Insanity is doing the same thing over and over again and expecting different results" - Einstein

The truth is that nothing is going to change if we do not increase the security of our wallets.

I don't know what you call it but I call it as a Mistake Cycle: from exchanges to self custodial wallets to exchanges.

People do that, repeat the cycle, repeat their mistakes in the past simply because they don't understand about security well enough, they don't master only fundamentals of Bitcoin and Bitcoin wallets.

If they understand Bitcoin fundamentals well enough, they will choose self custodial wallets but will no longer blindly choose any recommended hardware wallets to use. Now they will consider about entropy of seed created from the hardware wallet method, and know importance of wallet seed phrase so they will have more reasons to create their own passphrases for their wallets in order to increase its security against hackers.

[citywise2]

There is nothing better than open source noncustodial wallets, but do things right. Use passphrase to extend your seed phrase with an impossible to guess and impossible to brute force passphrase of go for multisig wallet.

I agree with you, people just lack knowledge and that’s why they follow the crowd and don’t really know exactly what they should do when it comes to keeping their holdings safe. Op claims self custody isn’t reliable, I can’t blame him for saying that. maybe he had a bad experience with a self custody wallet. My friend and I usually thought trust wallet was the reliable in the past because it’s a self custody wallet, and we had our seed phrase, unknown to us that it was a closed source wallet, and the code could have a bug or even be compromised my the company without our knowledge. And we started hearing how people lost their fund they kept on the trust wallet.
Then I made research on the possibility and how people lost coin through self custody wallet and I realised that you don’t only go for self custody wallet, but an open source self custody wallet that the code could be seen and reviewed by everyone using it.

You sure misconstrued that, see words in bold! OP was merely citing a quote that seemed to highlight the mindset of possibly those behind the ColdCard incident and as he rightly pointed out, it serves only the interest of the exchanges and the authorities by extension. They want you to leave your funds where they can see it and even snatch it at will and  like you said, people perish because of lack of knowledge, we should be the wiser  because they won't stop stirring up issues like this. Open source noncustodial wallets remain the best choice.

[Livingleged]

There is nothing better than open source noncustodial wallets, but do things right. Use passphrase to extend your seed phrase with an impossible to guess and impossible to brute force passphrase of go for multisig wallet.

You sure misconstrued that, see words in bold! OP was merely citing a quote that seemed to highlight the mindset of possibly those behind the ColdCard incident and as he rightly pointed out, it serves only the interest of the exchanges and the authorities by extension. They want you to leave your funds where they can see it and even snatch it at will and  like you said, people perish because of lack of knowledge, we should be the wiser  because they won't stop stirring up issues like this. Open source noncustodial wallets remain the best choice.

First of all I’ll like you to learn how to quote or mention users properly, and stop confusing readers. The first part you bolded wasn’t OP’s statement but rather @charle Tim’s which  was the user I was responding to. You made it look like it was my statement, now anyone reading your post will think I was the one that wrote that part because you mentioned me and attached part of someone else’s reply.

[Tungbulu]

When Bybit was hacked, people were moving their coins from exchanges to noncustodial wallet. When a noncustodial wallet was hacked, people were moving their money from noncustodial wallet to exchanges.

And every time someone says self-custody is not reliable or exchanges are not reliable or whatever, both are slightly valid points but they're just beating around the bush.

"Insanity is doing the same thing over and over again and expecting different results" - Einstein

The truth is that nothing is going to change if we do not increase the security of our wallets.

What many people fail to realize is that, safety isn’t necessarily about WHERE your coins are stored but more about HOW you choose to store them. Self custody isn’t immune to hack or theft, especially when your mismanage your seed phrases, and exchanges are the worst because you’re literally trusting third party to help you store your coins which can be even more dangerous.

[knowngunman]

This is the message that's been indirectly passed by what happened with ColdCard hardware wallet, and it's why my friends believe that this attack was planned to make people have doubts about self custody.

Nop, I don't believe the attack is planned unless there is a convincing evidence to support that claim. Nothing beat self custody when it comes to Bitcoin investment but it becomes a problem if you don't do it rightly.

There is no custody of Bitcoin that has no risk, they all have risk but the degree of risk is higher than each other.

This is the part some people don't understand. There is no risk free way to hold bitcoin, it's better to choose the risk you can control. If you're holding your coin with external entities, you can not control the risk. It's totally under their control and you're just like a watch dog. Even Offline storage doesn't erase risk but it reduces it drastically. Unless you're running away from responsibility, self custody is the lower risk among others.