Self custody is not reliable

[Ayers]

and it's why my friends believe that this attack was planned to make people have doubts about self custody.

Come to think about it, who benefited the most out of this attack?, exactly...

i have never stored my Bitcoin on centralized platform, nor do I support using them for custody. however, we should be fair here. whether this attack was planned in advance and intentional or not, it doesn't change the fact that the vulnerability existed and went undetected for years until it was finally exploited.

coldcard should take responsibility and compensate the people who placed their trust in the company.
as for us, this should be a reminder that there is no such thing as absolute security. every solution has its own risk, and we should do everything we can to improve our security instead of becoming complacent just because we are using a solution that is widely considered secure.

[Smartvirus]

NOT YOUR KEYS, NOT YOUR COINS. Exchanges are never the best options, there have been series of serious hacks in history like FTX, MTGOX, BYBIT, etc and the fact that exchanges breeds centralization and trusting a third party which is still the same thing Bitcoin came to eliminate. Exchanges are tools of the government and can seize your funds upon request and deprive you of the right to use your money whenever you want.

Risks from centralized exchanges as a fund storage are truly existing and big too but if people don't know how to create and secure their wallets, backups and funds properly, they can choose biggest and most trusted centralized exchanges to use for trading and fund storage. Of course, it's only temporary solution and they must learn to become self custodians properly.

That brings you back right where you started and what it simply means is that, self custody remains the only reliable means to ensure the safety of your Bitcoin(s).

At times, we tend to make the idea of self custody a lot more complicated than it actually is. It’s simply keeping your seed phrase or private keys safe.
Should you own an account on a centralized exchange, you are still responsible for keeping the logins of that account safe, its password included. Same applies to self custody except for one twist, the possibility of password recovery.

Self custody all comes down to one thing, a reliable means that suits you to keep what you deem important private and safe.

[Miles2006]

Come to think about it, who benefited the most out of this attack?, exactly...
This message might look too early but I'm sure that what's going to be pushed from now on is people needs to trust centralised platforms more.

Self custody remains the best, I mean letting a third party hold our coin is very dangerous probably you might think the centralized exchange is reliable and it has been for long still anything can happen at any time when dealing with centralized platforms.
I don’t see this hack situation going on with COLDCARD as a means to start viewing centralized exchange as an option, we get this hack almost all the time with centralized platforms so there’s nothing new I guess anyone who’s threaten by this don’t know how bad storing bitcoin in a centralized exchange can be, non custodial is still the best but, we must be very careful when choosing which wallet is reliable enough in other to avoid stories like hack and the rest.

[SeriouslyGiveaway]

At times, we tend to make the idea of self custody a lot more complicated than it actually is

Two complicated is not good as it is warned in How to back up a seed phrase?

Seed Backup Threat Model

We already know why we are creating seed backups - to protect against loss of whatever devices (if any) we are storing the keys on for regular use. But what do we need to worry about protecting the backups themselves against?

    Loss due to destruction
    Loss due to complexity / not being able to restore from backup
    Loss to an attacker

It’s simply keeping your seed phrase or private keys safe.
Should you own an account on a centralized exchange, you are still responsible for keeping the logins of that account safe, its password included. Same applies to self custody except for one twist, the possibility of password recovery.

Self custody all comes down to one thing, a reliable means that suits you to keep what you deem important private and safe.

It only requires people to do two main things rightly.

Choose a good wallet to use: it must be secure in creating private keys/ mnemonic seeds with enough entropy (128 bits at least).
Do other steps in wallet download, installation, verification, creation, backup, recovery and practical use from storage to transactions securely.

All sub steps in the second thing list are all important but they are meaningless if the first step was not chosen and done well. Coldcard hack is an example, people can do many things rightly as security advice but they chose a bad hardware wallet, then funds were stolen by hackers.

[NotATether]

When Bybit was hacked, people were moving their coins from exchanges to noncustodial wallet. When a noncustodial wallet was hacked, people were moving their money from noncustodial wallet to exchanges.

And every time someone says self-custody is not reliable or exchanges are not reliable or whatever, both are slightly valid points but they're just beating around the bush.



"Insanity is doing the same thing over and over again and expecting different results" - Einstein

The truth is that nothing is going to change if we do not increase the security of our wallets.

[hd49728]

And every time someone says self-custody is not reliable or exchanges are not reliable or whatever, both are slightly valid points but they're just beating around the bush.



"Insanity is doing the same thing over and over again and expecting different results" - Einstein

The truth is that nothing is going to change if we do not increase the security of our wallets.

I don't know what you call it but I call it as a Mistake Cycle: from exchanges to self custodial wallets to exchanges.

People do that, repeat the cycle, repeat their mistakes in the past simply because they don't understand about security well enough, they don't master only fundamentals of Bitcoin and Bitcoin wallets.

If they understand Bitcoin fundamentals well enough, they will choose self custodial wallets but will no longer blindly choose any recommended hardware wallets to use. Now they will consider about entropy of seed created from the hardware wallet method, and know importance of wallet seed phrase so they will have more reasons to create their own passphrases for their wallets in order to increase its security against hackers.

[citywise2]

There is nothing better than open source noncustodial wallets, but do things right. Use passphrase to extend your seed phrase with an impossible to guess and impossible to brute force passphrase of go for multisig wallet.

I agree with you, people just lack knowledge and that’s why they follow the crowd and don’t really know exactly what they should do when it comes to keeping their holdings safe. Op claims self custody isn’t reliable, I can’t blame him for saying that. maybe he had a bad experience with a self custody wallet. My friend and I usually thought trust wallet was the reliable in the past because it’s a self custody wallet, and we had our seed phrase, unknown to us that it was a closed source wallet, and the code could have a bug or even be compromised my the company without our knowledge. And we started hearing how people lost their fund they kept on the trust wallet.
Then I made research on the possibility and how people lost coin through self custody wallet and I realised that you don’t only go for self custody wallet, but an open source self custody wallet that the code could be seen and reviewed by everyone using it.

You sure misconstrued that, see words in bold! OP was merely citing a quote that seemed to highlight the mindset of possibly those behind the ColdCard incident and as he rightly pointed out, it serves only the interest of the exchanges and the authorities by extension. They want you to leave your funds where they can see it and even snatch it at will and  like you said, people perish because of lack of knowledge, we should be the wiser  because they won't stop stirring up issues like this. Open source noncustodial wallets remain the best choice.

[Livingleged]

There is nothing better than open source noncustodial wallets, but do things right. Use passphrase to extend your seed phrase with an impossible to guess and impossible to brute force passphrase of go for multisig wallet.

You sure misconstrued that, see words in bold! OP was merely citing a quote that seemed to highlight the mindset of possibly those behind the ColdCard incident and as he rightly pointed out, it serves only the interest of the exchanges and the authorities by extension. They want you to leave your funds where they can see it and even snatch it at will and  like you said, people perish because of lack of knowledge, we should be the wiser  because they won't stop stirring up issues like this. Open source noncustodial wallets remain the best choice.

First of all I’ll like you to learn how to quote or mention users properly, and stop confusing readers. The first part you bolded wasn’t OP’s statement but rather @charle Tim’s which  was the user I was responding to. You made it look like it was my statement, now anyone reading your post will think I was the one that wrote that part because you mentioned me and attached part of someone else’s reply.

[Tungbulu]

When Bybit was hacked, people were moving their coins from exchanges to noncustodial wallet. When a noncustodial wallet was hacked, people were moving their money from noncustodial wallet to exchanges.

And every time someone says self-custody is not reliable or exchanges are not reliable or whatever, both are slightly valid points but they're just beating around the bush.

"Insanity is doing the same thing over and over again and expecting different results" - Einstein

The truth is that nothing is going to change if we do not increase the security of our wallets.

What many people fail to realize is that, safety isn’t necessarily about WHERE your coins are stored but more about HOW you choose to store them. Self custody isn’t immune to hack or theft, especially when your mismanage your seed phrases, and exchanges are the worst because you’re literally trusting third party to help you store your coins which can be even more dangerous.

[knowngunman]

This is the message that's been indirectly passed by what happened with ColdCard hardware wallet, and it's why my friends believe that this attack was planned to make people have doubts about self custody.

Nop, I don't believe the attack is planned unless there is a convincing evidence to support that claim. Nothing beat self custody when it comes to Bitcoin investment but it becomes a problem if you don't do it rightly.

There is no custody of Bitcoin that has no risk, they all have risk but the degree of risk is higher than each other.

This is the part some people don't understand. There is no risk free way to hold bitcoin, it's better to choose the risk you can control. If you're holding your coin with external entities, you can not control the risk. It's totally under their control and you're just like a watch dog. Even Offline storage doesn't erase risk but it reduces it drastically. Unless you're running away from responsibility, self custody is the lower risk among others.

[IceLincoln]

ETFs are far more reliable than you holding Bitcoin yourself.
Self custody is not reliable, let crypto exchanges do the holding for you.

Instead of trusting some Bitcoin wallet that promised self custody it's better to trust JP Morgan.
It's better to have trust in BlackRock so that you can sleep well in the night.

You can't wake up and see your Bitcoin moved into another person's wallet address.
Never ever trust Self Custody.

This is the message that's been indirectly passed by what happened with ColdCard hardware wallet, and it's why my friends believe that this attack was planned to make people have doubts about self custody.

Come to think about it, who benefited the most out of this attack?, exactly...
This message might look too early but I'm sure that what's going to be pushed from now on is people needs to trust centralised platforms more.

People needs to trust Blackrock, fidelity, and others than self custody, but nothing beats self custody even after what happened, this attack will be an eye opener to why you and I should be picky when it comes to self custody.

Self Custody is still Superior to centralised options, with multi signature setups and 100 Dice rolls your wallet will be more stronger than ever

I can understand it’s the emotions of people driving all these messages, people have lost their lifesavings, a big fortune, years of efforts and sacrifices it’s enough to drive a spike in emotions and outbursts. Then again competitors can use this to push their markets. I don’t think this was planned by the ETFs and others, it’s just an unlucky sad events.
Another reminder we should take security of our assets very seriously. Do not depend on only seedphrase as security add pass phrase too; make it random and difficult. Those who had pass phrase in their coldcard were saved from this catastrophic attack.

[purple_sparkles]

 What happened with the Coldcard hack is really unfortunate, and many people genuinely lost their savings. It’s another reminder that you should spread out your investment assets rather than keep everything in one place. And it’s not even about the saying that any security system can eventually be hacked. Any form of protection can potentially be compromised in one way or another. But if you diversify your investments, or at least spread them across several different wallets or trusted custodians, then even if something goes wrong, the losses won’t be nearly as devastating as they would be if everything were kept in one place.

[Shishir99]

You just need to know what you are doing. Of course, a self-custodial coldcard wallet was a good option. But the coldcard wallet users were unlucky to choose that wallet. I saw a thread by dkbit who shared that Coldcard was anti-open source. If they were open source, I bet some people would have checked the code and probably found the issues early. The damage could have been smaller. So, before a person chooses a wallet, they should do their own research.

Of course, self-custody is still superior, and it will remain superior to centralized services. But users need to be updated. They should not miss any events. I am sure some Coldcard users were able to move their funds somewhere else before the hacker touched their money. It's because they learned about this attack and acted in a timely manner.

[Kelward]

What happened with the Coldcard hack is really unfortunate, and many people genuinely lost their savings. It’s another reminder that you should spread out your investment assets rather than keep everything in one place. And it’s not even about the saying that any security system can eventually be hacked. Any form of protection can potentially be compromised in one way or another. But if you diversify your investments, or at least spread them across several different wallets or trusted custodians, then even if something goes wrong, the losses won’t be nearly as devastating as they would be if everything were kept in one place.

This Coldcard, hack is very unfortunate, we have been encouraged to be holding our Bitcoin in none custodial wallets especially hardware wallets for extra security because they are offline. Now we find out that even the recommended hardware wallet are not totally guaranteed to protect our Bitcoin from being stolen, this news about Coldcard, hack is a very big heartbreaker for many of us. Self custody have now been proven not to be 100% secured for our Bitcoin and the best thing to do like you said is to spread our Bitcoin into different brands of wallets for safekeep, if something happens in one none custodial wallet you will still hold on to the others. Despite what happened in Coldcard, I still prefer self custody over exchanges and ETFs because they can likewise be hacked.

[Aanuoluwatofunmi]

Come to think about it, who benefited the most out of this attack?, exactly...
This message might look too early but I'm sure that what's going to be pushed from now on is people needs to trust centralised platforms more.

Coldcard hack is just a target on its users and not on non-costodial storage, we have to understand the relevance of using a non-custodial wallet to that of a custodial wallet and we cannot apply the same challenges currently faced by the user of coldcard as being applicable to every other hardware wallet users or derailed on the integrity of using a non-custodial wallet.

[Son Of Blockchain (SOB)]

You just need to know what you are doing. Of course, a self-custodial coldcard wallet was a good option. But the coldcard wallet users were unlucky to choose that wallet. I saw a thread by dkbit who shared that Coldcard was anti-open source. If they were open source, I bet some people would have checked the code and probably found the issues early. The damage could have been smaller. So, before a person chooses a wallet, they should do their own research.

Of course, self-custody is still superior, and it will remain superior to centralized services. But users need to be updated. They should not miss any events. I am sure some Coldcard users were able to move their funds somewhere else before the hacker touched their money. It's because they learned about this attack and acted in a timely manner.

I'll never question self custody cause it's part of the reason for Bitcoin's existence so going against it means going against one of the purpose of the coin, i knw that people are not pleased with what played out with the coldcard wallet but it shouldn't make them question self custody but learn to keep the coin they're holding more secure.
 Those who were lucky to escape the hack would be wise enough to move their funds, i just hope some won't move it to a wallet with weaker security due to panic, moving it to a multisig wallet is a good idea.

[Uhwuchukwu53]

To me, this wasn't a failure of self-custody. Of course Wall Street and centralized exchanges will use this to push the "trust us instead" narrative. They love stuff like this.

But ditching self-custody over one company’s screw-up is like quitting driving forever because a specific car model got recalled. Just think of all the centralized exchanges and services that have been hacked or rug-pulled over the years. You’re right about multisig and rolling your own dice. Self-custody is still the way - this just proves that we have to be way pickier about how we do it.

The factual truth seem hidden for those who haven't fallen victim of  crashed exchange where the option of self-custody could be the mostly preferable despite all odd, I recall in past where my friend that have accumulated and was using hard earned money to buy Bitcoin and others crypto without this very initiative of self custodian was left in shock after a crashed of the exchange despite the promise haven't recovered all he labour, the use of self custodian is already cutting down higher level of risk nothing can take away risk even in our  domestic bank where saving is made risk factor is only reduced but is not completely taken away. I will agree with the saying if "decodx" .

[Findingnemo]

If someone is convinced that they are not even capable of handling their own assets, then they shouldn't have assets, it would be better if they just go back to being slaves and served their master according to the commands. That is exactly what these institutions are trying to replicate, but in a bit softer version.

[MiF]

What happened with the Coldcard hack is really unfortunate, and many people genuinely lost their savings. It’s another reminder that you should spread out your investment assets rather than keep everything in one place. And it’s not even about the saying that any security system can eventually be hacked. Any form of protection can potentially be compromised in one way or another. But if you diversify your investments, or at least spread them across several different wallets or trusted custodians, then even if something goes wrong, the losses won’t be nearly as devastating as they would be if everything were kept in one place.

This Coldcard, hack is very unfortunate, we have been encouraged to be holding our Bitcoin in none custodial wallets especially hardware wallets for extra security because they are offline. Now we find out that even the recommended hardware wallet are not totally guaranteed to protect our Bitcoin from being stolen, this news about Coldcard, hack is a very big heartbreaker for many of us. Self custody have now been proven not to be 100% secured for our Bitcoin and the best thing to do like you said is to spread our Bitcoin into different brands of wallets for safekeep, if something happens in one none custodial wallet you will still hold on to the others. Despite what happened in Coldcard, I still prefer self custody over exchanges and ETFs because they can likewise be hacked.

Don't let the Cold Card incident make you think that self-custody isn't reliable, it's just that nobody's security solution is perfect. With self-custody, the counterparty risk associated with relying on an exchange is eliminated, but it does not mean that the exchange rules out the need for sound security measures. With the correct usage and trusted vendors. Hardware wallets are still one of the most secure storage methods for Bitcoin. It's a good strategy to spread investments across several wallets. Particularly if you have a significant amount of cash. The point isn't that you won't need to rely on self-custody, it's that you shouldn't depend on any single device or security measure as if it were invulnerable to being compromised.

[#CapsLOck]

When Bybit was hacked, people were moving their coins from exchanges to noncustodial wallet. When a noncustodial wallet was hacked, people were moving their money from noncustodial wallet to exchanges.

And every time someone says self-custody is not reliable or exchanges are not reliable or whatever, both are slightly valid points but they're just beating around the bush.

"Insanity is doing the same thing over and over again and expecting different results" - Einstein

The truth is that nothing is going to change if we do not increase the security of our wallets.

What many people fail to realize is that, safety isn’t necessarily about WHERE your coins are stored but more about HOW you choose to store them. Self custody isn’t immune to hack or theft, especially when your mismanage your seed phrases, and exchanges are the worst because you’re literally trusting third party to help you store your coins which can be even more dangerous.

That it's not about picking a side and saying this is the best but about security practices. Self-custody means absolute control. And absolute responsibility for keeping the keys and backups safe. While it is easier to find exchanges. They also carry the risk of counterparty risk beyond your control. Rather than shifting money from one wallet to another after each major hack. Users should work on their own security practices They should use secure hardware wallets. Ensure their funds are backed up offline. And not keep everything in a single wallet.