Short-term impact of the Coldcard incident on Self-Custody

[Abiky]

Now that the Coldcard incident has caused millions in BTC losses, I am beginning to wonder how would this affect the self-custodial industry? I mean, will the impact be such that people will avoid hardware wallets forever? After what happened with Coldcard, many decided it was safer to move to a CEX instead. Others went ahead and bought Bitcoin ETFs. This is bad because it gives centralized entities more leverage over Bitcoin.

My question is, will the impact be short-lived or a long-lasting one? What would it take for people to trust doing self-custody of their BTC again (via HWs)?

Your input would be greatly appreciated. Thank you.

[free-bit.co.in]

If you are scared and send your Bitcoin to CEX, is that a security improvement, hmm?
It just nothing but changes the type of risk.
In self custody, you have to manage your own risk. You have to ensure of your hardware/seed/backup's security.

But in CEX your risk will be on exchange failure, hack, withdrawal freeze, insolvency, account seizure or counterparty risk. If we talk about ETF, you do not control your private key of Bitcoin here. So I don't see any logic in centralizing entire custody model as a response to a vendor failure at Coldcard.

[Chibit01]

I can tell for sure how much time that's needed for people to move past the trauma, but it also calls for more scrutiny and checking of source code over and over again to make sure there are no vulnerabilities that can be exploited. Being open source alone is not enough.

The hardware wallet and how people view them now will change and the best decision to take is not to move someone's holdings down to centralised entities. Instead, diversifying your holdings into different open-source wallets will best both the hot wallet and the cold wallet.

[Dogedegen]

Now that the Coldcard incident has caused millions in BTC losses, I am beginning to wonder how would this affect the self-custodial industry? I mean, will the impact be such that people will avoid hardware wallets forever? After what happened with Coldcard, many decided it was safer to move to a CEX instead. Others went ahead and bought Bitcoin ETFs. This is bad because it gives centralized entities more leverage over Bitcoin.

People make false conclusions using correct and false premises all the time, there is nothing that you can do about that seriously. You can provide education but that only works with people who want to get educated, you can't force it on people so many will ignore the correct advice. If you look at the data on hardware wallet hacks and CEX hacks, the conclusion is factually correct that using a CEX is significantly more insecure than using a hardware wallet. So if some people want to draw false conclusions that are not based on real data, there is nothing that we can do about that. They may learn their lesson once they lose their money in a big CEX hack, or they might not learn the lesson at all. Also this situation poses a good learning opportunity for everyone, because we now know that all hardware wallet should always be used with a passphrase because that would prevent a compromise like this.

My question is, will the impact be short-lived or a long-lasting one? What would it take for people to trust doing self-custody of their BTC again (via HWs)

The impact is short lived and it is limited to people who don't know how to conduct data and reason properly, you can't really do anything about that. All the data we have points at the superiority of hardware wallets and we have educational information everywhere, there is nothing else that can be done.

[m2017]

Now that the Coldcard incident has caused millions in BTC losses, I am beginning to wonder how would this affect the self-custodial industry?

Now, some users will be more cautious regarding the storage of their assets.

I mean, will the impact be such that people will avoid hardware wallets forever?

Every year, a large number of people die in car accidents (around 1.2 million, according to online data), yet that doesn't stop the global population from using cars, does it? That is why I believe the recent incident won't "kill" the HW market for these devices. After all, they remain one of the best ways to store cryptocurrencies (with the possible exception of Coldcard). Furthermore, a vulnerability in one company's device doesn't mean that all these devices have suddenly become useless trinkets.

After what happened with Coldcard, many decided it was safer to move to a CEX instead.

Because they forgot the Mt. Gox and FTX sagas (as well as what happened with other exchanges) all too quickly.

Others went ahead and bought Bitcoin ETFs.

Everyone makes their own choice. There is no need to reproach anyone for that.

This is bad because it gives centralized entities more leverage over Bitcoin.

Well, not everyone chose the path you described. Some people still remain true to the "traditions" and principles of self-custody.

My question is, will the impact be short-lived or a long-lasting one?

Do we need yet more predictions that won't affect the final outcome? Time will tell where this all leads. I expect quality control for these devices to improve, as no serious manufacturer would want to repeat Coldcard's "success".

What would it take for people to trust doing self-custody of their BTC again (via HWs)?

I think you are dramatizing the situation; I believe that peopl (or at least some of them) continue to trust hardware wallets and wouldn't give up self-custody for anything in the world.

Who among those reading this has thrown away their hardware device (unless it’s a Coldcard)? Is there anyone?

[salad daging]

This is only temporary in my view, because the current situation is still hot about the issue of Coldcard which continues to be discussed therefore many people are hesitant to choose About Self-Custody.
Trust me they will go back to the hardware again, continue the matter they want to keep on the exchange or transferred to ETF it becomes their decision, you don't worry too much because I myself still believe in hardware rather than third parties.

[Ishicryptic]

This is only temporary in my view, because the current situation is still hot about the issue of Coldcard which continues to be discussed therefore many people are hesitant to choose About Self-Custody.
Trust me they will go back to the hardware again, continue the matter they want to keep on the exchange or transferred to ETF it becomes their decision, you don't worry too much because I myself still believe in hardware rather than third parties.

I also believe that what is happening now is temporary and after sometime when the panic of what what happened to Coldcard, had died down many Bitcoin holders would reconsider their stance about totally abandoning hardware wallets, many might abandon using Coldcard for a very long time but it won't affect other hardware wallet brands. Although we cannot blame anybody that is in a haste to abandon hardware wallets entirely because before now it's seemed as if hardware wallets were the peak of self custody then this happened to show that they can be vulnerable just like third party custodians. If you compare self custody and third party custody you will agree that despite what has happened with Coldcard that self custody remains the better choice for a decentralized cryptocurrency like Bitcoin. 'Not your keys not your coins' is still relevant despite any self custody setbacks.

[Floxynice]

It is not an act of wisdom to move from self custody to CEX. Alot of bad experiences have been heard about CEX, yet people still use them even when they are not safe. The Coldcard experience is bad and is capable of making one question his decision about self custody, but trust me that CEX is in no way better.

The impact from the Coldcard compromise will only last for a short while. What we should know is that, from this experience, wallet manufacturers have taken note of the error that gave room to the unfortunate compromise, security measures will definitely be put into consideration to prevent reoccurrence of a similar situation. However, for CEX, trusting them with your bitcoins is the worse decision anyone can make.

[MadSl1m]

Worth reading the vendor advisory before anyone in this thread decides anything about custody models, because one line in it is the actionable part: updating the firmware does not repair an existing seed.
https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

The failure is in seed generation, not in anyone getting access to a device. Mk2 and Mk3 firmware 4.0.1 through 4.1.9 are affected, and seeds made on Mk4, Mk5 and Q before the fixed releases carry roughly 72 bits of entropy where 128 was expected. Coinkite's exception is narrow: at least 50 fair, independent, private dice rolls at seed creation, and they don't consider that seed at risk from this issue alone. A strong unique BIP-39 passphrase lowers the exposure but leaves the seed as it is.

Which is also the answer to the OP. The guarantee that broke was device-level, not custody-level. Moving the same seed to an exchange fixes none of that. It just puts a counterparty on top of it.

[Curious T]

It will be very short-lived. People are moved by current events all the time. The same way they moved during the Bybit hack, and after a while they continued using CEX. This time around, people who still want to hold their coins would hold. It won't take long before another CEX is hacked again, and what would be raining then would be "hold your coins by yourself". People just echo what is reigning at the time, and when it's no longer popular, they stop. We've seen it with so many trends. This one would not be different. Some people are using the opportunity to advertise their service, which is fine, but it will die down soon enough.

[Oasisman]

Wise people would not jump into another stuff that bears more risks just because a more secure one has been compromised. The best course of action to take is to take extra precautionary measures and be more educated in updating the firmware, setup backup, and be updated with security advisories.  

My question is, will the impact be short-lived or a long-lasting one? What would it take for people to trust doing self-custody of their BTC again (via HWs)?

Well, it would only take another attack/hack on  custodial wallets, CEX, or even Bitcoin ETFs, for people to realize that everything is vulnerable to hacking and that the most important thing is having full control over your asset. This will not last long when people start realizing again about the weight of the phrase "not your keys, not your bitcoin".

[Ceemv22]

The failure is in seed generation, not in anyone getting access to a device.

this is the correct framing and worth repeating since half the thread is debating custody models when the actual lesson is about entropy...

one thing worth adding from the monitoring side (im talking about blockchain monitoring here): this is also a live case study in how visible stolen funds actually are on chain. researchers (Galaxy Research and others) have been tracking the swept btc move through consolidation addresses and into mixers in near real time since the first wave. the attacker still holds most of it unmoved, likely waiting out attention before cashing out, which is itself informative, it shows even with a huge haul, liquidating stolen btc without getting flagged by exchange risk systems is nontrivial  

so the entropy failure was the root cause but the response is a decent example of the monitoring side of the ecosystem actually doing its job after the fact even tho it obviously cant undo the theft

[MadSl1m]

worth splitting that in two. galaxy has this cluster at 1,158.81 BTC from 2,673 addresses, sitting unspent across seven attacker addresses. the mixing that's been reported is a different cluster. nothing is both unmoved and mixed. 

flagged isn't frozen either. those coins can move any time he wants. the wall is at cash out.

and on entropy: a weak seed looked exactly like a good one, nothing to test for. which is why 2-of-3 from three coldcards of the same era isn't three failures, it's one failure three times.

[hd49728]

Now that the Coldcard incident has caused millions in BTC losses, I am beginning to wonder how would this affect the self-custodial industry? I mean, will the impact be such that people will avoid hardware wallets forever? After what happened with Coldcard, many decided it was safer to move to a CEX instead. Others went ahead and bought Bitcoin ETFs. This is bad because it gives centralized entities more leverage over Bitcoin.

My question is, will the impact be short-lived or a long-lasting one? What would it take for people to trust doing self-custody of their BTC again (via HWs)?

It's only short-lived effect, not long-lasting one because even many exchanges were hacked, scammed, closed, most people still use centralized exchanges and consider exchanges as where they can let their funds there a long time. They possibly don't consider exchanges as their storage places for long term but by letting their funds there a long time, even for trading purposes, it's already a risky practice of storage. It's storage a long time for trading, and even they don't do that for investment and holding storage, it's still risky.

People who understand importance of "self custodial" will move their funds back to their self custodial wallets when dusts settle.

[jcojci]

Not forever or leave self-custody but they will be more carefully selecting the hardware wallets. They will research deeper before choosing the wallets so they will be sure that is the best wallets for them.

If they return to centralized exchanges, they will let other party hodl their Bitcoin which is not good. No one knows the exchanges can run how long and nothing bad happening. The effect can be short-lived or a long-lasting one, depends on awareness about the important of the research they will do finding the wallet.

But I guess this will only temporary and people will select the hardware wallet that can help them to hodl Bitcoin.

[abel1337]

Now that the Coldcard incident has caused millions in BTC losses, I am beginning to wonder how would this affect the self-custodial industry? I mean, will the impact be such that people will avoid hardware wallets forever? After what happened with Coldcard, many decided it was safer to move to a CEX instead. Others went ahead and bought Bitcoin ETFs. This is bad because it gives centralized entities more leverage over Bitcoin.

My question is, will the impact be short-lived or a long-lasting one? What would it take for people to trust doing self-custody of their BTC again (via HWs)?

Your input would be greatly appreciated. Thank you.

In the short term, people would be sceptical on using hardware wallets since it's not 'bullet proof" as we think it is. Hardware wallet companies will recheck and reaudit their codes, minimizing the impact and not fall the same path as coinkite.

Hardware wallet still provides better security than CEX on reality, it still has a lesser holes that hacker can penetrate.

On the longer term, influencers or the community will double check hardware wallet that they are recommending, hardware companies would make themselves stand out by showing proofs of their audits and do bounty campaigns that will help them identify the potential holes that they have.

I'm expecting a more positive future because of this incident. Being sceptical isn't that bad if we talk about the security that hold our bitcoins.

[bitbollo]

In a certain way this can be called the "elephant" in the room... since everyone must be aware on how to use private keys/seeds for a certain grade of security. 
As we know there are some cases where we are taking the risks but no one can trust third party keys with substantial amount of funds.
With or without this incident has not changed anything on the protocol by itself. bitcon continue to work pretty fine.
It could be appears something new about the use of AI on exploitation of certain kind of sw/hw.
The industry of HW would continue fine, there is always a market for this. there are many ways to use bitcoin...

[Muba20]

The fact should be reviewed carefully. The quality of products of all companies in the market is not the same. There may be errors in the process of generating a seed in a hardware wallet. There is no logic to whether it will happen to all devices. However, it will be difficult for a ordinary user to understand which device has such errors, which is why I think that such an incident of hacking will definitely create a kind of panic among everyone. Users may take out the Bitcoins in the store and put them in different wallets, but such an incident can definitely have a negative impact on Bitcoin users, even for a short time.

Many of the investors who think about Bitcoin in the long term may change their wallets to some exchanges and some to software wallets especially who are low volume holders and some may even change the brand of hardware wallets. I think that this is why there is no opportunity to think that trust in Bitcoin will decrease in the long term. We often learn about various incidents of hacking, but they are few incidents and everything does not change around that incident. While this is a major cause of concern for Bitcoin users for the time being, the situation will gradually return to normal.

Moreover, various companies will now carefully review all the security concern and try to find the weaknesses of that wallet and will try to make the wallet more secure.

[tbct_mt2]

But in CEX your risk will be on exchange failure, hack, withdrawal freeze, insolvency, account seizure or counterparty risk. If we talk about ETF, you do not control your private key of Bitcoin here. So I don't see any logic in centralizing entire custody model as a response to a vendor failure at Coldcard.

People can think ETFs are safer than exchanges because regulations on ETFs are stricter than centralized exchanges but risk still exists. Most Bitcoin Spot ETFs don't store and secure bitcoins by themselves as they likely are fearful that they can do security mistakes and lose bitcoins. Then, they decided to use custodial services with a most favorite one chosen is Coinbase.

If Coinbase has something wrong in security and their treasury exploited, it will cause severe troubles for many Bitcoin Spot ETFs, then exchanges and consequently many cryptocurrency users.

Bitcoin ETF trackers and custodians.
https://blockworks.com/analytics/bitcoin-etf/tracker

[Lucius]

Now that the Coldcard incident has caused millions in BTC losses, I am beginning to wonder how would this affect the self-custodial industry?
~snip~

Buying hardware wallets is not self-custody as some people think, it is much more than buying and generating seeds. Anyone who because of this, starts to believe that it is better to store their coins on CEXs or something similar is one of those who still hasn't understood what it means to be your own bank.

If you want security then choose an air-gapped setup, add a strong enough passphrase or make multi-sig setup and don't just depend on the entropy you get through the seed. Of course, in most cases this is enough, but if the manufacturer messes things up (as in the case of coldcard), then it happens that people get hacked.