What kind of wallet should you trust?

[|MINER|]

Recently, we saw a huge amount of Bitcoins being stolen by hackers due to a vulnerability in the firmware of the coldcard wallet. Until now, we all knew that coldcard was a reputable and secure hardware wallet provider, but after this incident, that perception has completely changed, and at the same time, the question has arisen in our minds that similar incidents will not happen to other hardware wallet providers in the future.

And from this point of view, a question has arisen in my mind: would it be better for us to rely on a recognized popular close-source hot wallet or should we trust an open source hardware wallet?
If I clear it, which hot wallet should I trust, which is reputable but closed source, and which is less reputable but open source hardware?

[Upgrade00]

Admittedly, the coldcard case impacts the cold storage argument. Users did nothing wrong on their part and got f**led over by a vulnerability which should only happen when you're using a custodian service, but this does not change the fact that non custodian, airgapped cold storage is still the best option for long term hodling.  You should add extra security now through:

• extended passphrases,
• multi signature wallets,
• splitting your holdings (if it's large enough) among multiple addresses and wallets sometimes too.

And from this point of view, a question has arisen in my mind: would it be better for us to rely on a recognized popular close-source hot wallet or should we trust an open source hardware wallet?

NO.
A hot wallet should only be used for an address you regularly move in and out of, like one you use to fund a gambling account but not for long term storage. Being closed source makes it worse for your security.
I think you ask this cause a closed source code cannot be scanned for vulnerabilities which may give an illusion of failure, but this means you cannot also check what's going on behind the scenes of the service holding your savings. Open source allows the community verify, check for vulnerabilities and also any backdoor that could have been added.

To answer your topic title, you never trust; always verify.

[Zaguru12]

Until now, we all knew that coldcard was a reputable and secure hardware wallet provider, but after this incident, that perception has completely changed, and at the same time, the question has arisen in our minds that similar incidents will not happen to other hardware wallet providers in the future.

The warning about coldcard losing its reputation didn’t start as at when the incidence happened recently. I have read particular in this forum of members warning against this particular wallet and since NVK switched from open source to a non open source license. One user who I read most of his post about an awaiting danger was dkbit98.

So it’s not about been long in the market and blindly trusting it’s about verifying.

You can see the current warnings around ledger wallet because of their recovery policy but people will ignore until a Cristi hit them

And from this point of view, a question has arisen in my mind: would it be better for us to rely on a recognized popular close-source hot wallet or should we trust an open source hardware wallet?
If I clear it, which hot wallet should I trust, which is reputable but closed source, and which is less reputable but open source hardware?

If you’re still considering wallets based on popularity and also having closed in that regard I think you definitely haven’t followed the saga around this coldcard vulnerabilities, the two things you wish to trust is what made people trust nvk and coldcard.

As for open source wallet you’re not trusting them rather you’re given an opportunity to verify and then choose if the wallet is best suited for you and this isn’t offered in closed sourced

For hot wallets whether open source or closed source it’s a no for me for big amount storage . But I will stick to electrum in a form of cold wallet because I can verify and also other open source wallets

Check this threads
  https://bitcointalk.org/index.php?topic=5482076.0
https://bitcointalk.org/index.php?topic=5422456.0

[Charles-Tim]

And from this point of view, a question has arisen in my mind: would it be better for us to rely on a recognized popular close-source hot wallet or should we trust an open source hardware wallet?

Use passphrase or a multisig wallet to avoid your wallet to be compromised with such vulnerability. Use open source wallets that are reputed on a forum like this forum.

One of the worst wallets are close source wallets. Just avoid them.

Coldcard is not open source.

[Hatchy]

And from this point of view, a question has arisen in my mind: would it be better for us to rely on a recognized popular close-source hot wallet or should we trust an open source hardware wallet?
If I clear it, which hot wallet should I trust, which is reputable but closed source, and which is less reputable but open source hardware?

Closed source, is already a red flag. Hot wallet is risky but using a wallet that's both closed source and a hot wallet, you are increasing the chances of losing your funds if not careful.we already knew that the cold card case would create a lot of fear for many investors because of how it happened. It gives this view that no wallet is actually safe from attack. Though if you use a good wallet, or an air gapped device you already save yourself a lot of trouble. For me, electrum is exceptional. I don't think I've seen anyone that serves it's purpose better than electrum both as a hard or soft wallets or even air gapped. I will always recommend it for anyone who is really confused about which wallet to use for storing their coins.

[notocactus]

You should add extra security now through:

• extended passphrases,
• multi signature wallets,
• splitting your holdings (if it's large enough) among multiple addresses and wallets sometimes too.

The first step is most important: Choosing a good wallet to use.

If people choose a bad wallet with terrible seed generation, adding passphrase can not help too much. Like with Coldcard wallet, there were reported cases that with 2-word passphrase, wallets were still hacked.

Extended passphrases must be strong but setting it up and using it contains risk too. If you did not carefully set it up, test it, back it up, test backup before funding a wallet with passphrase, you will lose your fund later when you can not recover that wallet.

Multisig wallets can be helpful but it costs more in transaction size, then transaction fee.

Split the fund needs to be with wallets as nowadays people mostly use HD wallets with wallet seed phrase, so if a wallet is hacked, hackers will get access to all private keys, all addresses in that wallet. Splitting fund into different wallets, not only addresses, is my recommendation.

[rdluffy]

Coldcard hack could very well be a game changer moment for crypto.
I used to think my crypto was safe, but after everything that’s happened, I’ve started to feel a little unconfortable
I think many of us will be reevaluating our self custody strategies

So far, what I consider important is:

-> Generating your seed phrases offline
-> A passphrase helps A LOT
-> Multisig would be very secure, but you need to know how to use it and have patience

And one thing I consider probably the most important, and which I’ve always followed is
->  to diversify your portfolio, never keep everything in one place. That way, if something bad happens, you’ll lose a percentage of your holdings, not everything

I have here: Trezor Safe 3, ledger nano s and a Safepal x1

[pooya87]

And from this point of view, a question has arisen in my mind: would it be better for us to rely on a recognized popular close-source hot wallet or should we trust an open source hardware wallet?

There simply is no justification for using anything closed source when good open source alternatives exist. Specially not a hot wallet, it just makes no sense to use it to store your precious bitcoins!

It is also important to know that your options are not these two only (closed source hot wallet versus open source hardware wallet). You have a lot more such as a normal open source wallet that has been around for over a decade and is trusted. Like bitcoin core! You can use that offline to generate keys too without needing to run it as a full node (with internet access).
There are other options like Electrum as well if you want a mnemonic based wallet that you can physically backup (write down on paper).

[notocactus]

Like bitcoin core! You can use that offline to generate keys too without needing to run it as a full node (with internet access).

Bitcoin Core is an old and high quality wallet software for people who want to have privacy with Bitcoin full node and most secure Bitcoin wallet software.

• [Guide] The simplest Full Node guide ever.
• [Guide] How to run a Bitcoin Core full node for under 50 bucks!

There are other options like Electrum as well if you want a mnemonic based wallet that you can physically backup (write down on paper).

Electrum is a SPV wallet but people can achieve some privacy by using Electrum wallet with Tor.

• [Guide] Electrum wallet and Tor proxy.

[Findingnemo]

Never trust any wallet, simply don't run them online ever that is the best security for your Bitcoin. Of course, ofcourse it comes with inconvenience you need to broadcast the transaction from another device after signing the TX, get used to it.

For day-to-day use, Electrum is best option, I never had any issues with it, and even using it on my Android for like 5 years now with no issues.

[dkbit98]

I can tell you what not to trust, and I was preaching this for years, only a few listen to me.
Don't use any closed source wallets, or anyone who is telling you how their product is best in the universe.
Also don't use any wallet with egoistic maniacs in charge, and f yopu purchase hardware wallets try to buy them in local shop or bitcoin conference.

[Yamane_Keto]

If I clear it, which hot wallet should I trust, which is reputable but closed source, and which is less reputable but open source hardware?

Closed-source wallets disclaim responsibility for errors or other flaws in the software and will not compensate you if the vulnerability is their fault. This is the disclaimer from Trust wallet, and there are similar statements in other closed-source wallets.

You acknowledge and accept that Trust Wallet cannot control, nor is obligated to act regarding: (i) potential failures, disruptions, mistakes, or delays in the processing of Digital Assets during your usage of the Services; (ii) chances of hardware, software, and internet connectivity failures; (iii) the risk of malicious software being introduced or discovered in software underpinning Trust Wallet; (iv) the possibility of unauthorized third-party access to your wallet information, including, but not limited to, your wallet address, private key, and Secret Phrase; and (v) the risk of unknown vulnerabilities or unforeseen changes in the relevant blockchain networks.
You agree to hold us harmless and release us from all liability relating to any losses, damages, or claims resulting from: (a) user errors such as forgotten passwords, misconstructed transactions, or mistyped Digital Asset addresses; (b) server failure or data loss; (c) unauthorized access to the Trust Wallet application; (d) bugs or other faults in the Trust Wallet software; and (e) unsanctioned third-party activities, including, but not limited to the employ of viruses, phishing, brute forcing, or other potential attack vectors against Trust Wallet.

Centralized accounts may compensate for your losses in certain cases, and therefore they are better than these closed-source wallets. It is better to use a reliable open-source wallet.