One bad egg doesn't equals the the rest

[Natalim]

If you focus on the Coldcard hardware wallet incident alone, you are being biased. There are past negative events that involved those trusted centralized exchanges that have lost thousands of bitcoin because of hacking and scamming. But people still trust them, because they opt to believe that it won't be happening too into other reputable centralized exchanges.

But with what happened to Coldcard, the rest of hardware wallets reputation are being compromised. For me, it's actually unfair. Because the truth is, centralized exchanges are more prone to lose our bitcoin because the custody is already theirs. But if we ignore them and focus on our hardware wallet and maximize our custody, then maybe we can minimize this losing or stealing bitcoin incidents.

[Odusko]

Is up to you to work out an extra technical layer of security that protects your assets stored on your hardware wallet or even on Centralised platforms. What we must also know is that security breaches can come from wherever it finds the leakage to exploit, so we must not emphasise so much on just a few waves of security failures in the system. I can never take what happened with the coldcard hard wallet company and another one of such to mean that the entire self-custody network has failed and to consider a centralised exchange as a better storage option.

[BABY SHOES]

I don't think there is a malicious agenda behind it, but the reaction of many people to the ColdCard incident is natural many people start to be wary of the use of hardware, especially since there have been news of some leaked data such as Ledger, Trezor, Safepal, BitBox even though this is only username and email data and phone number only while for the hardware itself is not affected except ColdCard.

Okay... you said that in favor of centralized entities such as exchanges and banks, how did those two entities collapse? You already know there are a lot of collapsed exchanges including banks as well, so in this world No one is completely safe.

Sure, not everyone has malicious intent, but I still believe in non-custodial wallets and reputable hardware, so as long as you keep your keys safe, you won't be affected.

[X-ray]

Coldcard incident really hit the reputation of hardware wallet, it's to be expected. Life savings gone not because your mistake, but coldcard entropy bug mistake. Even though the problem is only isolated on Coldcard, average people still scared anyway.

That's to be expected but don't stop explaining to these people, otherwise they'd consider hardware wallet as simply not secure anymore even though every hardware wallet if manufactured by different company is different.

I do believe that if someone is paranoid, they might be better off with custodial wallet, some people aren't built for self custody and it shows. In that case, they might as well buy the ETF. The ETF exist for these people and institutional. Exchange is riskier than self custody arguably so that is out of the question.

[OcTradism]

I do believe that if someone is paranoid, they might be better off with custodial wallet, some people aren't built for self custody and it shows. In that case, they might as well buy the ETF. The ETF exist for these people and institutional. Exchange is riskier than self custody arguably so that is out of the question.

It's right to don't use custodial wallets like the Reminder: do not keep your money in online accounts but it's not enough.

People who are victims of Coldcard incident lost their bitcoins even they chose and bought a hardware wallet to use. They just chose a bad hardware wallet to buy and use while the wallet manufacturer actually ignored several security warnings from community about their weak wallet seed entropy with only 40 bits rather than 128 bits or 256 bits.

[LIST] Open Source Hardware Wallets.
[GUIDE] How to buy a Hardware Wallet the right way.
The rise of the machines.

The detail that should focus every security team in this industry: the source code was viewable the entire time. Human reviewers looked at it for years. They confirmed the hardware RNG existed. Nobody checked whether the seed generator actually called it correctly. Researchers now believe the vulnerability was most likely found by a frontier AI model - someone pointed the best available model at the public source, and it surfaced what human eyes had missed.

Whether or not that attribution is ever confirmed, it doesn't matter. It is plausible today, and it will be normal tomorrow. The threat environment has changed, and we'd like to talk plainly about what Casa is doing.

In fact, Coldcard founder and team received reports and complaints from community about that, and human detected that security issue but the manufacturer ignored the risk.

[Darker45]

Well, unfortunately, there isn't just one bad egg so far. So, rather than defensively jumping into the conclusion that the one spoiled egg found is an isolated case and the rest are good, perhaps it's better to treat it like a sort of a wake-up call to take a closer and more careful look, even inspection, at the rest of the eggs. Surely, there are those that may look good from without but would produce a sloshing sound when shaken.

But all this doesn't mean to say it's better to surrender the ownership and control of your coins to centralized services. I guess that's obviously worse.

I don't see any evil agenda.

[sheenshane]

Is there any evil agenda behind this or it's just normal human reaction?

I think it's a normal reaction for non-tech users, not an evil agenda.
They're often afraid because they don't know how to keep their coins safe, so they put their trust in a centralized wallet because they think it's safe since customer support is always there to ask.

It's sometimes happened with some hardware wallets that have been breached, not only with ColdCard.
If you have this wallet, you should always keep it updated at all times.  As long as we have our keys, consider your coins safe, you can immediately transfer it into another safe non-custodial wallet ASAP.

[yhiaali3]

I wouldn't rule out the possibility that governments or some malicious actor played a role in the hardware wallet incidents or even other crypto-related incidents to instill a sense of insecurity among cryptocurrency users.

This is a plausible possibility, though not certain; furthermore, users concerned about their assets cannot be blamed if they lose confidence in hardware wallets and turn to centralized platforms to store their holdings. Because keeping assets safe is the number one priority.

But unfortunately, They do not realize that storing their assets on centralized platforms is the worst option.

[Delaforetnoire]

It's what made me think this way, my friends are already complaining that hardware wallets aren't safe anymore, one fell and others are already looking like spoilt eggs.

First of all, you have to understand that wallets will never be able to give one 100% guarantee. I think choosing wallets that are well-known and providing good service for many days is the safest.

You have to think keeping your eyes and ears open in the crypto world because you have to see which wallet is doing better than which wallet and you have to find out which wallets are providing better service compared to hardware wallets.

[pooya87]

Instead of falling off the other side of the roof, we should see these events as a good thing.

You see, people should stop seeing everything in black and white because that's not how things work.
It is never "hardware wallets are either 100% secure or 100% insecure". Instead people should learn that everything they use has both strengths and weaknesses. If they believe in an exaggerated strengths of something and ignore its weaknesses, or conversely if they believe in an exaggerated weaknesses of something and ignore its strengths then they are misled.

Hardware wallets have their strengths but people should also be aware of their weaknesses as well. Ignoring the weaknesses can be a fatal flaw that leads to losses we witnessed with ColdCard.
So your title is wrong. It is not juts a "bad egg" it is all of them. But that doesn't make them "bad", this event should make people's view of hardware wallets more realistic.

[m2017]

If everyone is scared of hardware wallet as their safety option and self custody option who wins? Who benefits the most from this? I guess the centralised entities and the banks.

Well, I wouldn't say this scares everyone, since people continue to use hardware wallets (except for Coldcard owners).

The winners here are hackers and other malicious actors who can run malware on your PCs \ laptops to steal your cryptocurrency.

Do you think this panic in the hardware wallet market was orchestrated by centralized organizations and banks? One might suspect cryptocurrency exchanges or custodial services, but banks? Cryptocurrency holders aren't the bank's target audience; they would never hand over their assets to them, as they are typically people who have become disillusioned with the traditional financial system and recognized the profit potential offered by cryptocurrency.

What if this is it? What if the goals of these people is to strike fear in the mind of holders that giving up their Bitcoin to custodial entities is the only way forward?

And is that why hacker attacks are orchestrated against the providers of these services? After all, centralized services get hacked just the same, take the recent incident with Revolut, for example. How does news like that improve the perception of the service as a secure place to store assets? Even if user funds weren't actually stolen in that specific case, the personal data leak still put users at risk.

Custodial services don't guarantee 100% security for asset storage either, as they can be hacked (just google how many exchanges have been compromised over the years) and can go bankrupt or collapse (like FTX,Terra\ Luna).

I know what many people will say, that I am just scared because one hardware wallet got ruined, ColdCard as the main example, but before you said this few people surrounding myself have already started to show this sign.

People in one's personal circle represent a very small sample for drawing conclusions.

It's what made me think this way, my friends are already complaining that hardware wallets aren't safe anymore, one fell and others are already looking like spoilt eggs.

Well, if you were dropped, you’d break just the same. That’s not a valid argument. Any electronic device can fail if dropped (or subjected to physical damage). That doesn't mean this device itself is unreliable. The primary function of hardware wallets is the secure storage of assets.

By any chance, do your friends own Ledger? If so, there’s no point in continuing the discussion about their quality.

Besides, you’ve shifted the conversation from the reliability of HW devices as asset storage to the realm of physical durability and impact resistance. Those are two completely different topics.

Is there any evil agenda behind this or it's just normal human reaction?

To see malicious intent in this is to admit to paranoia. The world is a very complex place where a multitude of unrelated events occur, events that may share common consequences, yet this doesn't mean some "universal evil" is orchestrating these processes solely to force you to hand over your assets to their management.

[Outhue]

People talks alot without thinking, if what happened to ColdCard never happened the vulnerability will be there still, and the longer it takes the more uglier it will be because more people will keep buying ColdCard, a damage that could be affect 1000 people could turn into 100,000 people, to me it's not completely a bad thing that we have AI today, many more vulnerability in every crypto wallets and platforms are been exposed and that's the good thing about it, immediately solution and fixes will show up as well, and developers and crypto companies will also be able to come up with solutions using same AI too.

[Peanutswar]

It is normal to get feared with the situation happen with the cold card but does not mean that most of the wallet will happen like this but we cannot remove the chance there is might likely happen but of course they dont let this because it could ruin their reputation. Now one of the best things here is to diversify your asset so if ever the other wallet gets compromised still its just portion of your hodlings and not most of your asset. With the power of knowledge and skills right now one vulnerability could penetrate not only in system but most of the errors came from human mistakes.

[Dunamisx]

No one wish to learn in the hard way, but sometimes you think yourself in the shape of taking risk even when you are less expected of it, the most annoying part is that you trusted on those you think they will not disappoint you and later find out that they are taking a little chances they have as an advantage against you, this could tell more about knowing the fact that cold card are done, no one could recommend them or to anyone for use.

[Fiatless]

Well, unfortunately, there isn't just one bad egg so far. So, rather than defensively jumping into the conclusion that the one spoiled egg found is an isolated case and the rest are good, perhaps it's better to treat it like a sort of a wake-up call to take a closer and more careful look, even inspection, at the rest of the eggs. Surely, there are those that may look good from without but would produce a sloshing sound when shaken.

But all this doesn't mean to say it's better to surrender the ownership and control of your coins to centralized services. I guess that's obviously worse.

I don't see any evil agenda.

There has been a series of promotional campaigns portraying custodian services as the best option. Some of these claims push the narrative that since these centralized firms are insured, customers have nothing to worry about, even if there are hacks or other security breaches. The cases of MtGox, Binance, and others are used as examples.

Hardware wallets might have their weaknesses, but their benefits are more. Those who have never lost money in exchanges because of government policies or flimsy excuses will not know the benefits of self-custody.

The advancement in AI technology will increase the rate of attacks on different Bitcoin hardware wallets. Following up on reviews on different reputable platforms would help us choose good hardware wallets.

[Floxynice]

The Coldcard experience is not enough for anyone to paint these narrative that that self custody is not safe. I am not not even buying that "one bad egg crap". Over the years, exchanges, hot wallets and the rest have experienced attacks, restrictions, disappointments worse than the recent Coldcard case. Are we going to dump self custody for custodian services which carries the greater risks? This sudden switch is laughable. It makes absolutely no sense tuning back to thesame thing we condemn just because of one error that can be fixed. Truly, nothing beats self custody.

[Royal Cap]

I don't think that people's fear of losing hardware wallets is actually a conspiracy by a bank, but rather a lack of proper understanding of self-custody. Many people don't understand that the physical device is just like a key, the real control lies with the backup seed phrase. For example, if your ATM card is broken or lost, the money in your account does not disappear, just like if your ColdCard or any other device is broken, you can easily recover funds anywhere with those words. Still, yes, the ColdCard incident has really spoiled the general public's impression of hardware wallets. But I would say that handing over control of your funds to a centralized exchange for fear of losing your device is actually a natural reaction to not understanding the technology deeply.

[Tonimez]

Just because a brand experiences issues doesn't mean self-custody is bad. That's important to understand because self-custody is the best way to secure your Bitcoin, and there's no compromise on that. It's just that people need to be more selective in choosing their wallets, as not all of them can really secure your assets. Sticking with open source is a good option, although it doesn't necessarily mean it's more secure, but at least public can verify the source code of the wallet.

It's bad that the coldcard event has now reviewed so many unsuspected insecurities in using self custody and this is because, if this incident had delayed further, more victims could have been trapped. Things like this create more fear that's difficult to erase in the minds of the users because there's no insurance and once your coins are gone, you will have yourself to blame.

We understand how important self custody is but going by the assurance received from some few established exchanges, it seems easier to see a very trusted exchange than it is for beginners to identify a secure non custodia wallets and/or hardware wallets. More hacks are still possible to happen in the future due to rise in technology so one must be very careful in their choices, if your mind doesn't accept self custody, you can continue with an exchange as long as you have nothing fishy in your transactions.

[davis196]

If everyone is scared of hardware wallet as their safety option and self custody option who wins? Who benefits the most from this? I guess the centralised entities and the banks.

What if this is it? What if the goals of these people is to strike fear in the mind of holders that giving up their Bitcoin to custodial entities is the only way forward?

I know what many people will say, that I am just scared because one hardware wallet got ruined, ColdCard as the main example, but before you said this few people surrounding myself have already started to show this sign.

It's what made me think this way, my friends are already complaining that hardware wallets aren't safe anymore, one fell and others are already looking like spoilt eggs.

Is there any evil agenda behind this or it's just normal human reaction?

Being scared by something frightening is a normal human reaction, but I don't think that there's an evil agenda by the centralized entities to scare people away from cold wallets. If that was the case there would have been constant attacks and hack attempts against the big crypto cold wallets throughout the last 10 years. The reality is a bit different. The big banks don't pay that much attention to the cold wallets.
ColdCard wasn't even that popular cold wallet and it's obvious that it's security wasn't at the best possible level.

[coinrifft]

I don't think that people's fear of losing hardware wallets is actually a conspiracy by a bank, but rather a lack of proper understanding of self-custody. Many people don't understand that the physical device is just like a key, the real control lies with the backup seed phrase. For example, if your ATM card is broken or lost, the money in your account does not disappear, just like if your ColdCard or any other device is broken, you can easily recover funds anywhere with those words. Still, yes, the ColdCard incident has really spoiled the general public's impression of hardware wallets. But I would say that handing over control of your funds to a centralized exchange for fear of losing your device is actually a natural reaction to not understanding the technology deeply.

He was referring to Coldcard incident, so it make sense that others might be fearful of using hardware wallets for now or using self-custody. But you are correct, if we only know how to practice security and understand not to get phished or something, then we might still be ok with hardware wallets.

Probably the Coldcard incident might just be an isolated case. But it open up a lot of possibilities specially on how this hardware wallet produces their machine so that we can still be protected by that kind of attacks.