One bad egg doesn't equals the the rest

[Ever-young]

Your question is a very valid one because most times when issues do arise like this custodial service like the banks and the centralized exchange suddenly becomes the winners. And sometimes it’s even planned to happen that way for some reasons (not that they sponsor the hack, but push the narrative which spread fear)
What I see here is fear pushing us to the centralized entities in which, bitcoin was actually made to bypass.

Personally I’ll say that to remedy a bad egg doesn’t call for ending up with a custodian. Fueling security can do better, to foster sovereignty and the safety of your funds.

Talking about the centralized, we should always be very careful when dealing with it. We can aswell care more in decentralization,
The fiat users go through crises most times but has never given up on them and settled for storing physical cash.
Maybe we’re just making the fear more intense than it actually is.

[pawanjain]

One rotten tomato can spoil the whole batch of tomatoes unless separated from the batch.
Hardware wallets are not the same though. Every hardware wallet already operates independently of other hardware wallets.
So just because one hardware wallet with a weak security got compromised, doesn't mean others will face the same fate.
But then again, we must remember that there's always a room to errors and so nothing is safe. We have to stay vigilant.

[OsaiEmma]

I know what many people will say, that I am just scared because one hardware wallet got ruined, ColdCard as the main example, but before you said this few people surrounding myself have already started to show this sign.

You're scared, and it's ok, that's a natural response to things like this. The question is, what will you do with that fear. Will you just conclude that this is an isolated issue and continue being lax in your financial security? You need to have a better opsec while using these wallets by including an extra layer of security.

It's what made me think this way, my friends are already complaining that hardware wallets aren't safe anymore, one fell and others are already looking like spoilt eggs.

Is there any evil agenda behind this or it's just normal human reaction?

Well, that's why they have a friend like you to ground them in reality and explain to them what really went down, and how the other option is not better either if they continue the same mistake of having a lax opsec and too much trust in the software promising you a "secured" wallet.

The detail that should focus every security team in this industry: the source code was viewable the entire time. Human reviewers looked at it for years. They confirmed the hardware RNG existed. Nobody checked whether the seed generator actually called it correctly. Researchers now believe the vulnerability was most likely found by a frontier AI model - someone pointed the best available model at the public source, and it surfaced what human eyes had missed.

Whether or not that attribution is ever confirmed, it doesn't matter. It is plausible today, and it will be normal tomorrow. The threat environment has changed, and we'd like to talk plainly about what Casa is doing.

In fact, Coldcard founder and team received reports and complaints from community about that, and human detected that security issue but the manufacturer ignored the risk.

Actually, that is not exactly what happened. On June 17th, an audit on coldcard RNG was published in GitHub, and they didn't include any high risk vulnerabilities in the RNG audit—they found 1 medium and several low risk bugs.

Coldcard Firmware Security Audit — 2026-06-17
Scope: memory crashes / OOB, weak RNG, nonce reuse, Bitcoin signing logic (oversized-fee, change/fee handling), integer/number overflows, and anything else that could cause loss of funds or device compromise.

Method: read-only review. Python layer (PSBT/signing/serialization, RNG, NFC, QR) plus a deep multi-agent pass over the C code (bootloader/USB dispatch, secure-element I2C, NFC/NDEF, QR/BBQr decode, crypto wrappers, flash/firmware-update). Every C finding was put through an independent adversarial verifier prompted to refute it; only what survived, plus manual re-tracing of the headline bug, is reported here.

Bottom line: This is a mature, well-defended codebase. None of the headline issues flagged by the initial automated sweep survived verification — the signing path, RNG, and fee logic are sound. The audit found one genuine memory-safety bug (a stack overflow in the secure-element response parser, gated behind physical bus access) and a handful of defense-in-depth hardening gaps in the bootloader / firmware-update path. No issue was found that lets a remote or USB/NFC/QR/SD attacker steal funds or crash the device into a fund-loss state.

source

So...even though it was audited, they couldn't find any high risk bug that would lead to the loss of users coins.

Personally, I feel open-source is a double-edged sword. Same way the public can review this code and source for bugs to be resolved, that's exactly the same way malicious actors can source for bugs to exploit. I know it is often advisable to use open source wallets for transparency and trust, but this also has its own down sides when it comes to security, especially if the wallet's security team is doing a poor job and not actively tackling potential security vulnerability.

Although, this coldcard case is good in the sense that:
- It created that awareness of taking extra steps towards securing our wallets, and not trust blindly because it's an open source cold wallet.
- It brought forth the awareness of the bug in the wallet, and others can learn from it.
- It has made different companies take proactive measures and deploy the use of AI to strengthen security—which is a good thing.

But, the cost of all these lessons is the loss of the numerous wallets being hacked—which is indeed sad.

Most average people don't want self-custody, which is why most Bitcoin investors use a centralized mechanism like CoinBase or Robinhood.

A well-known and insured exchange is by far the safest way to keep your Bitcoin. These large companies are extremely secure, and they are insured if they get hacked, so you will never lose money no matter what.

Hmm, I would not say they are all extremely secure. We never know until they get hacked. Because they are considered extremely secure because by now, hackers can't find their way in, but one day they can. At least, they can get your information by breaching some servers and people in support teams directly through phishing emails. So you can't say all of these exchanges are extremely secure.

Instead, I would never say this to someone without giving them a disclaimer about how they can lose your money, like the FTX exchange. They did give the funds back, but at what cost? People got the USD value of the coins they held, and the conversion was based on the price at the time when it went down. So everyone made a huge loss. Many other exchanges cost people huge amounts of money. BitMart went down and then stopped withdrawals, so people were unable to withdraw their money.

Yes, you said big exchanges, but still, they are not as secure as you think.

You're definitely right, but there is a nuance to this. Most of these exchanges do make use of the cold storage too you know. They even employ more sophisticated means in securing their storage, much more than a single individual can—they spend a lot of money to achieve this. They use things like air-gapped offline wallets, multi-sig wallets, withdrawal limits, dedicated teams for this, etc.

If hackers can breach these, is it your meager setup they can't? These exchanges are like an honeypot; targeting individual with few Bitcoins and satoshis isn't as economical as targeting these honeypots.

Don't get me wrong, I'm not saying non-custodial/centralized exchanges are better, I'm just highlighting an important caveat in this premise. Self-custody is definitely a better option if you know how to properly secure your wallet in such a way that it would be less beneficial to put in too much resources to target you—afterall, that's the main work in being a self-custodian in a space with heavy targets and bounty by malicious hackers.

[NiceNIC.COM]

I don't blame your friends at all for losing confidence. Brushing people off with "nothing is 100% safe" is the worst thing you can say to someone panicked about their life savings. What actually helps in situations like this is a straight post-mortem from the wallet devs: clear scope on who got hit, the exact vulnerability, and step-by-step instructions on what users need to do next. That carries a lot more weight than spinning conspiracy theories about FUD or competitors.

[Webutxo]

Whether the COLDCARD incident or something else is true, it has proven that hardware wallets or self-custody are not 100% risk-free custody, but rather they change the nature of the risk and recently, some institutions have been using this situation to gain their market and their custody products. As a result, multiple hardware-wallet security incidents can reduce people's confidence, so it would be a big mistake to rely entirely on custody and keep all BTC in their custody.

If someone thinks neutrally and considering the risks of institutional custody and hardware-wallet or self-custody, it is generally clear which custody is better for users.

There is nothing in life that have a merit and doesn't have demerit, hardware wallets have their merit and they also have their demerits too but that of central custody demerits are worse. The Coldcard came unaware to many people, most people that even have hardware wallet don't check the firmware and very because not everyone can do it but since that happen, everyone is checking that to make sure that such mistake doesn't repeat itself again.

People are able to see the mistake of Coldcard since it's a hardware wallet but if this was a centralized custody, people might not know the real truth about it and how the coins were stolen from the exchange. If this was an exchange, people can not improve their security, rather they will still have to depend on centralized exchanges to secure their coins which is the point of hardware wallet advantage.

[Comeacross]

It's what made me think this way, my friends are already complaining that hardware wallets aren't safe anymore, one fell and others are already looking like spoilt eggs.

You should recommend this thread to your friends Events made you scare about custodial wallets, centralized exchanges. or this Why do hacks still occur? I can't find the link to the thread with updated list but these two should pass the message already.

Maybe, they will quit their bitcoin journey since they think hardware aren't safe but the exchanges aren't better too.

Is there any evil agenda behind this or it's just normal human reaction?

Hackers don't care if it is hardware or exchange, once they noticed there's vulnerability, they exploit it. There's nothing like agenda here and people are free to react anyhow they want but should not run from frying pan to fire.

[legiteum]

Most average people don't want self-custody, which is why most Bitcoin investors use a centralized mechanism like CoinBase or Robinhood.

A well-known and insured exchange is by far the safest way to keep your Bitcoin. These large companies are extremely secure, and they are insured if they get hacked, so you will never lose money no matter what.

Hmm, I would not say they are all extremely secure. We never know until they get hacked. Because they are considered extremely secure because by now, hackers can't find their way in, but one day they can. At least, they can get your information by breaching some servers and people in support teams directly through phishing emails. So you can't say all of these exchanges are extremely secure.

Instead, I would never say this to someone without giving them a disclaimer about how they can lose your money, like the FTX exchange. They did give the funds back, but at what cost? People got the USD value of the coins they held, and the conversion was based on the price at the time when it went down. So everyone made a huge loss. Many other exchanges cost people huge amounts of money. BitMart went down and then stopped withdrawals, so people were unable to withdraw their money.

Yes, you said big exchanges, but still, they are not as secure as you think.

You're definitely right, but there is a nuance to this. Most of these exchanges do make use of the cold storage too you know. They even employ more sophisticated means in securing their storage, much more than a single individual can—they spend a lot of money to achieve this. They use things like air-gapped offline wallets, multi-sig wallets, withdrawal limits, dedicated teams for this, etc.

If hackers can breach these, is it your meager setup they can't? These exchanges are like an honeypot; targeting individual with few Bitcoins and satoshis isn't as economical as targeting these honeypots.

Don't get me wrong, I'm not saying non-custodial/centralized exchanges are better, I'm just highlighting an important caveat in this premise. Self-custody is definitely a better option if you know how to properly secure your wallet in such a way that it would be less beneficial to put in too much resources to target you—afterall, that's the main work in being a self-custodian in a space with heavy targets and bounty by malicious hackers.

If they are insured, then why would you even care if they got hacked? You get your money no matter what. You can't lose anything.

Self-custody is always a bad idea unless you are a criminal or you don't live in a civilized country.

Or perhaps it's an amount of money that is so small that you don't care if you lose it....

[OsaiEmma]

If they are insured, then why would you even care if they got hacked? You get your money no matter what. You can't lose anything.

Self-custody is always a bad idea unless you are a criminal or you don't live in a civilized country.

Or perhaps it's an amount of money that is so small that you don't care if you lose it....

Insurance won't cover all the losses you know. After a major hack, you certainly won't be walking away with all your funds. Furthermore, saying self-custody is a bad idea contradicts the fundamental reason this forum exists in the first place.

Bitcoin birthed this forum, and Bitcoin's core purpose is to facilitate and uphold self-custody and control of your finances. No doubt, a lot of other technologies and side products have been built around this ecosystem, but the fundamental principle of why we are here is centered around self-custody.

So, calling self-custody a bad idea is like calling Bitcoin and its technology a bad idea.

[moneystery]

If everyone is scared of hardware wallet as their safety option and self custody option who wins? Who benefits the most from this? I guess the centralised entities and the banks.

Indirectly, centralized platforms benefit from this drama because, as people become increasingly afraid to use hardware wallets, they will begin to consider moving their assets to their platforms, which they claim are more secure and easier than using self-custody wallets.
But using a centralized platform to secure your assets isn't really a solution either. It's like you're trusting someone else to control your assets and manage them completely, which means you're still exposed to risks if the platform fails. There have been plenty of cases where a single centralized platform failed, and the number of affected users who lost their assets has been huge so far.
So self-custody can't really be replaced by centralized platforms. No matter how much they claim their services are safe, the risk of failure is still significant.

[legiteum]

If they are insured, then why would you even care if they got hacked? You get your money no matter what. You can't lose anything.

Self-custody is always a bad idea unless you are a criminal or you don't live in a civilized country.

Or perhaps it's an amount of money that is so small that you don't care if you lose it....

Insurance won't cover all the losses you know. After a major hack, you certainly won't be walking away with all your funds.

How do you know? Have you looked at every single contract entered into by every human being on earth? Lots of companies carry insurance and it works just fine. Insurance as a concept has been around for several thousand years.

Furthermore, saying self-custody is a bad idea contradicts the fundamental reason this forum exists in the first place.

This forum exists to discuss Bitcoin. I think we're.... discussing Bitcoin. No?

Bitcoin birthed this forum, and Bitcoin's core purpose is to facilitate and uphold self-custody and control of your finances.

No, Bitcoin's purpose was to enable a digital currency during a time when digital currencies were illegal. That's why it had to be decentralized. And the only sustainable decentralized model is one with the proof-of-work protocol. That's why Bitcoin took off and the other decentralized currencies that were around at the time did not.

When digital currencies became de facto legal--and Bitcoin's decentralized architecture thus became pointless--Bitcoin's popularity shifted to its role as a meme investment instrument, which is what it is today.

To fulfill its function as a meme investment, all it needs to do is be sold for more than you paid for it. You don't need self-custody for that.

[DiMarxist]

What if this is it? What if the goals of these people is to strike fear in the mind of holders that giving up their Bitcoin to custodial entities is the only way forward?

Who are these people that, are trying to instill fear into the mindsets of holder into giving up their coins , by discouraging them to abandone self custody. The truth is that anyone who is into Bitcoin knows the danger of storing their Bitcoin on a centralized exchanges. The coldcard issue only made people to ask critical questions when it comes to self custody of your Bitcoin.

Your assumption is wrong because I don't believe that centralized exchanges are trying to sell themselves to holder's because of what happened, the idea of Bitcoin was to give people power over their wealth which was lacking in Fiat currencies and Bitcoin was created to replacing that, so self custody is the goal here.

[Luke3bird]

No, Bitcoin's purpose was to enable a digital currency during a time when digital currencies were illegal. That's why it had to be decentralized. And the only sustainable decentralized model is one with the proof-of-work protocol. That's why Bitcoin took off and the other decentralized currencies that were around at the time did not.

People can use physical items or digital items and it's quite common among online gamers. They can exchange game items for money and even it's not legal in a nation, it's hard to catch them if they do it in secret platform, groups.

Things only become more severe when there is a term like currency attached to it. Without a term of currency, people can exchange bitcoins for the other things, nobody catch you because you do that, except if you exchange drugs.

like laszlo exchanged bitcoins for pizzas, did any government, any one from government catch him?
No, it was accepted or ignored even in that year, Bitcoin was not considered as legal in the USA, not legal officially but not as an illegal item.

[legiteum]

No, Bitcoin's purpose was to enable a digital currency during a time when digital currencies were illegal. That's why it had to be decentralized. And the only sustainable decentralized model is one with the proof-of-work protocol. That's why Bitcoin took off and the other decentralized currencies that were around at the time did not.

People can use physical items or digital items and it's quite common among online gamers. They can exchange game items for money and even it's not legal in a nation, it's hard to catch them if they do it in secret platform, groups.

Things only become more severe when there is a term like currency attached to it. Without a term of currency, people can exchange bitcoins for the other things, nobody catch you because you do that, except if you exchange drugs.

like laszlo exchanged bitcoins for pizzas, did any government, any one from government catch him?
No, it was accepted or ignored even in that year, Bitcoin was not considered as legal in the USA, not legal officially but not as an illegal item.

What you can get away with is a ratio between how much money is flowing through the system and the difficulty of the intervention by the government. In other words, if you are doing something small and it's a pain in the ass for the government to prosecute, you'll get away with it for a while.

Centralized digital currencies would be able to operate for a while, but the minute they got bigger, they got shut down for violating money transfer laws. It was easy to shut them down because the government would just find the owner and tell them to stop.

This begat decentralized currencies, which survived government intervention but got hacked by 51% attacks. Then Bitcoin solved the 51% attack problem with PoW, which made Bitcoin take off in popularity.

If Bitcoin were centralized from the beginning, it would have been shut down the minute it graduated past buying a few pizzas.

Anyhow, this is all just history now. Today there are thousands of defacto-centralized digital currencies like Ether and all of the stablecoins, and they are not being shut down by governments, making them defacto legal.

In other words, digital currencies no longer need to be decentralized in order to exist.

This makes decentralization--and especially the extremely-expensive PoW protocol--completely pointless....

[drangos]

I believe the salient point is that a hardware wallet should not be considered as the only security solution. The device can be damaged. The firmware might be compromised or the user can reveal the seed phrase. Those are three different risks. If the seed backup is not corrupted, the issue is likely to be a hardware failure. In which case the device is not a threat to security. If the seed backup is corrupted. It is a different story. Hence the importance of a recovery plan as well as the choice of the device. But rather than inquiring about the security of hardware wallets. Maybe we should ask how much security or safety does our entire setup have if one element fails?

[Alpha Marine]

Self-custody is always a bad idea unless you are a criminal or you don't live in a civilized country.

Or perhaps it's an amount of money that is so small that you don't care if you lose it....

I guess that is for you, because as for me, I prefer to hold all the money I have by myself. I know it's not possible to hold everything in Bitcoin, but if I had my way, everything I own would be in self custody. I like the idea of being in control of everything I own. I don't have to be a criminal to want to control and hold my own money by myself.
We live in a world where that is not possible anyway. You still need the banks and centralised companies to pay bills or buy things. But if it were possible, I would really prefer to go completely on self custody.

[Rockstarguy]

Self-custody is always a bad idea unless you are a criminal or you don't live in a civilized country.

Or perhaps it's an amount of money that is so small that you don't care if you lose it....

There is nothing bad about self-custody; this makes you the real owner of what belongs to you. Self-custody means you are being responsible and not depending on an exchange to control your keys and coins. What is the point of relying on an exchange, and unknowingly, the exchange goes bankrupt or crashes, and you lose all your assets?

Since exchanges are not dedicated to securing your assets, and it does not even make sense for an exchange to control your assets, why don’t you take responsibility and do it yourself? Self-custody is the true definition of safety and control.

[Orpichukwu]

It's what made me think this way, my friends are already complaining that hardware wallets aren't safe anymore, one fell and others are already looking like spoilt eggs.

That’s just a typical way of how some people think. Whenever something related to Bitcoin happens, we have also seen cases of fintech companies which run financial transactions being hacked, but they did not generalise everything, and others in the same line of business are being unsafe.

Is there any evil agenda behind this or it's just normal human reaction?

Sometimes we can say it’s a narrative being pushed by bloggers who spread the news, but we also can’t omit the fact that humans are also fearful of their asset when people who are close to them get affected by something they fear for their own self, which is where the fear of not knowing which wallet is going to be affected next comes from, but we still

[Catenaccio]

That’s just a typical way of how some people think. Whenever something related to Bitcoin happens, we have also seen cases of fintech companies which run financial transactions being hacked, but they did not generalise everything, and others in the same line of business are being unsafe.

What were hacked are their platforms and their wallets because of bad platform security and their bad security setup for their Bitcoin wallets.
Related to Bitcoin, I don't think like this because Bitcoin blockchain was not hacked, Bitcoin transactions were not rolled back/ reversed.

If people had bad security practice and got hacks with their accounts, wallets and funds, it's their faults.

Sometimes we can say it’s a narrative being pushed by bloggers who spread the news, but we also can’t omit the fact that humans are also fearful of their asset when people who are close to them get affected by something they fear for their own self, which is where the fear of not knowing which wallet is going to be affected next comes from, but we still

It's easy to spread misleading information for catching attention to their blogs or social media because what they care about are traffics which can help them earning more money. With them, they don't care about what they write or talk is accurate in information, what they want to achieve is noise, a lot of noise, more traffics, and more money.

You can not stop them but by learning you can avoid panic with fuds.
http://endthefud.org/

[Bushdark]

If everyone is scared of hardware wallet as their safety option and self custody option who wins? Who benefits the most from this? I guess the centralised entities and the banks.

You don't have to conclude that people are scared of hardware wallet, their are millions of investors that are using hardware wallets and also you need to understand the role centralized exchanges play in the society before any conclusion.
Most holders often use centralized exchanges for trading, P2P, staking and other things that could look convenient for them based on their comprehensive limitations.

What if this is it? What if the goals of these people is to strike fear in the mind of holders that giving up their Bitcoin to custodial entities is the only way forward?

What fear actually? I know that the government will often create propaganda to make us seen centralization in cryptocurrency portfolio as the safest so that they can comtrol how spend money and monitor our activities but that does not mean that we don't have the option to go for what we want.

[PrivacyG]

Self-custody is always a bad idea unless you are a criminal or you don't live in a civilized country.

How does the Big Brother boot taste, legiteum?