Another month, more news about hardware wallet incidents. A sad recurrence.

[greysonz]

We're facing a major crisis of trust in hardware wallets, which until relatively recently were considered the best way to store your bitcoins. Look at the picture and you'll see a new incident every month. And which wallet will we hear about in November? I'd prefer none at all. And if hardware wallet manufacturers don't take action now, the list will go on. They need to know every detail of their assembly lines and undergo code audits, both with the help of the latest AI models and with the help of specialists.
Mistakes are too costly.
And unfortunately, the ones who pay for them are the users who were careful and survived crises and market crashes.


https://x.com/SolanaSensei/status/2114257912424227152

[Upgrade00]

The recurrent problem with most cases is data leaks, some have suggested actions like anonymous shipping, which should be live in EU now for trezor users, if they kept to their timeline. This protects sensitive date from being available to multiple parties and potentially get leaked.

The issue with most consequence however is ones like the device tampering or faulty seed generation that directly leads to loss of funds without the user being able to protect themselves. Situations like that should never occur and it's down to the service to make sure that they do not. They should have open source codes and key guidelines for users to do after purchasing.

[Pmalek]

The core assumption hasn't changed. Hardware wallets remain a good and safe way to store your bitcoin and crypto. Other factors that can affect your security and privacy have changed, though. You can buy your device online and your data can leak. That affects your privacy, not the security of your coins. You can buy a modified device like we saw with Ledger and suffer financial losses. That affects the security of those units only. These things can be avoided, either with share luck or different planning (for buying and shipping hardware wallets).

The worst fu**up of all those cases mentioned is Coldcard. Their users did everything they could and should have and still lost money. The only other thing they could have done if they knew how to was to inspect the publicly available code, but no one did it properly. Coldcard's actions directly impacted the problems the users suffered. In all the other cases, it was an outside party that caused problems.

[greysonz]

The core assumption hasn't changed. Hardware wallets remain a good and safe way to store your bitcoin and crypto. Other factors that can affect your security and privacy have changed, though. You can buy your device online and your data can leak. That affects your privacy, not the security of your coins. You can buy a modified device like we saw with Ledger and suffer financial losses. That affects the security of those units only. These things can be avoided, either with share luck or different planning (for buying and shipping hardware wallets).

The worst fu**up of all those cases mentioned is Coldcard. Their users did everything they could and should have and still lost money. The only other thing they could have done if they knew how to was to inspect the publicly available code, but no one did it properly. Coldcard's actions directly impacted the problems the users suffered. In all the other cases, it was an outside party that caused problems.

Then we can compare the situation to what happens during an immune system test: the body gets sick, but then recovers and becomes stronger.
Perhaps I was too critical about hardware wallets, and perhaps this is all just a phase of their strengthening. And you were right to mention Coldcard, clarifying the details. And I want to add that they reacted completely inappropriately to the wave of hate in the comments.
In their situation, they should have remained as open as possible, but they chose this: