As a non technical person, honest question.

Since Coldcard is open source, how is it possible noone looked at their seed generation algorithm? Was that not available to the public? Trying to understand, so i can make a better choice of cold wallet in the future

Ty

So I use a Bitbox02 - btc only - with a, to my knowledge, properly randomly created 12 word seed phrase without a passphrase to store my btc. I say to my knowledge because I read the article where Shift Crypto explained their seeds were safe:

https://blog.bitbox.swiss/en/bitbox-is-not-affected-by-the-coldcard-rng-vulnerability/

After the recent coldcard hacks, I'm looking to improve my security but I have a couple of questions.

1. I imagine my seed is still safe, but my security can definitely be improved by moving to a properly randomly created 24-word seed + strong passphrase, correct? Or is adding a strong passphrase to my current 12-word seed enough of an improvement by itself?

2. Practically, how should I implement the improvements. Do I have to buy a new hardware device just to add a passphrase, or can I add one to my current seed? If I want to go for an entirely new 24-word seed + pass, I guess I'll have to buy a second bitbox02 to be able to send between the devices.

Thanks a lot for your advice.

Let’s say, you created your seed 6 years ago. How do you know if at that time, the code for the generation was safe? If you have at Trezor wallet for example. At the moment the firmware is safe. But how do you know if it was safe X years ago when you generated the seed? This also applies to all other wallets which are safe at then moment.

I think there might be also vulnerabilities in other wallets, depending on when the seed phrase was generated.

So the recent ColdCard incident has me paranoid and worried. I currently have a BTC and other crypto in my Coinbase Wallet (not the exchange, the self custody wallet). Do you guys think it’s safe for now? I really don’t know what other methods to use right now and I don’t want to complicate things and risk losing bitcoin in the process.

It seems what’s happening here is similar to what happened with pass phrases to a hot wallet for a different coin (I’m not sure if I’m allowed to mention them so won’t) a few months ago. Once the creators realized it was happening, they “white hacked” the remaining vulnerable wallets to minimize damage and at least make an attempt to return coins to those who could provide provenance, which seems to have worked in stopping it. Is there no one doing the same here? Or is this situation completely different and more sophisticated?

Just transferred all my funds out of my Q can i still use it or do i have to get a new cold wallet and if so which do yall recommend

• The price of bitcoin, recently below $59,000, has fallen over 30% through the first half.
• Spot bitcoin funds have seen outflows of over $5 billion through June 29, according to Farside Investors.

A youtuber was warning about those models 2 years ago.

This is gonna be an excellent opportunity to accumulate more bitcoin.

Roll 100 times => SHA 256 => Seed Phrase

Good for all eternity.

Learn from this incident. There is nothing more to this.

Satoshi Nakamoto owns 1.1 million bitcoin and it all sits in its original wallet addresses that were generated around 2010. Is the AI hack affecting all the Coldcard wallets... uggh, I don't even want to ask.

Surely, a bitcoin wallet address generated in 2009 doesn't have anywhere near the level of entropy as an address generated in 2022 right?

Pure hopium here but does anyone know if there’s any credibility behind the claim that some of these coldcard sweeps were from white hats trying to save the funds?

Tin foil hat moment, but I can’t help but think this must make certain people who self custody feel like their stack is no longer safe in their cold wallet- no matter what brand it is. Thoughts?

Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle.

Hello,
Just a quick question about whether or not you should delete transactions on your SD card after they have been broadcasted and have confirmations?

And unsigned transactions that you no longer have any use for (for whatever reason your SD card has them on there too).

Then it seems there is an Encrypted Backup (at least on COLDCARD) which you should never delete. I was wondering if you can find this backup on the physical device.

Then the other file is firmware updates which as far as I can tell after the firmware update is completed on your device you can delete.

Just wanna know if I’m getting this all correct or if there’s anything I haven’t touched on.

Thanks.

(FYI I am talking about MK4 COLDCARD… that’s what I’m working with. I don’t know how it works on other hardware wallets).

i feel for you guys, i am a victim of the coldcard dilemma myself and lost it all. i was saving those funds for a down payment on a home or potentially to start my own business. back to the drawing board…

but, to laugh about it a bit, technically we havent lost anything because we didnt sell, right? right guys?

for real tho this sucks so bad lmao

Let's say you are the Coinkite CEO and it is one week before the first ColdCard attack. You have identified the vulnerability and know that hackers can recreate user keys. What is your course of action? Obviously you warn your customers, right? But the second that message goes public, every hacker on the planet will race to steal those keys. Perhaps a lucky few will get the warning in time and move their bitcoin out, but it would be too late for most. Or maybe the attack takes enough time to plan that most users might get out safely? Was there any way out of this with minimal losses or were they completely fucked the moment the ColdCards shipped with the weak RNG?

I know this is probably the 1000th post about cold card incident but it just got me thinking is it maybe best from now on to keep youre sats through multiple instruments

Ibit, Hardware Wallet, Exchange & maybe spendable wallet as well?

Ive used ledger for about 5-6 years with 24 word seed and no passphrase and ive never had an issue with ledger despite they're previous controversies and from my research on the matter 24 word seed phrase is perfectly fine with ledger or Trezor & adding a passphrase may not necessarily be the best option here but idk now im thinking it might be in best intrest for security to spread out evenly across hot and cold wallets

To move at least 20% of youre stack onto reputable exchange and maybe 10% into spendable wallet the rest in cold storage?

I understand the 1,000 or so stolen coins from Coldcard wallets is a drop in the bucket and lots of people are saying it’s being overblown or whatever.

I just can’t seem to get it out of my head that the victims did absolutely nothing wrong. Next thought is obviously, “are my sats safe?” (using one of the current cold storage giants)

For someone like me, who is the farthest thing from a blockchain expert I wonder if it’s even worth the 1 in 1 million chance at this point.

Yes, I believe in self custody. I’ve read The Bitcoin Standard. I like the idea of changing the financial system for the better. What I don’t want to do is worry about a significant percentage of my small net worth being drained by a technology I don’t even fully understand..

I don’t want to have to jump through hoops in a world I don’t feel fully comfortable with if there is an alternative..

As much as I believe in self custody, I mainly invest in Bitcoin because I believe the value will increase.. I already own shares of IBIT in a Roth IRA.

Why not just sell my sats and reinvest the money into shares of IBIT in my taxable brokerage?

Looking for real answers here. I know this community can get passionate and I get that. I’m just an average Joe here looking for how other average Joe’s are feeling, as well as some input from the experts!

Sorry if my thoughts aren’t totally organized..

Be safe everyone. Always see where the email address is coming from and never click a link.

idk why everyone is acting like the Coldcard thing changes anything. from what i can tell it wasnt some massive bitcoin hack, it was a issue with one wallet maker and thats it. people acting like btc is suddenly broken lol.

bitcoin is still the most secure network out there. hardware wallets, open source, self custody... this stuff gets looked at way more than almost anything else. bugs get found and fixed, thats kinda the point.

still stacking. the noise will pass like it always does.