Derek Ross on Nostr: Consider the Coldcard vulnerability just the beginning. With frontier LLMs advancing ...

Consider the Coldcard vulnerability just the beginning. With frontier LLMs advancing rapidly, security threats are only getting more sophisticated. What was "secure enough" yesterday won't cut it tomorrow.

That means leveling up:

🔐 Use multi-sig. Don't rely on a single key to protect your stack.

🔧 Use multiple vendor devices. Don't put all your trust in one company's hardware or code.

🔑 Use complex passphrases. A strong 25th word adds a layer that even a compromised seed can't crack.

🛡️ Or combine ALL of these. For some of you, that's what it's going to take.

Yeah, it sucks. Financial freedom isn't free and it isn't easy. But the alternative of trusting someone else to secure your bitcoin is exactly what we opted out of in the first place. I still believe in self custody.

quoting
nevent1q…ra98

Coldcard Security Vulnerability: What You Need to Know

If you generated your seed words on a Coldcard WITHOUT rolling a die 100+ times yourself AND without adding a strong passphrase as your 25th word, your wallet may be vulnerable. This affects all Coldcard devices. The device didn't use sufficient entropy on its own, meaning someone could potentially recreate your seed.

What are your options?

1) Move your funds immediately. Transfer your bitcoin to another wallet. Sparrow, your own node, Aqua, or almost anywhere else. This is a temporary fix, but it gets your funds out of harm's way. Practice standard security hygiene with wherever you park them.

2) Update and regenerate. Flash your Coldcard to the latest firmware, then generate a brand new wallet by manually rolling dice 100+ times and adding a strong passphrase. This significantly improves your security, but honestly, after a vulnerability like this, it's hard to fully trust the device again.

3) Get a Bitkey from Block. No seed words, no passphrases. All complexity is hidden. It uses multi-sig for security instead, and the UX is genuinely great. I've bought several for family members and recommend it highly. Different approach, but rock solid. Literally.

4) Get a Trezor Safe 7. It's a Bitcoin only version from the company that literally invented hardware wallets. I haven't used one personally, but trusted friends and colleagues swear by them, no issues, feel secure.

The bottom line: if you're using a Coldcard with a device generated seed and no passphrase, don't wait. Move your funds and upgrade your setup. Please.