How Bitcoin Hardware Wallets Supported Users During the Coldcard Crisis

Bitcoin.com Information seemed into how the highest 13 producers of those essential gadgets communicated on X, the principle social media channel for all issues crypto asset-related, because the disaster erupted on the finish of July and into August.

SPEED AND CLARITY

Groups differed in velocity, readability, helpfulness, tone, bragging degree, and whether or not they saved following up on the matter days and now, weeks later. For instance, the producer of Bitkey, U.S.-based Block, which was a part of the preliminary Coldcard investigation, was among the many first to warn its customers and the broader neighborhood in regards to the exploit, and was quickly adopted by Canada-based Blockstream, the producer of Jade. In the meantime, for some others, it took greater than a day to submit on X. One of many leaders of the business, Europe-based Ledger, knowledgeable its followers on X after round 14 hours because the disaster erupted.

Nevertheless, the quickest responders weren’t all the time essentially the most thorough.

BROADER SELF-CUSTODY OPPORTUNITY

In both case, among the many patterns that emerged throughout the wallets’ communication, there was a heavy emphasis on how entropy is generated, as groups have been attempting to distinguish themselves from Coldcard. Additionally, some groups highlighted assist for user-generated entropy as a approach to cut back belief within the system’s personal random quantity generator (RNG).

There was additionally a special strategy to how closed- and open-source system producers have been attempting to calm their customers. Gadgets with stronger open-source credentials (Passport Prime, Trezor, Bitbox, Keystone, Blockstream Jade) leaned into verifiability, whereas extra closed-source designs (Ledger, Tangem, Ngrave) leaned extra on certifications and audits.

Moreover, not all groups mentioned multisignature (multisig) setups as a structural protection, particularly on the subject of multi-vendor setups, whereas a number of firms used the second to push broader self-custody greatest practices typically.

HELPING AND BRAGGING

As for the follow-ups, Trezor, Bitkey, Bitbox, and Blockstream Jade stood out as extra energetic ones, offering further info, whereas Ledger, Tangem, Safepal, and Ngrave have been comparatively much less energetic in that regard.

Additionally, not each crew gave sensible migration recommendation for affected customers, and Basis (the producer of Passport Prime), Bitkey, Ellipal, Jade, Bitbox, and Trezor stood out for actionable steerage. In the meantime, Basis and Trezor additionally communicated about their further safety hardening measures. Ngrave and Ellipal appear to have used the strongest promotional language, corresponding to “world’s most secure,” “chief of air-gapped,” and so forth.

Now, let’s take a fast take a look at every of the wallets’ communications. They’re ranked by their first submit on X throughout the disaster.

REACTIONS OF THE TOP 13 BITCOIN HARDWARE WALLETS TO THE COLDCARD CRISIS

BitkeyJuly 30, 10:07 PM EDTBitkey and its producer, Block, took a proactive early position within the Coldcard disaster, as Block’s crew independently investigated the thefts and revealed an in depth technical evaluation confirming that the seedless Bitkey pockets wasn’t affected. Moreover clear explanations in plain language and warnings that susceptible Coldcard seeds stay compromised even when moved elsewhere, the crew additionally suggested towards rushed new self-custody setups. A mid-August FAQ reiterated that Bitkey was unaffected, no motion was wanted, and detailed its core 2-of-3 multisig design. Later communication shifted to product schooling on multisig and restoration somewhat than repeated disaster messaging.

Blockstream JadeJuly 30, 11:20 PM EDTThis crew instantly ensured that Jade’s seed phrases are generated from a number of unbiased entropy sources. Additionally, it revealed a sensible weblog submit outlining a four-step migration course of for affected Coldcard customers. The crew detailed Jade’s multi-source entropy design and harassed its absolutely open-source nature. Subsequent communication targeted on answering consumer questions, explaining the pockets’s security measures, and saying new strategies to create entropy offline.

Passport PrimeJuly 30, 11:33 PM EDTThe producer of the Passport Prime pockets responded with an announcement that every one its fashions have all the time generated appropriate entropy and are protected. It adopted with detailed technical posts explaining the Coldcard failure and its personal multi-source {hardware} entropy design. Additionally, the crew shared a further post-incident overview of its entropy structure. Particular new measures introduced included additional well being monitoring to stop low-entropy seeds from {hardware} failures, the discharge of a user-facing entropy-testing app on Passport Prime, and plans to publish AI code-review stories with every software program launch.

TrezorJuly 31, 03:16 AM EDTTrezor assured customers that their funds have been protected, quickly including that anybody who had moved a Coldcard-generated seed onto a Trezor was nonetheless in danger. The identical warning is current throughout the vast majority of different wallets as nicely. In just a few days, the crew revealed a technical breakdown of the pockets’s entropy design. Subsequent, the communication continued via mid-August by consolidating its place and repeating entropy explanations, phishing warnings, and mentions of attainable added dice-roll entropy assist. In the meantime, on Aug. 13, Trezor disclosed that nearly 14,000 of its clients have been affected by a knowledge breach at ShipMonk, one in all Trezor’s transport suppliers.

OnekeyJuly 31, 04:24 AM EDTAfter calming its customers that these gadgets should not affected, OneKey defined that entropy is generated completely on-device, combining unbiased random sources. Comply with-up communication repeated the identical details, together with twin on-device entropy sources, certification, open-source firmware, and ongoing security-firm overview, whereas additionally sharing extra detailed articles, together with on multisig or easy methods to degree up the safety of a seed phrase.

BitboxJuly 31, 04:52 AM EDTBefore its first substantive assertion on July 31, the crew had already replied in a separate earlier thread that its gadgets have been protected. BitBox additionally defined that its seeds mix 5 unbiased entropy sources. Comply with-ups detailed its entropy sources, framed as defense-in-depth, and pointed to open-source firmware, inside AI-assisted audits, a bug bounty, and assist for guide dice-roll entropy. BitBox additionally defined the professionals and cons of a multisig setup. Individually, unrelated to Coldcard, BitBox disclosed and patched its personal firmware bugs. No exploitation has been reported.

KeystoneJuly 31, 06:47 AM EDTKeystone’s early posts addressed their entropy era with out mentioning the Coldcard disaster, however have been adopted by one other assertion on August 4, confirming that inside checks discovered all Keystone gadgets to be protected. Later, the crew detailed its system design, emphasizing that the era course of had been verified at each stage. In addition they supplied two non-compulsory options, corresponding to including a BIP-39 passphrase or utilizing the system’s dice-roll function. Comply with-up replies via early August targeted on the multi-source design and the cube/passphrase choices, whereas additionally pointing its customers to the open-source firmware and public audit stories for unbiased verification.

Ledger July 31, 12:16 EDTAfter the preliminary message that Ledger wasn’t affected by the Coldcard difficulty, pointing to an authorized true random quantity generator constructed into its safe aspect, a extra detailed clarification got here on Aug. 2 from its CTO Charles Guillemet. In its follow-ups, the crew targeted on the variations in its know-how, whereas additionally providing steerage on multisig, warning that extra complicated custody setups will also be extra dangerous, and providing different options corresponding to Miniscript and MuSig2, a two-round bitcoin multi-signature protocol. Moreover, the crew shared how they’re getting ready for AI-accelerated safety assaults. Whereas Ledger itself has not suffered any safety breaches, its clients have been impacted by two private information leaks stemming from third-party incidents.

TangemJuly 31, 3:08 PM EDTTangem was additionally fast to emphasise that this seedless system runs on completely separate code from Coldcard. Later in August, Tangem argued that safety comes from structure, testing, and unbiased verification somewhat than open-source code alone. Additionally, it revealed a proof of why seed-targeting malware doesn’t work towards Tangem. The crew’s predominant messaging later targeted on structure and certification.

EllipalAug. 1, 07:21 EDTBesides calming its customers down, Ellipal invited them to confirm somewhat than simply belief, because the system accepts a seed {that a} consumer generates themselves. Additionally, it shared a proof of easy methods to examine randomness independently. Two days later, it supplied a giveaway of seed-security instruments. Within the follow-ups, it targeted on technical explanations, whereas on Aug. 5 it supplied a migration guidelines for customers who’d made a seed on a Coldcard. Ellipal was additionally energetic in warning its customers about phishing makes an attempt and even shared a submit by its competitor, Ledger, on open-source {hardware}.

SafepalAug. 1, 2:14 PM EDTSafePal additionally targeted on differentiating itself from Coldcard, saying that this pockets pulls entropy in the mean time of pockets creation somewhat than counting on a single chip or supply. As with many different wallets, it additionally warned about phishing makes an attempt. Its Aug. 1 submit and weblog have been primarily the entire response, later solely sharing a submit on passphrases. Nevertheless, on Aug. 16, the corporate disclosed that nearly 40,000 of its clients have been affected by a knowledge breach.

NgraveAug. 1, 3:43 PM EDTNgrave targeted on its “Excellent Key” era course of that mixes a number of cryptographic methods, air-gapped era, and the consumer’s personal fingerprint. Later, it saved reminding customers that counting on a single key-generation supply is a single level of failure. It additionally invited customers to confirm the design themselves. Additionally, the crew mentioned they’re leveraging “varied LLM assisted cyberdefense evaluations, harnessing the world’s leading edge fashions to safe your funds,” and introduced their buyer information deletion program.

KeepkeyAug. 1, 4:25 PM EDTKeepKey shared a technical breakdown from its developer, additionally linking to a KeepKey weblog submit protecting who was in danger, migration steps, and why an all-Coldcard multisig doesn’t defend towards this class of failure. This was the one submit by KeepKey after the Coldcard disaster began, as this crew will not be very energetic on X.

To conclude, the Coldcard disaster has not solely taught {hardware} pockets producers new safety classes however, hopefully, their communication may even enhance even additional when/if the subsequent disaster hits.

Bitcoin.com Information has contacted all these groups for remark and can share their responses, ought to they be forthcoming.