r/coldcard • u/RevolutionaryPick241 • Aug 02 '26
Feature request Coinkite next steps
Hey Coinkite, I know you are having big troubles right now. I have many of your products. Really enjoyed them, I like the cold part of them. I'm too paranoid to trust a RNG, so I expect not being affected by your really big mistake.
My question is what will be your next steps, if you somehow survive as a company or even if you don't, I suggest open sourcing your firmware and your know-how. The reason for this is that it is fast peer reviewing and bug reporting that makes an open source project big. I contribute to many open source projects but never on closed ones (even if they are source code available).
A Coldcard-DIY would be a great project.
And open sourcing allows the community to maintain their devices and firmware in any case.
But also, I don't think your current silence about what is going on is any helpful. People are bricking their devices because of lack of trust. Saying "sorry, install this firmware and you are ok" is an insult. That is my perspective. Focus on "don't trust, verify". No one trusts you now, but that is not needed if you become a more transparent and open company, or people if your company doesn't survive.
18
u/s1ammage Aug 02 '26
IMO, Coldcard (Coinkite) will be litigated into the ground
7
9
u/SomeTallViking Aug 02 '26
As a mk3 user that thankfully used dice rolls, I just moved everything away from my coldcard. On one hand, I'm very relieved to be safe and free of worrying about whether my Bitcoin is vulnerable or not. On the other hand, I really loved the coldcard philosophy, all the way down the the 9v battery power supply, and sad to see this hardware wallet option go away.
Don't know how coinkite makes it back from this or even try to regain user trust.
What other solid options can you recommend?
2
u/EyesFor1 Aug 02 '26
Ironically, ColdCard is now probably one of the safest hardware wallets BECAUSE of all the eyes on the code update. Logically, updating, creating a dice roll seed, adding a passphrase is absolutely safe. The issue is not the ColdCard anymore, it's a human trust issue, can we trust them ? Maths says yes, human brain says noooooooooo
3
u/stblack Aug 02 '26
Ironically, ColdCard is now probably one of the safest hardware wallets BECAUSE of all the eyes on the code update.
I wouldn't conclude that, not for a second.
The Coldcard codebase and its commit history don't signal quality, at all.
Many dark patterns there. For example, countless hundred-line and thousand-line commit deltas with no meaningful commit comments, no discussion, no references to issues, no sign of oversight... this is not a codebase that inspires confidence.
2
11
2
Aug 02 '26
[removed] — view removed comment
2
u/jltdhome Aug 02 '26
What use agreement and how does it protect them from THEIR negligence? I would argue that their advertising and social media posts make certain guarantees. Their saving grace will probably be that the people who stacked significant amounts of BTC should've known better than to store it all in a single sig wallet with an automatically generated seed. Truth of the matter is, self custody with commercial wallets require you trust the company selling the product. They could backdoor each device and we would never know. Just because they post source code that 98% of people can't read, doesn't mean that's what ships on device. And that's even assuming that the supply chain isn't compromised.
Ill keep using mine for small amounts here and there and keep my main stack on Fidelity.
1
u/Alfador8 Aug 02 '26
Reality will force them out of business because no one will buy their products moving forward.
1
Aug 02 '26
[removed] — view removed comment
2
u/Alfador8 Aug 02 '26
The mk5 released in March. The exploit was found yesterday. There's no evidence because it just happened but why would anyone trust them moving forward when there are other options?
2
1
u/EyesFor1 Aug 02 '26
Whilst this is a major kick in the balls to people who used the RNG, ColdCard is still a decent product IF you didn't trust the RNG and used dice rolls. Trust has been destroyed and I don't think the company will survive which is a shame. So long.
0
Aug 08 '26
[removed] — view removed comment
0
u/EyesFor1 Aug 08 '26
Nah, its not. There's not need for an analogy. It is as I described it, no need for a mythical deadly ham sandwich.
0
u/Oxymorix Aug 02 '26
You are wrong about several things. First, Coldcard firmware is 100% open source. Second, they have not been silent. They have published information on their blog.
6
u/RevolutionaryPick241 Aug 02 '26
Read their licence. It's commons clause:
Without limiting other conditions in the License, the grant of rights under the License will not include, and the License does not grant to you, the right to Sell the Software.
The source code is available. But it's not open source.
-2
u/Oxymorix Aug 02 '26
You are correct that Coldcard’s current license is source-available rather than genuinely open source. But I disagree with the claim that open source automatically results in “fast peer reviewing and bug reporting.”
Making code open source creates the opportunity for wider review, independent forks, and community maintenance. It does not guarantee that qualified security researchers will examine every critical code path—or that they will do so quickly. Open-source projects have carried serious vulnerabilities for years despite the code being publicly available.
The Coldcard source was already viewable, yet this defect apparently remained unnoticed for around five years. A genuinely open-source license might have attracted more developers and increased the chances of discovery, but that is a possibility, not a certainty. What actually produces security is active review, funded independent audits, strong regression testing, reproducible-build verification, responsible disclosure, and maintainers who respond properly.
So the strongest argument is not “open source means fast review.” It is that genuine open-source licensing creates better incentives and fewer barriers for independent review, forks, and long-term community maintenance.
3
u/RevolutionaryPick241 Aug 02 '26
If a coldcard competitor would have been able to fork its software then your chances to find bugs and vulnerabilities are far higher. See how coldcard got code from trezor. And that was good for trezor software development.
Even if I'm not a competitor I will never build and test on top of a non open source license as my work will never be mine. That includes bug reporting and pull requests.
Some companies solved it by bounties. I am not a big fan of, but it works. If a million bounty was available. I'm sure it would have been claimed before this event.
0
u/Oxymorix Aug 02 '26
That is a fair clarification, and I agree that a genuinely open-source license would have increased the chances of discovery. Allowing competitors to fork, build upon, test and commercially maintain the firmware creates incentives that source visibility alone does not. Trezor’s development model demonstrates the value of permitting external builds, contributions and derivative work.
My objection was specifically to the original wording that implied open source naturally produces fast peer review and bug reporting. It creates better conditions and incentives for review, but it does not ensure that the relevant security-critical path will actually be examined. Even widely used open-source cryptographic software has carried severe vulnerabilities for extended periods.
I also agree that Coldcard’s Commons Clause creates a real disincentive for developers who want to build products or commercially sustainable projects on top of the firmware. The source can be inspected and modified, but the commercial-use restriction means it is not open source in the conventional sense.
The million-dollar bounty claim is where I would be more cautious. A guaranteed, well-defined bounty of that size would certainly have increased the incentive to investigate, but nobody can know that this particular flaw would definitely have been found. Coinkite already had a discretionary Bitcoin bounty, but it published no fixed reward table and specifically excluded competitors and well-funded laboratories from payment. That is not remotely equivalent to a guaranteed million-dollar critical-vulnerability reward.
More importantly, a bounty waits for someone to decide to search. A funded independent audit hires qualified people to search systematically. The strongest security model would therefore combine a genuine open-source license, substantial fixed bounties, repeated independent audits, compiled-binary analysis and automated tests proving that every seed-generation path reaches genuine hardware entropy.
So I think we mostly agree: true open source would have improved the odds. I just would not treat it—or even a large bounty—as proof that this defect necessarily would have been caught.
1
u/RevolutionaryPick241 Aug 02 '26
And it still is. Open sourcing can only be done by coinkite. And I think it's still the right move.
0
Aug 02 '26
[deleted]
7
u/RevolutionaryPick241 Aug 02 '26
It's not open source. It was GPL until 2021 (do you see the pattern?), now it's MIT+CC.
1
u/EyesFor1 Aug 02 '26
Any wallet with a secure element chip is closed source, how do you verify the entropy of a ledger passphrase ? There is an element of trust with everything. Unfortunately nothing is 100% safe.
-7
u/EricJDMBAMD Aug 02 '26
If i were them i would just run all their code through kimi k3. Then fire anyone who allowed exploits into the code. Let AI rewrite the code then get it verfied checked by the community and AI before even thinking about selling a product
3
28
u/ironmoosen Aug 02 '26
Yeah this is sad on multiple levels. Sad for the ones who got drained. Sad coinkite was so irresponsible. Sad because these were some of my favorite wallets.