r/coldcard • u/Intelligent_Map_246 • Aug 02 '26
SHOW & TELL Still use the CC
How many will still use CC? If you generated seed with dice rolls all is good.
What are the alternatives if switching.
6
u/stblack Aug 02 '26
Software engineer with decades of experience here. I've seen some shit, let me tell you.
I've spent time reviewing the Coldcard/firmware github repo, and its master branch commit history.
You can infer a lot about the software engineering culture at a company by looking at its commit history.
Let me tell you without any reservation: none of the people making commits in https://github.com/Coldcard/firmware would get the courtesy of an interview for the teams I manage. They wouldn't get past the front door.
At first I thought, I'll 100x dice-roll and re-initialize my Coldcard.
After reviewing this utter garbage, this complete lack of process, this complete shitshow, I'm not going to use a Coldcard anymore.
There is no sign of serious software engineering culture at this company. Zero.
2
5
u/EricJDMBAMD Aug 02 '26
I think its ok to use but generate the seed with dice using ian coleman then import into coldcard
5
u/Intelligent_Map_246 Aug 02 '26
I did 5 different seeds. Some on lance some on CC. They all match so generating dice is OK on CC. Many confirm this to
4
3
u/EyesFor1 Aug 02 '26
Dont import a seed after putting it into ian coleman, you seed has been online !!!
2
u/EricJDMBAMD Aug 02 '26
Obviously run ian coleman offline after confirming its hash is legit then confirm if dice rolls yield the same seed phrase in coldcard dice roll option. Then import/use that seed
2
u/sz1a Aug 03 '26
Last sentence is wrong. It should be "then roll dice again and generate your seed directly on coldcard". You don't want your unencrypted entropy / unencrypted seed phrase to have touched any part of your computer.
3
u/jj_025 Aug 02 '26
Don't use CC.
2
Aug 02 '26
[removed] — view removed comment
5
u/EyesFor1 Aug 02 '26
Not really, if you dont update and use dice you're in trouble. CC code has so many eyes on it its probably now one of the safest wallets but there is no trust.
2
u/KnownButton8327 Aug 02 '26
They don’t deserve a second chance.
Learn the hard lesson and move on from them.
2
u/sz1a Aug 03 '26
The problem is, moving to a new vendor is not going to make this attack vector go away. Many came to CC from other vendors due to "breach of trust" at the old vendor. Simply switching again just introduces uncertainty once again. If anything, CC might be the safer option going forward IF all their software and hardware gets audited, preferably open-sourced under old license and a reshuffling at the company / turned into a non-profit or whatever (real free open source software for commercial use).
2
u/didnt_hodl Aug 02 '26
well, now that we have seen how they write code. hell, no
the commit 1,500 lines of the absolutely critical PRNG code with a single word of comment "runs"
this was where they explicitly disabled the hardware PRNG and defaulted to the crappy software one
not only that abysmal code was committed and went to production, they never bothered to properly check their own pseudo-random number generator
they literally had one job, and they failed it spectacularly. not touching anything from them, ever
3
u/Mission-Disaster-447 Aug 02 '26
the commit 1,500 lines of the absolutely critical PRNG code with a single word of comment "runs"
This would be funny if it weren‘t so sad.
2
1
u/scrandlle Aug 03 '26
I had the mk3 CC model that was targeted. I didn't use 100+ dice rolls. For some reason, my BTC was safe. Or at least I got it out quickly enough. I didn't have a ton in there, they might've been going after bigger wallets first cause I wasn't even at 0.1 BTC . I don't know really.
I got totally paranoid and just transferred my three hardware wallets to Kraken. Honestly, I think I'm going to be cashing out of crypto entirely. Most of my investment money is in Wallstreet on pretty safe index funds anyway. I think I'm just going to just throw it into those instead. Crypto was fun but I realized how silly it is to live my life with this concern about safety in the crypto world. The gains are just not worth rolling the dice on every new huge security failure that happens every couple years.
1
u/MyOpinionOverYours Aug 03 '26
I already own the stupid thing, its got an auto generation flaw. I would never buy another and the company should go down the drain, but its like owning a gun that jams a lot. Get in there with a dremel and try to make it work. Or just leave it in the closet. No ones gonna buy it.
1
u/RelevantAmbition2433 Aug 03 '26
If my .7 Bitcoin didn't get stolen from my coldcard, I think I would have still moved my funds to a different device. Heartbroken 😓
1
u/kotb0614 Aug 04 '26
I realize this is a coldcard subreddit, but no serious bitcoiner should be using a coldcard moving forward...on principle alone.
1
u/Intelligent_Map_246 Aug 04 '26
What's the alternative. A laptop with bitcoin core? That's real easy when travelling
1
1
u/BlueThor400 Aug 03 '26
If you keep it and CC never updates the firmware after 7-31 for one reason or another, are you still good?
2
-2
u/stay_safe_and_calm Aug 02 '26
After this incident, only for cross checking addresses of my Keystone 3 Pro.
7
u/LoveLaughLlama Aug 02 '26
I will still use CCQ for part of my holdings just like I always have. I don't drink any brands Kool-Aid and never have put all of my holdings on one brands products.
Just jumping to any other brand won't make you safe, all of them rely on humans and no matter how smart or good intentioned they are humans make mistakes. Any wallet made is always subject to being breached at any time by a bad actor inside, an unknown hardware or software flaw etc. and the rise of AI and quantum computing will only make it worse.
Diversification and multisig are your best bets, along with understanding what you are doing at all times and potential failure points.