There is an old saying in Bitcoin: don’t trust, verify. Like a lot of Bitcoin aphorisms, it sounds simpler than it really is.
Over the past week, the Bitcoin community was reminded of that in a painful way. A serious vulnerability involving Coldcard hardware wallets resulted in bitcoin being swept from wallets whose owners believed their coins were safely stored in cold storage. Some had been stacking for years. One account I read was from someone who said he had accumulated two bitcoin over eight years, only to wake up and find them gone. He had done what he thought he was supposed to do. He bought one of the most respected Bitcoin hardware wallets. He took custody of his coins. He kept his keys offline. And he still lost everything.
I found that story genuinely sad. But one sentence in particular stayed with me: “I thought I was secure because Coldcard was always praised as one of the best and most secure wallets.”
There is an important lesson buried in that sentence. He trusted the hardware.
And hardware can fail.
Bitcoiners spend an extraordinary amount of time debating hardware wallets. Coldcard versus Trezor. Trezor versus Ledger. Jade versus everything else. Open source versus closed source. Secure elements. Air gaps. QR codes. Seed lengths. Dice rolls. There are legitimate differences between these devices, and some designs are undoubtedly better than others.
But eventually I came to believe that we are asking the wrong question.
The question isn’t:
What is the most secure hardware wallet?
The question is:
What happens if my hardware wallet fails?
Those are very different questions.
The first assumes we can identify a perfect component. The second assumes that eventually every component can fail.
That distinction is the foundation of resilient engineering.
Airplanes don’t stay in the sky because engineers discovered a component that can never break. Data centers don’t stay online because somebody invented a server that never crashes. Critical systems are designed around redundancy. They assume individual components will fail and then make sure the failure of one component doesn’t bring down the entire system.
Bitcoin custody should work the same way.
I happened to own one of the Coldcard models caught up in the current controversy.
I used an MK4 in two places. One protected a small amount of non-KYC bitcoin in a single-signature Sparrow wallet. The other was one of the keys protecting a much larger amount of bitcoin in an Unchained collaborative multisig vault.
When the news broke, those two wallets suddenly looked very different to me.
The Sparrow wallet depended entirely on the Coldcard key. If that key were compromised, there was nothing standing between an attacker and the bitcoin. So I moved those coins.
The multisig vault was different.
The Coldcard was only one key in a 2-of-3 system. Even if I assumed the worst—that the Coldcard key was completely compromised—it still wasn’t enough to move my bitcoin. Another independently generated key was required.
So there was no panic.
I uploaded a new Blockstream Jade key to Unchained and eventually rotated the Coldcard out of the vault. It was an inconvenience. It required some transactions, some verification and a little bit of my time.
But it wasn’t a catastrophe.
That’s when the lesson really crystallized for me:
In the end, it’s not about the hardware. It’s about the system you use.
One of the misconceptions I had when I first got into Bitcoin was that self-custody meant eliminating trust.
It doesn’t.
Trust moves.
If you use a hardware wallet, you trust that its random number generator works correctly. You trust its firmware. You trust the cryptographic libraries its developers used. You trust that the device you received wasn’t tampered with somewhere along the supply chain. You trust yourself to properly record and secure the seed.
Even if every line of code is open source, you probably haven’t personally audited it. I certainly haven’t.
That doesn’t make self-custody a failure. It simply means that “don’t trust, verify” has practical limits for normal human beings.
The better objective, in my view, is to minimize required trust and eliminate single points of failure.
That is ultimately what attracted me to collaborative multisig.
I don’t have to assume Trezor will never make a mistake. I don’t have to assume Ledger will never make a mistake. I don’t have to assume Jade will never make a mistake. I don’t even have to assume that I will never make a mistake.
No single participant gets that much power.
That is a much more realistic security assumption.
We intuitively understand diversification when we’re talking about investments. Putting your entire net worth into one company is risky because one management team, one accounting scandal or one technological disruption can destroy you.
But diversification applies to trust too.
If my Bitcoin security depends entirely on one seed generated by one device made by one manufacturer, I’ve created a concentrated position whether I realize it or not.
Multisig changes the equation.
Different keys can be generated by different hardware manufacturers using different implementations and different sources of entropy. Those keys can be stored in different physical locations. A collaborative custodian can hold another key without having unilateral control over the funds.
Now several things have to go wrong simultaneously.
That’s the point.
The purpose of redundancy isn’t to prevent failure.
It’s to make failure survivable.
None of this means everyone needs multisig.
Someone holding $1,000 of bitcoin probably doesn’t need a geographically distributed collaborative multisig arrangement. The complexity might create more risk than it eliminates.
A good hardware wallet and a properly secured seed can be an excellent solution.
At the other extreme, someone storing a meaningful percentage of his lifetime savings in bitcoin should probably think differently. At some point the consequences of losing a single seed—or discovering that the device that generated it had a flaw—become large enough that redundancy is worth the additional complexity.
And for some people, self-custody may not be appropriate at all. An ETF or qualified custodian might genuinely provide a better security model than trying to protect seed words they don’t understand.
Bitcoin gives us choices.
The mistake is turning any one of those choices into a religion.
There’s an interesting philosophical tension here.
Bitcoin attracts people who value independence. We want to hold our own money. We don’t want banks deciding when we’re allowed to access it. We don’t want governments debasing it. We don’t want trusted third parties standing between us and our property.
I believe deeply in those ideas.
But sovereignty doesn’t mean doing everything yourself.
It means maintaining control.
Those are not the same thing.
A well-designed multisig arrangement can involve other people and companies while still leaving ultimate control with you. Nobody can unilaterally seize the bitcoin. Nobody can move it without the required quorum. And the failure of any one participant doesn’t destroy the system.
To me, that’s not a compromise of sovereignty.
It’s an expression of it.
I don’t know what ultimately happens to Coldcard after this incident. They’ve built an enormous amount of credibility within the Bitcoin community, and perhaps they’ll rebuild whatever trust has been lost.
I hope they do.
But I’m not particularly interested in declaring Coldcard good or bad. That’s not the lesson.
Coldcard is simply the hardware wallet that failed this time.
Someday it could be another manufacturer. Or a custodian. Or a software wallet. Or some vulnerability nobody has discovered yet.
That’s why I’m not replacing my Coldcard because I’ve suddenly decided another manufacturer is infallible. I’m replacing one component inside a system specifically designed to tolerate component failure.
There’s a big difference.
The strongest security model isn’t the one where nothing can go wrong.
Nothing like that exists.
The strongest security model is one where something does go wrong—and you’re still okay.
That principle extends well beyond Bitcoin. We diversify investments because companies fail. We maintain savings because jobs disappear. We buy insurance because accidents happen. We build relationships because none of us is entirely self-sufficient.
Resilience doesn’t come from predicting which thing will fail.
It comes from designing your life so that when something inevitably does, you survive it.
That may be the most important lesson I’ve taken from this entire Coldcard episode.
Don’t search for the perfect hardware wallet. Build a system that doesn’t need one.
Not financial or legal advice, for entertainment only, do your own homework. I hope you find this post useful as you chart your personal financial course and Build a Bitcoin Fortress in 2026.
Thanks for following my work. Always remember: freedom, health and positivity!
Please also check out my Bitcoin Fortress Podcast on all your favorite streaming platforms. I do a weekly Top Bitcoin News update every week on Sunday, focused on current items of interest to the Bitcoin community. Please check it out if you haven’t already. Also now on Fountain, where you can earn Bitcoin just for listening to your favorite podcasts.
Also, check out my books:
Follow me on Nostr:
npub122fpu8lwu2eu2zfmrymcfed9tfgeray5quj78jm6zavj78phnqdsu3v4h5
And finally, don’t forget my YouTube channel for inspiring shorts and all my podcasts.
If you’re looking for more great Bitcoin signal, check out friend of the show Pleb Underground here.
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.