The Unsafe Box

Reader,

You are new to Bitcoin. You have questions. You seek answers. You do what every normal human being does. You go to YouTube.

There on the screen your eye catches a thumbnail with a catchy title and a human face. The video is about how a device can keep your funds safe.

You watch it. You watch a few more. You take notes. You poke around social media. The feed feeds your curiosity.

You go to a website. You type in your name. Your address. You pay with your card or your coin. The box that secures your coin is on the way, and little did you know that your name and residence now reside on the lists of the manufacturer, the shippers and the analytics companies, in addition to your bank.

And then you see the news. ColdCard. The most respected box in the room. Over a hundred million dollars in coin swept out of the very box the faces told you to buy. The box you put your coin in. The coin is your life savings. The savings of your children. Your grandchildren.

The faces tell you the box is safe.

They always told you the box is safe.

You sit in the worry and you question if your funds are safe. Every bead of sweat drops with the weight of loss. You open your box. The coins are there. The heaviness lifts from your chest and your mind feels the release. And the moment comes back to remind you that you were a lucky one. Fortunate let you be.

For many others, it wasn’t the case. Life savings gone.

And then in the same week, the faces return with a new message. Use this box instead.

And you almost believe them. Believing is easier than starting over. Easier than admitting the ritual itself was the flaw.

So stop. Look at what happened to ColdCard. Not the headline. The plain words.

Five years ago the makers changed one piece of code. The change routed the making of your secret away from true randomness and into something weaker. A number a computer could guess. The difference between a lock and a drawing of a lock. The code was open for anyone to read. It sat there for five years. Nobody read it. Or nobody who read it understood it. Which for you is the same thing.

Then one morning in July someone guessed. Twelve hundred ColdCards emptied in forty one minutes. Less time than a lunch break. And the faces on the screen, the ones with the podcasts and the affiliate codes, they could not have warned you. They never read the code either. They trusted. And they sold you their trust dressed up as knowledge.

There is a word for doing the same thing over and over and expecting a different result. The word is not security.

And ColdCard is not the story. ColdCard is a chapter. Read the ledger.

Ledger, 2020.

The customer list leaked. Two hundred and seventy thousand names and home addresses on the open internet. Then came the extortion letters. Pay us or we come to your house. The device did not fail. The list did. The list you joined at checkout.

Trezor.

Twice. Sixty six thousand emails through a support desk in 2024. Fourteen thousand names, phone numbers and home addresses through a shipping partner this very month. The phishing mail arrived inside the week, asking the frightened for their twenty four words. And then it happens again in 2026.

Safe Wallet, 2025.

Not a cheap operation. Audited, multisig, institutional. One developer’s laptop compromised, and a billion and a half dollars walked out of Bybit through it.

Atomic Wallet, 2023.

A hundred million dollars gone from a wallet that promised safety in its name.

Different companies. Different countries. Different failures. One pattern. You trusted a party you could not inspect, and the party failed, and the faces moved on to the next sponsor.

Because the code was only one door. Count the others. You trust that no one touched the package in the mail. That there is no back door in the chip, put there by malice or contract or sloppiness. That the firmware does what the paper promised. That the customer list never leaks. Every one of those doors has already swung open somewhere. You wanted to protect your money. The first thing the box did was announce you.

Someone will tell you the answer is Bitkey. It’s Block. A public company. Jack’s company. A ticker symbol. But look at your hands. You are performing the same ritual. Name. Card. Address. Database. Shipping label. Firmware you will never read. You don’t know what you don’t know, and no stock exchange audits fate. A public listing is a promise about accounting. It is not a promise about your keys.

Now imagine a different way.

There is a laptop in your closet. Old. Ordinary. You wipe it clean. You install a fresh system and then you never let it touch a network again. You put Bitcoin Core on it, software beaten on in public for seventeen years by people with every incentive to break it. Or a cheap phone bought with cash, one of ten thousand identical phones that passed through that store, running an open wallet the world has already tried to break. You make your keys on that machine, offline, in the dark. You sign there and carry the signed transaction across the air by QR code, to a machine that talks to the world but never sees a key.

What have you told the world? Nothing. You are on no list of coin holders. No shipping label ever tied your name to the word wallet. The machine on your shelf is a laptop. There are a billion of them. It hides you the way the herd hides the animal. A ColdCard in a drawer tells anyone who finds it exactly what it is and exactly what to do to you. The laptop says nothing.

Yes, it takes practice.

You will verify a download and it will feel tedious.

You will move a small amount first and you will sweat.

The second time it takes two minutes. This is a skill on the order of parallel parking. It asks a little confidence of you. People secured coin this way for years before a single box was ever sold.

I am not calling for bans.

The market sells what it sells and you are free to buy what you like.

But there is a difference between a product existing and the faces holding it up, month after month, breach after breach, Ledger then Trezor then Safe then Atomic then ColdCard, as the responsible standard. It is not the standard. It is a mailing list of targets stapled to a machine you cannot inspect. The record is the argument.

So when the faces return with the next box, ask them one question. Did you read the code?

They didn’t.

Nobody did.

Stop promoting the box.

Teach the practice.

Rare

block height 963 120

Note: If you have a moment, check out this podcast with Saif and Heavily Armed Clown. They talk about DIY Bitcoin storage.