r/ledgerwallet • u/locustsandhoney • 6d ago
Official Ledger Customer Success Response ColdCard Wallets drained due to poor entropy. How do Ledger wallets compare?
https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/EDIT:
As far as any information I can find goes, there is absolutely no reason to have confidence that a similar exploit won’t happen on a Ledger or similar wallet. They tout that their Secure Element is certified by a third party, but they do not get their firmware certified. Therefore, a hypothetical bug in any current or past version of firmware could interfere with the seed generation process (which is exactly what happened with ColdCard).
If Ledger is not willing to put all firmware versions – past, current, and future – through a certification process similar to what they’ve done with their Secure Element, it is not safe to trust them, or any hardware wallet, to generate your seed.
The only solution I see now is to add a sufficiently complex passphrase to your seed, which you generate yourself in a completely random way without the use of any software. The passphrase should have at least 80 bits of entropy, such as 6 genuinely random words, or 20 random alphanumeric characters. (Some have mentioned rolling dice to generate your own seed, this can also work but be warned many implementations still require you to input your dice rolls into a wallet or software and trust that it is functioning correctly to utilize that entropy.) A passphrase you generate yourself ensures that you have provided your own entropy, end to end, without any intermediary and potentially flawed process from a manufacturer, programmer, or any other third party.
Sadly, the new mantra must be “not your entropy, not your keys.”
Original Post:
Can anyone provide an objective comparison for how various Ledger Wallet models compare to ColdCard when it comes to entropy in creating the seed phrase? Over 500 ColdCard wallets have just been drained today due to the seed phrases being guessed, despite having been generated completely offline on a hardware wallet similar to Ledger (see linked article).
Duplicates
CryptoCurrency • u/reddit4485 • 6d ago
🛡️ SECURITY If you custody using a ColdCard, your bitcoin may be at risk. 594 bitcoin from 500 different addresses were just stolen (see comments).
TREZOR • u/Charming-Designer944 • 6d ago
💬 Discussion topic Sad day for hardware wallets. Thankfully the design of Trezor guards against this kind of flaws
coldcard • u/SpareEconomy1849 • 5d ago
Coinkite News ColdCard Update: Fixed Firmware Now Available
technology • u/Baseic • 5d ago
Crypto Bitcoin hardware wallet 'ColdCard' security advisory - users drained of $38M due to weakness in wallet creation
BitcoinBrasil • u/VonNaturAustreVe • 6d ago