Reddit recommended Coldcard for years. Nobody asked these questions. Now $38 million is gone.

I didn't lose anything in this hack. But it shook me enough to write this out, because I genuinely believe most retail buyers, including my past self, have no idea what questions to ask before buying a hardware wallet.

What actually happened

This wasn't a hack in the traditional sense. Nobody broke into a server. Nobody phished anyone.

A firmware bug introduced in March 2021 caused Coldcard's Mk3 devices to silently skip their hardware random number generator during seed creation. Instead of drawing entropy from a secure hardware source, the device fell back to software-based generation seeded by the chip's serial number and internal clock registers. Neither of those are secret. Neither of those are random in any meaningful sense.

The result: seeds that should have had 2^128 possible combinations instead had around 4.2 billion. A desktop computer can run through 4.2 billion combinations in about 20 minutes.

The attacker didn't guess your seed. They predicted it. And they did it to 500 wallets simultaneously in under half an hour.

The terrifying part: this bug lived silently in the firmware for five years. People who did everything right, bought hardware, went self-custody, stayed off exchanges, lost everything anyway.

The questions every hardware wallet buyer should ask

Part 1: The architecture questions

Does the wallet use a certified secure element? Not just "a secure chip" but one with independent third party certifications like EAL5+ or EAL6+. This means the chip's randomness has been mathematically verified to produce full entropy.

Is the firmware open source with reproducible builds? The Coldcard bug went undetected for five years partly because auditing complex firmware is hard. Open source firmware lets independent researchers verify what the device actually does during key generation.

Does a single point of failure exist anywhere in your setup? Even a wallet with a perfect TRNG generates a single seed. One seed means one point of failure. If that seed is ever compromised through a firmware flaw, physical attack, or supply chain issue, the attacker has everything.

What happens if your device is lost, stolen, or destroyed? Most people think about this in terms of seed phrase backup. But that backup is now your single point of failure. If someone finds it, they have your Bitcoin.

Part 2: My personal journey, not a recommendation

I'm sharing this not to tell you what to buy but to show how I thought through the decision so you can figure out your own path.

After going through Part 1, I started asking a different question entirely. Instead of "how do I protect my seed phrase," I asked "what if I didn't have one?" I also had a specific requirement that most people don't think about until it's too late: I needed non-KYC inheritance support. No custodian. No third party knowing my identity. Just a way to ensure my Bitcoin reaches the right people if something happens to me.

That ruled out Trezor and Bitbox for me. Neither had native non-KYC inheritance support built into the architecture at the time I was evaluating them.

That search led me to Cypherock X1 about two years ago. It uses Shamir's Secret Sharing to split your private key across five components. No single component holds a usable key. You need any two of the five to reconstruct it. Lose three and you're still fine. Someone steals one card and they have nothing. It also has Cypherock Cover, a non-KYC inheritance feature built natively into the product.

Again, I'm not saying it's the right answer for everyone. I'm saying it answered my specific questions. Figure out your own list of questions first, then find what answers them.

How to buy a hardware wallet that won't end up like Coldcard

Before buying anything, ask the manufacturer these questions and verify the answers independently:

• What secure element does the device use and what is its entropy certification?
• Is the firmware fully open source with reproducible builds?
• What is the entropy source during seed generation? Ask for technical documentation, not the marketing page.
• What is the single point of failure in my setup?
• Does the architecture distribute risk or concentrate it?

The crypto community has spent years telling people to get off exchanges. That advice is right. But we never followed it up with "here's how to evaluate what you're moving your Bitcoin into."

Do your own research. Read the technical docs. Ask the questions above. And don't let Reddit recommendations substitute for due diligence.

And most importantly, self-custody is still the way forward. Don't let anyone tell you otherwise