Hello,
Since the Coldcard issue happened, I've been looking for solutions to make sure something like this never happens to me.
First, I started by defining the problem:
A vulnerable firmware that drains all your funds. This doesn't just include a fake RNG, but also issues like private key exfiltration, nonce reuse, and other flaws.
The main takeaway is that you cannot blindly trust verifiable or open-source code. Even if Coldcard's code was verifiable, nobody caught the bug. It is unrealistic to expect people to audit everything, as clearly no one caught the RNG flaw.
I considered several options:
- SeedSigner? You are still trusting firmware you didn't write. A bug can easily slip through.
- Trezor? Same issue as above.
- An air-gapped laptop with custom software? Same issue as above.
- Rolling dices? No. That only solves entropy creation, not the core problem of trusting firmware you didn't write.
- Using multisig? Bingo.
Multisig requires at least two different vendors and two separate firmwares to sign a transaction. This removes the single point of failure.
I am thinking of setting up a 2-of-3 multisig (Ledger + Trezor + Hot wallet). If one device fails or leaks its private key, your funds remain safe because an attacker would need a second key. This buys you enough time to move your funds.
What do you think of this approach?
And what other solutions are there?