How Bitcoin Hardware Wallets Supported Users During the Coldcard Crisis

As there’s no single best bitcoin hardware wallet, only different features and trade-offs, their manufacturers also vary in how they have supported their customers following the Coldcard crisis. Fast, clear, and helpful communication might be the factor that protects your funds during similar emergencies.

Teams differed in speed, clarity, helpfulness, tone, bragging level, and whether they kept following up on the matter days and now, weeks later. For example, the manufacturer of Bitkey, U.S.-based Block, which was part of the initial Coldcard investigation, was among the first to warn its users and the broader community about the exploit, and was soon followed by Canada-based Blockstream, the manufacturer of Jade. Meanwhile, for some others, it took more than a day to post on X. One of the leaders of the industry, Europe-based Ledger, informed its followers on X after around 14 hours since the crisis erupted.

However, the fastest responders were not always the most thorough.

In either case, among the patterns that emerged across the wallets’ communication, there was a heavy emphasis on how entropy is generated, as teams were trying to differentiate themselves from Coldcard. Also, some teams highlighted support for user-generated entropy as a way to reduce trust in the device’s own random number generator (RNG).

There was also a different approach to how closed- and open-source device manufacturers have been trying to calm their users. Devices with stronger open-source credentials (Passport Prime, Trezor, Bitbox, Keystone, Blockstream Jade) leaned into verifiability, while more closed-source designs (Ledger, Tangem, Ngrave) leaned more on certifications and audits.

Additionally, not all teams discussed multisignature (multisig) setups as a structural defense, especially when it comes to multi-vendor setups, while several companies used the moment to push broader self-custody best practices in general.

As for the follow-ups, Trezor, Bitkey, Bitbox, and Blockstream Jade stood out as more active ones, providing additional information, while Ledger, Tangem, Safepal, and Ngrave were relatively less active in that regard.

Also, not every team gave practical migration advice for affected users, and Foundation (the manufacturer of Passport Prime), Bitkey, Ellipal, Jade, Bitbox, and Trezor stood out for actionable guidance. Meanwhile, Foundation and Trezor also communicated about their additional security hardening measures. Ngrave and Ellipal seem to have used the strongest promotional language, such as “world’s safest,” “leader of air-gapped,” etc.

Now, let’s take a quick look at each of the wallets’ communications. They’re ranked by their first post on X during the crisis.

To conclude, the Coldcard crisis has not only taught hardware wallet manufacturers new security lessons but, hopefully, their communication will also improve even further when/if the next crisis hits.

Bitcoin.com News has contacted all these teams for comment and will share their responses, should they be forthcoming.