Self Custody Is Not Dead with Stacie Waleyko

— Cold Card hardware wallet vulnerability affecting devices with firmware post-2021: a software bug caused the device to fall back from a secure randomness source (Trezor cryptographic library) to a weaker LibNG library, reducing entropy from 256 bits to a brute-forceable key space.

— Attackers likely used open-weight AI models (e.g., Kimi K3) to grind through the reduced key space and sweep affected wallets; attacks are ongoing.

— Cold Card's licensing change from GPL to CC removed access to the battle-tested Trezor library, forcing reliance on a replacement library of unclear provenance.

— Open-source security is a double-edged sword: code transparency enables community review and AI-assisted auditing, but also allows attackers to find vulnerabilities.

— Multi-vendor multisig is recommended as the near-term practical solution; covenants and vaults are longer-term improvements that could add time-locks and spending rules to prevent instant sweeps.

— Self-custody remains viable and worth defending, though non-technical users should seek assistance from established providers (Casa, Unchained, BitKey) offering emergency key backup.

— If you hold Bitcoin in a Cold Card purchased or updated after 2021, move those funds immediately to a secure address, ideally via multi-vendor multisig setup (e.g., Cold Card + Trezor + Ledger, or work with a provider like Casa or Unchained for emergency key backup). Do a small test transaction first and seek community help if unsure.

— Do not panic-sell to exchanges; temporary refuge there is acceptable while you plan a proper move.

— Verify any hardware wallet's entropy source and audit status before use.

— The Bitcoin Dev Project and volunteer red teams are auditing open-source Bitcoin projects; prioritize wallets that have undergone recent security assessment.