My friend has a coldcard and is in the process of moving funds to a new seed. When they generated a passphrase for this new wallet, they used only 4 words of a diceware list, and transferred some funds to it. Only afterwards did they find out that they really should have used 6 words. Since the 4-word wallet has a transaction history, would reusing any/most of those 4 words in the new 6-word wallet reduce entropy for a brute-force attack? (i.e. since the hacking algorithm would find the 4-word wallet quickly, would it then be more likely to search for 5+ word wallets containing those original 4 words?)

What is the l best way to start buying Bitcoin? There are several exchanges and apps. I'm not sure where to begin. Any advice would be welcomed. Thanks in advance!

I just find it so fucking weird that after this whole hacking event cold card isn’t being held responsible to reimburse people. I mean you sell a product on the promise that it’s secure and it’s really not that sounds like fraud to me. The people that got hacked should come together and get lawyers and sue them. I’m not sure how this all works or if they are legally held responsible for a hack, but it seems like they should be, but it’s still gray area I guess

Disclosure up front: ENTROPÍA is built by 12 Palabras, which is why I’m posting from this account. It’s free and open source; we’re not selling anything.

I kept seeing the same sentence: “I have the seed.” That answers one question, but not whether the passphrase is recoverable, wallet metadata survives, two backups share the same fire domain, the root email and password manager form a loop, or another person could follow the plan under stress.

ENTROPÍA uses aliases to map a Bitcoin wallet, devices, backup copies, email, security keys and trusted people. It then simulates phone loss, loss of the primary location, a missing security key, owner incapacity, possible seed exposure and root-email compromise. Each critical system is reported as available, blocked, unknown or compromised.

It never asks for a seed, passphrase, address, xpub or balance. The analysis runs in the browser, and an optional vault is encrypted locally.

The important limitation: it cannot prove that words written on metal are correct, that a device is genuine or that an off-site location is actually independent. A declared recovery path is not evidence; a controlled drill is.

The beta UI is currently in Spanish and the code is public: https://12palabras.github.io/

I’d genuinely like this model torn apart:

1. Which Bitcoin-specific failure mode is missing?

2. Is an aggregate summary without aliases or topology safe enough for asking for help, or would you still share nothing?

3. Would you use a browser-local tool for this, or only a downloadable offline build?

Please use a synthetic setup if you test it. Don’t post wallet data here.

I’m sorry but everything seems to be getting compromised and hacked rn. I’m sure I’m not the only skeptical one right now but I figure I ask for some input. Thanks

Edit: I do cold storage but rethinking everything since these hacks continue

I have been looking at the possible failure modes of lightning while a possible fork (however short) could happen. I don't want the hassle of watching 2 separate chains while this plays out. Any precautions that you are taking or am I just being paranoid?