I am new, but I have finally decided to get involved. During Covid I was strongly offered to buy a bitcoin but I didn't have $20k to lose neither did I have any trust in it back then. I'm thinking to give it a try and buy 1btc for a start. Any advice you could give to a newbie? Is it even a good time to buy it? I'm not looking to make a big spread unless I leave it for a few years.

ColdCard used a python library named "ngu" for "Number go up"
ngu.hash
ngu.secp256k1
ngu.random
ngu.codecs
ngu.hdnode
ngu.hmac

def generate_seed(): # Generate 32 bytes of best-quality high entropy TRNG bytes. seed = ngu.random.bytes(32) assert len(set(seed)) > 4 # TRNG failure # hash to mitigate any possible bias in TRNG return ngu.hash.sha256d(seed) 

The funny and sad irony is that all of these users actually saw "Number go zero"...

They (ColdCard/CoinKite) need to go belly up and liquidate all of their holdings... and distribute them back to victims.

WHITE HAT DRAINS OF COLDCARD WALLETS BEGIN

The white hat wallet drains of exploitable COLDCARD wallets are now underway, according to @coinjoined

If your COLDCARD was compromised, do not destroy the device. It could be needed if a recovery process is established.

If a white hat secures your coins before you move them yourself, any future claim may depend on proving ownership with your device and KYC records.

Users without a way to verify ownership could face a much harder path to recovery.

Link: https://www.ledger.com/blog-coldcard-incident

TL;DR
Ledger explains that the recent Coldcard incident was caused by a firmware bug that weakened the randomness used to generate recovery seeds, making some seed phrases predictable to attackers.

Updating the firmware alone is not enough if your wallet was initialized with affected firmware. Users must generate a brand-new seed phrase and move their funds to a new wallet. Reusing the old seed on another device does not fix the issue.
Ledger says this vulnerability is specific to the affected Coldcard firmware and does not affect Ledger devices.

The incident is a reminder that secure seed generation is critical for any hardware wallet, and users should keep firmware up to date and follow good security practices.

This is a tough week for bitcoin community. Wishing speedy recovery of funds for everyone involved.

Lessons learned for the rest:

1. Hardware wallets - were always a vector of a possible attack. Just like you can't trust 100% your ISP, your PC and your phone, same goes for hardware wallet.

2. To protect yourself, always use a passphrase. It makes these kinds of exploits million times more difficult, if not impossible.

3. If you have any significant funds, you must have a passphrase. If you don't, you haven't done your homework.

4. Coldcard is the only wallet that was impacted by the seed-generation issue, you are perfectly fine if you didn't create a seed on Coldcard. Trezor, Ledger and other wallets don't share the same firmware as Coldcard.

5. I wouldn't recommend Coldcard at this point but the device itself, as far as we know, is still perfectly fine but you need to realize that company is most likely going out of business, so won't be getting much support or updates from them after this.

6. Apple, Microsoft, Meta, Oracle and other firms had bugs in their code that allowed people to steal stuff. Coinkite had a bug in the code as well that allowed a nasty exploit. Bitcoin doesn't have a bug in its code.

7. Self-custody is not for everyone. If it is easier for you to let someone else manage keys, you can/should explore those options. But companies and governments fail and it happened many times in the past as well, so nothing in life is 100% guaranteed.

Needing to set up a cold wallet. Any advice of what to be looking for?