Review: Coldcard Mk.3 hardware wallet

The Coldcard Mk.3 from the Canadian Coinkite is a hardware wallet that seems to be increasing in popularity. The Coldcard has distinctive features that enable a higher level of security than with other hardware wallets, but at the expense of ease of use. Less suitable for beginners, but perhaps even more interesting for advanced users. Read our review here.

One of the major challenges you face as a bitcoiner is securing your bitcoin wallet. The use of a hardware wallet is often recommended, but that is not the end of the matter.

Hardware wallets differ from each other in design and the way they work. Most hardware wallets protect against the greatest dangers, but nevertheless there are often attacks that are theoretically possible. If you are looking for the highest degree of security, this may not be optimal.

Coldcard Mk.3

The Coldcard Mk.3 from Canadian manufacturer Coinkite is an increasingly popular choice among hardware wallets these days. It is an open source hardware wallet with a price tag of around ??100 that offers just a little more than competing hardware wallets in terms of security.

That’s not because the Coldcard hardware is necessarily better than other hardware wallets, but because Coinkite seems to be a little more serious about potential risks than other manufacturers.

Packaging & Exterior

With the Coldcard, the emphasis on safety starts with the packaging. It is designed to prevent tampering with the device.

Coldcards are therefore not shipped in a box, but in a transparent plastic bag that cannot be opened without damaging it. The Coldcard itself is also made of transparent plastic, so you can look through it to see if the device has been tampered with.

There is a barcode with a number on the packaging. If everything is in order, the Coldcard shows the same number at the first start-up. There is a green light on the front of the Coldcard that indicates whether the device contains the official hardware.

Even if you have owned the device for a while, all kinds of attacks are theoretically possible. For example, someone with physical access could secretly modify or replace the Coldcard. The Coldcard protects against this with an extra pin code. With correct input, the Coldcard confirms during the login screen with two secret words that only you know and which should always be the same, so that you know that it concerns the same device.

On the Coldcard itself, it is indicated under the housing where the secure element chip is located, on which the private keys are stored. You will find the chip next to the letters ‘SHOOT THIS’ . If you ever don’t trust the Coldcard anymore, you can break the chip to irreparably destroy the data.

 

Cold wallet

Like other hardware wallets, you can connect the Coldcard to a computer, but there is always an inherent risk in theory. That is why the Coldcard can also be used ‘air gapped’, without ever being connected to a computer or the internet. This makes it impossible for hackers and malware to access it. A bit like a ‘ cold wallet’ – hence the name.

You use the built-in SD card reader to exchange data between the Coldcard and a computer with an internet connection. Via the Coldcard you can put a public key (xpub) of a bitcoin wallet on an SD card, after which you physically remove the SD card from the Coldcard and put it in a computer. You can then import the file via a wallet application on the computer to view the bitcoin wallet.

A transaction works about the same, but in reverse. You then save the transaction on a computer via a wallet application as a Partially Signed Bitcoin Transaction (PSBT) in a small file that you put on the SD card. You manually place this in the Coldcard and use it to sign the transaction. Then you remove the SD card from the Coldcard and put it back in the computer and import the signed transaction into the wallet application to offer it to the network afterwards.

It requires extra actions and is a bit cumbersome, but not having an internet connection is still the best protection against threats coming from the internet.

Open source

How reliable are hardware wallet manufacturers? Are there no bugs that can be exploited or maybe manufacturers have deliberately built in backdoors ? This is often impossible to check because many manufacturers of hardware wallets do not make their code transparent. It is usually a strategic choice to provide malicious parties with as little information as possible.

Coldcard, on the other hand, opts for a different strategy. Coldcard is completely open source and peer reviewed . All code is therefore verifiable and that can remove a lot of uncertainty. Potential attackers may also have something to hold on to, but it means you have less confidence in the manufacturer.

Additional features

Coldcard is full of extra features. For example, you can create multiple wallets with the help of extra passphrases , including a fake wallet that you can access with an alternative ‘duress pin code’ in the event of a robbery or other emergency. You can also set a special pin code to completely erase the device in one go in the event of an emergency. In the event of theft, the Coldcard will automatically block after 13 incorrect PIN codes.

In the menus of the Coldcard you will find options for making encrypted backups or paper wallets , interacting with the SD card and requesting information such as bitcoin addresses. For those who do not trust the random number generator , there is the possibility to add more randomness with the help of a dice. Coldcard supports Multisig and also CoinJoin via Wasabi wallet.

Coldcard only supports bitcoin and no other cryptocurrencies.

No official software

There is no official wallet application for the Coldcard, but several popular wallet applications such as Bitcoin Core, Electrum, Wasabi and Bluewallet support it. Coldcard also works in combination with software such as BTCPay and Umbrel.

Usage

Coldcard takes the ‘Don’t trust. Verify.’ clearly to the heart and probably that appeals to many bitcoiners. The downside is that Coldcard is therefore a bit more complicated than other hardware wallets and therefore especially suitable for the slightly more experienced user.

Above: The Node Case shows the use of the Coldcard

Novice bitcoiners may not appreciate the seemingly low-tech design and old-fashioned user interface . The screen is quite small and offers little space for text and explanation, which, despite the concise explanation, often leads to a lot of scrolling.

Coldcard also assumes quite a bit of prior knowledge. It is delivered loose in a bag without documentation, without SD card and a USB cable is also missing. The Coldcard’s menu is full of options that beginners may not immediately understand what they are for or how they work. There is an extensive online manual and there are tutorials via Youtube, but they do assume some basic knowledge of Bitcoin.

The extra steps that come with it when you use the Coldcard via an SD card make it safer, but of course also a bit more cumbersome.

Moreover, the operation of the device is not optimal. Coldcard has a numeric keypad, which is nice, but the buttons are not ideal and you have to press them again every now and then. The hardware also sometimes feels a bit slow. That sometimes results in a few seconds of waiting, but more annoying is the slight delay when scrolling through the menus and explanations.

Conclusion

Coldcard is therefore probably best suited for more experienced bitcoiners, who have been on their way for a while and have enough knowledge to appreciate and use the additional security measures.

For example, Coldcard could be of interest if you’ve already tried one or two hardware wallets and now feel the need to take the security of your long-term savings to the next level. Then the additional complexity is probably of added value.

Even if you work professionally or are planning a complicated setup for other reasons, where you have to exclude as many risks as possible, the Coldcard offers more options than many other hardware wallets. The fact that Coldcard is open source can be an added value and provide certain guarantees.

To take full advantage of it, however, you need a certain level of knowledge. If you have that, the Coldcard is perhaps the most secure hardware wallet at the moment. You sacrifice ease of use for this, but in this case that is not a bug but a feature.

If your knowledge level is lower, Coldcard is still a safe and great choice, but perhaps not necessarily more secure than hardware wallets from other brands that are slightly more accessible and more plug & play .

Advantages

  • High degree of security is achievable
  • Much care and attention to potential risks
  • Air gapped
  • Open source
  • Broad support by wallet applications
  • Many possibilities

Cons

  • Less user-friendly
  • No supplied accessories or manual
  • Not a luxurious look
  • Small screen
  • Operation is not optimal

For more information about the Coldcard Mk.3 or to order, please visit the official website.

s: ghalfacree, license CC BY-SA 2.0

Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *

© 2024 Cryptocoin Budisma.net