After some deliberation and customer feedback, we have decided to make our remaining stock of Coldcard devices (Mk3, Mk4 and Q) available for purchase again on BitcoinVN Shop.
Various clients – all of whom we consider experienced enough to understand the situation, based on direct conversations with them – reached out to us asking whether they could purchase Coldcard devices from our existing stock. They confirmed they were comfortable handling the necessary firmware upgrade themselves and were aware of the security issues affecting these devices.
We have also lowered the prices of these remaining units – you can find them listed, while stocks last, in the SALE category of BitcoinVN Shop.
Furthermore, while financial considerations are not a primary motivation here – we will not knowingly market insecure devices as safe, and providing our clients with the right guidance and tooling is one of our key responsibilities – BitcoinVN Shop has taken a significant financial hit from writing off the book value of stock we procured and imported from Coinkite.
As stated elsewhere on this blog in recent weeks, operating a physical hardware store to provide our client base with reliable access to genuine electronic and security devices in Vietnam is generally not a profitable endeavour for us. It requires regular subsidies from our parent entity “to keep the boat afloat”.
Our group views these subsidies as contributions towards strengthening the underlying network fundamentals. Widespread self-custody and the accessibility of secure self-custody solutions – on both the software and hardware side – are, in our view, among the primary drivers of the strength (or, in their absence, weakness!) and value of any given blockchain network.
However, we need to stop the financial bleeding before it impairs our ability to continue supplying the Vietnamese market with genuine devices. Any operation that relies on continued subsidies to exist is in a vulnerable position – and any sustainable operation must be able to carry itself financially through its own efforts and value exchange in the marketplace.
Now, to the positive things:
Once the firmware has been upgraded, a Coldcard can still be one of your devices of choice for a properly configured multivendor multisig setup.
And while we strongly recommend replacing a compromised or lost key as soon as humanly possible, we are aware of clients who continued using a Coldcard in an MVMS setup well beyond the public disclosure of the key-generation vulnerability – precisely the kind of situation MVMS is supposed to withstand. In a properly configured 2-of-3 setup with independent keys, one compromised key alone cannot spend your funds, and one inaccessible key does not lock you out.
With that said, given the history surrounding Coldcard’s key-generation vulnerability, we strongly suggest only buying a Coldcard at this point if you feel highly confident in your choice. For newcomers or first-time buyers, this is likely not the right tool.