I would assume that the majority of people don't have the technical knowledge to properly setup an air gapped computer. A small mistake could compromise your setup entirely, which makes it risky. So unless you know exactly what you're doing, it's better to just stick with a hardware wallet and use a strong passphrase.

They are not open source wallet and their hardware wallet source code, including firmwares are only available and verifiable. It's different than reproducible that is only for open source hardware wallets.

https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=coldcard



Security vulnerability was found and reported two years ago.
https://www.youtube.com/watch?v=oj_W3xOlt6U

That wasn't Coldcard's fault. That happened because the person used only one die roll in the creation of his seed and wallet. If the recommended number of dice rolls for enough entropy is 100, the wallet that user created was significantly less secure and was therefore easy to brute force. The same thing would/could have happened regardless what you used for the creation of such a seed. What Coldcard could have done better in that case is to show a warning, informing the user that they are supposed to enter many more dice rolls to increase the security of their keys.

From what I have learned, air gapped is considered one of the most secure way to store Bitcoin, on par with a hardware wallet. However, setting it up requires you to know exactly what you are doing. It's not as simple as using a hardware wallet, so most of the risk comes from user error rather than from the method itself.

To set up air gapped properly, you need clean operating system. You also need to make sure wifi, and bluetooth are completely disabled at the hardware level, and that any device used to transfer data is trustworthy...Even a small mistake during the setup process can cost you dearly.

As mentioned, the risks may lie with the user and the setup process.

Yes, I have started seeing some people become skeptical of hardware wallet. There's nothing wrong with that, because skepticism is necessary to protect our asset.

However, it would be incorrect to assume that all other hardware wallet on the market are no longer secure simply because of what happened with Coldcard. Each wallet has its own codebase, design, and security model.

I also believe that choosing a wallet should be based on many factors such as transparency, security audit and security track record, not just on brand or age. Ledger is also a long established and well known wallet brand, yet it is arguably worse than some newer wallets.

So we see now people who are scared of using their hardware wallets, don't think of it in general that the other HWs are unsafe. All of them are not perfect but you see how they eliminate the risk for us users through firmware updates and increase the protection through it. User intervention is also important and make ourselves updated and informed from time to time with issues like this, I still believe in the reputation that the known brands have.

It was loved and liked by the community before, despite it being closed source, but not until they had their Ledger Recover and the series of hacks of their customers' data had been leaked.

This is above basic users' technical knowledge. What people would usually say is to completely avoid coldcard from this point. But I think that this is also going to make everyone who has got the basic knowledge to pursue them to search for more means of securing their wallets.

That's true although the scam has been there in different means aside from fake emails intend to phish and real mails sent to the users where they've got the info through the data breach.

It is just to be better equipped with better security knowledge than to try to play it safe and still have loopholes that can be manipulated anytime.

We have learnt a great deal from this coldcard incident and I must say I may try on my own to explore safer options that includes security features and diversity strategies Incase a similar or new kind of coldcard issue arises again.

You are correct to point this out but I don't think it is reasonable to expect normal users to know these kinds of things. Maybe when we were promoting hardware wallets as the best solutions to the general public we have together made a mistake by not sharing the issues that could happen with it. I have had these wallets for years, and I consider myself a bit more security conscious than the average person but nothing special. I have never considered that my wallet could be hacked this way even if it was a very obvious possibility, I have considered all kinds of offline hacks, attacks by the vendor or through the internet but not a complete failure in the random generation where you are defenseless if you have set up the wallet the right way. I also don't think the regular advice was ever that you should in all cases add a passphrase to a hardware wallet, it was suggested only in some specific cases to deal with some sort of attacks or to add more protection. I think one lesson from this would be that adding passphrases to wallets should be a regular thing, and it does not even have to be extremely long but it would provide you enough time to survive the first wave attacks and get your keys out before some kind of brute force attack is successful against it.