So has the bitcoin been recovered despite the bounty? At least let the money be recovered before recommending it to another company.

It is just over for Coldcard.

Those that their coins was stolen can offer the bounty instead. Coldcard market share among the crypto hardware wallets is 1% which is very small.

I think they are looking to following similar directions as other platforms had done in the past, a recent example is the bybit hack. Bybit placed a bounty on the recovery of the assets which was around 10% of the total recovered amount and within few days there was a track of around $40 million by some on-chain analysts. But until now almost half of the stolen assets still is yet to be recovered or tracked. Even though exchanges are actually helping to freeze the address linking to this hacked addresses



Yes I believe too that it is over for coldcard even if they get to recover anything they won’t be trusted again, there case is just similar to MtGox and FTX in terms of trust even if there is recovery no one is going back there.

The owners cannot come out to place bounty on it because it has to be an unanimous decision and do we even know the victims only coldcard can place the bounty themselves. But they are not doing it, if not most victims would be glad to lose just 10% of their asset to the bounty if they can help to recover their assets

Prevention is better, but most of them do not know they will be hacked until it happened. According to what I have read about the Bybit breach was that most of the coins were later hard to trace, Bybit was unable to recover more than 90% of the ether that was stolen by the hackers. The hackers that stole the ethereum were smart.

I may not be really convinced that despite the bounty placed, it is still under probability that even if discovered they may not come to the public and declare what has been seen, come to think of it from another perspective, whereby there is an insider clue that tend to pretend they don't know anything concerning this and awaiting for the reward after the discovery, let's see how the game goes with the bounty placed.

A good bounty can definitely increase the chances of getting information, there are always those that know, but don't say until they perceive a motive to say.

But the toughest portion is determining whether or not the information is genuine or the one trying to gain an easy buck. In this case, there can be a number of bogus reports.

This happens following a security incident and I believe more companies will want to consider this in their future. It will not fix all the problems but it will definitely contribute in finding the cause, and at the very least make people feel that the team is taking the matter seriously as well.

This kind of relentless effort by the BTCpay team in trying to recover those stolen funds and to get hold of the attackers is really commendable; it strongly suggests that the team has their merchants at heart despite the deed already being done. In other hands, I think this will also boost users confidence in the team regardless and further increase their belief in the team's quick action or response.

I can't speak for them, but if it were me, as long as the code is verifiable and I can build and test on my own, I think I can try to use them a second time. Probably won't store too much though. But anyway, this depends on the scale of business and whatnot.

Maybe this will become common for other business too in the future. Especially if malicious people can pentest more easily. They need more incentive to encourage people to report and patch bugs instead of exploiting them.

Thinking about how much larger the scale of the Coldcard hacks were, they could at least offered some white hat bounty for anyone that able to trace the fund and help recover it.

Any white hat activity related to Coldcard that I know of are independent white hat volunteer.

Even a promise to give several percent bounty after the funds recovered is better than simply letting their users do their own thing e.g filing police reports and insurance claims.

Their users don't even know if insurance would cover faulty hardware wallet incident because some insurance exclude it from the claim.

BTCPay on the other hand, seems very committed to make the victims recover their money.

Well, it's the right thing to do, otherwise some clients will totally distrust them, especially those who got affected.
This attempt to recover the stolen Bitcoin is commendable, but it is not going to be enough to fully restore their client's trust. They need to do more work than just issuing a large bounty.
I think they also need to allocate more funds to create a more secure system, so their server won't show any vulnerability to hackers and incident like this won't happen again.

Should ColdCard do the same bounty? No, I don't think so, the amount was just too big! Imagine the amount they need to allocate if they aggressively offer the same bounty as BTCpay. They'd probably have to put a couple of annual revenue in line for that.