Did Bitcoin Change Forever After the COLDCARD Hack? | Zach Herbert | BFM273

Zach Herbert is Co-founder and CEO of Foundation, building Passport Prime, an open-source device that moves your digital authority onto dedicated, secure hardware:one device built to be held, verified, and trusted.

› https://x.com/zherbert

PARTNERS

🔐 The Bitcoin Way is your personal Bitcoin security team. Schedule a free, 30-minute consult: http://www.thebitcoinway.com/bram?utm_medium=podcast&utm_source=partner-bram-kanstein

🤝 Firefish is the open market for Bitcoin-backed loans. Find offers and get 30% off your first loan’s fees with code BRAM: http://firefish.io/?ref=BRAM

PRODUCTS I ENDORSE

› Get 10% off a Bitaxe open-source Bitcoin home miner using code BRAM at https://shop.powermining.io/?ref=BRAM

› Heat your home and Earn Bitcoin with Heatbit - Get 5% off with code BRAM https://heatbit.com/?ref=BRAM

› Stamp Seed: The safest way to backup your hardware wallet - Get 15% off with code BRAM at https://stampseed.com

🔔 SUBSCRIBE TO GET NOTIFIED

› https://youtube.com/@bramk⁠⁠

› https://x.com/bramk

🕑 TIMESTAMPS

00:00 - Coldcard exploit, what likely happened

02:29 - Negligence vs conspiracy theories

04:54 - Why basic entropy checks failed

06:30 - Source available vs open source

08:13 - Closed source scenario, why panic

09:25 - Why FOSS still wins long term

12:58 - Ledger, audits, and verification limits

16:30 - Why this bug was the worst case

19:23 - AI changes wallet threat models

21:56 - Best practice, rerun audits per model

24:56 - Self-custody backlash, convenience vs control

32:34 - Designing happy path vs advanced mode

36:54 - Do you need a phone?

37:45 - QR air gap limits and Quantum Link

57:04 - Hardware wallet cooperation, not infighting

1:04:24 - Biggest takeaways for average users

ℹ️ EPISODE SUMMARY

Bram Kanstein and Zach Herbert discuss the Coldcard entropy failure and why it smells like negligence, not a nation state plot. They confront how “don’t trust, verify” often stops at a slogan, even when seed generation is the whole game. They map the trade-offs between closed source, source available, and true FOSS, especially now that AI can audit firmware fast. Zach reveals why Foundation moved past pure QR air gaps, and how Quantum Link uses QR to bootstrap an encrypted Bluetooth tunnel. They zoom out to the real damage: self-custody adoption, UX vs hardcore OPSEC, and an industry that needs a rapid response loop.