Did Bitcoin Change Forever After the COLDCARD Hack? | Zach Herbert | BFM273

Zach Herbert is Co-founder and CEO of Foundation, building Passport Prime, an open-source device that moves your digital authority onto dedicated, secure hardware:one device built to be held, verified, and trusted.› https://x.com/zherbertPARTNERS🔐 The Bitcoin Way is your personal Bitcoin security team. Schedule a free, 30-minute consult: http://www.thebitcoinway.com/bram?utm_medium=podcast&utm_source=partner-bram-kanstein🤝 Firefish is the open market for Bitcoin-backed loans. Find offers and get 30% off your first loan’s fees with code BRAM: http://firefish.io/?ref=BRAMPRODUCTS I ENDORSE› Get 10% off a Bitaxe open-source Bitcoin home miner using code BRAM at https://shop.powermining.io/?ref=BRAM› Heat your home and Earn Bitcoin with Heatbit - Get 5% off with code BRAM https://heatbit.com/?ref=BRAM› Stamp Seed: The safest way to backup your hardware wallet - Get 15% off with code BRAM at https://stampseed.com🔔 SUBSCRIBE TO GET NOTIFIED› https://youtube.com/@bramk⁠⁠› https://x.com/bramk🕑 TIMESTAMPS00:00 - Coldcard exploit, what likely happened02:29 - Negligence vs conspiracy theories04:54 - Why basic entropy checks failed06:30 - Source available vs open source08:13 - Closed source scenario, why panic09:25 - Why FOSS still wins long term12:58 - Ledger, audits, and verification limits16:30 - Why this bug was the worst case19:23 - AI changes wallet threat models21:56 - Best practice, rerun audits per model24:56 - Self-custody backlash, convenience vs control32:34 - Designing happy path vs advanced mode36:54 - Do you need a phone?37:45 - QR air gap limits and Quantum Link57:04 - Hardware wallet cooperation, not infighting1:04:24 - Biggest takeaways for average usersℹ️ EPISODE SUMMARYBram Kanstein and Zach Herbert discuss the Coldcard entropy failure and why it smells like negligence, not a nation state plot. They confront how “don’t trust, verify” often stops at a slogan, even when seed generation is the whole game. They map the trade-offs between closed source, source available, and true FOSS, especially now that AI can audit firmware fast. Zach reveals why Foundation moved past pure QR air gaps, and how Quantum Link uses QR to bootstrap an encrypted Bluetooth tunnel. They zoom out to the real damage: self-custody adoption, UX vs hardcore OPSEC, and an industry that needs a rapid response loop.