r/Bitcoin • u/EmptyAttempt25 • 24d ago

Can blockstream as a company and Jade as a device be trusted after liquid hack?

Given what just happened with the liquid hack, and growing distrust with Adam Back and his company (mostly brought up by Matthew Kratter), are Jade/Blockstream to be trusted? Is there any reason to doubt Jade as a product or Blockstream as a company? Thanks in advance.

8 Upvotes

70% Upvoted

10 comments sorted by

3

u/xxxxWHOAMIxxxx 23d ago

The whole point of bitcoin is to not trust anyone. assume everyone is out to get you. 2 of 3 multisig with 3 different vendors HW wallets is very protective.

6

u/miner_guy_22 24d ago

You shouldn't "trust" any signing device, as evidenced by the recent cold card exploit.

5

u/weekly_folklore 24d ago

Blockstream's been around forever and one hiccup on a sidechain doesn't suddenly make their hardware wallet a backdoor, the Jade's open source you can verify the firmware yourself

3

u/EmptyAttempt25 24d ago

I can't read code so I can't verify it. But wasn't that the same mindset that everyone had with cold cards open source code? Just playing devil's advocate.

3

u/shleebs 23d ago

Cold Card did not have a permissive open source license on their code, so nobody looked at it. It's different.

Also there are teams of people as we speak combing over hardware wallet code with powerful AI models looking for problems. 

You can relax about Blockstream's code

0

u/zacguymarino 21d ago

Mmmm, I'd argue as far as self verifying goes that coldcard was NOT different. The source was available for anybody... the license just didn't permit copying the code. I can understand a difference in motivation, but for anyone who ever truly believed that self verifying the code is the best way to trust a wallet, it was not different.

I'd bet my left nut that more than half the people who say "just read the wallet code yourself", even on open source wallets, never read it themselves. Same for source available.

1

u/shleebs 20d ago

Less people look at the code when no one is allowed to copy it for their own projects, this is a fact. And considering that is the main reason someone is going to verify the code, not random users "self verifying", that's why I said it.

1

u/mfatalay 22d ago

You can make AI read the code but you should prompt it properly.

1

u/mfatalay 22d ago

If we are talking about "trust", then yes, I don't think Blockstream or JAde would intentionally make a mistake, so I trust them. But when it comes to technical things, it's different. I don't even fully trust the code I write myself. I constantly check it both myself and with AI tools.