{"id":96,"date":"2026-09-06T09:09:42","date_gmt":"2026-09-06T09:09:42","guid":{"rendered":"https:\/\/getbitcoin.guide\/articles\/?p=96"},"modified":"2026-10-18T08:41:19","modified_gmt":"2026-10-18T08:41:19","slug":"coolwallet-review","status":"publish","type":"post","link":"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/","title":{"rendered":"CoolWallet Review: The Card Format and Its Tradeoffs"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>This coolwallet review covers three cards from CoolBitX: the battery free Go, the Bluetooth enabled Pro, and the older S. The format is genuinely convenient. The tradeoff is that a card this thin leans hard on your phone for its interface, and your phone is the part an attacker reaches first.<\/strong><\/p>\n\n\n\n<div class=\"msq-audio\" data-article=\"coolwallet-review\" data-minutes=\"12\">\n<style>.msq-audio{margin:1.25em 0 1.75em;padding:16px 18px;background:#EEF3F8;border:1px solid #CBD8E6;border-radius:12px}\n.msq-audio-lead{margin:0 0 8px;font-size:.95em}.msq-audio audio{width:100%;margin:0 0 12px;display:block}\n.msq-toc-title{margin:0 0 6px;font-weight:700}.msq-toc ol{margin:0;padding:0;list-style:none}\n.msq-toc li{display:flex;gap:10px;align-items:center;padding:6px 6px;border-bottom:1px solid #CBD8E6;border-radius:8px}\n.msq-toc li:last-child{border-bottom:0}.msq-toc li.is-active{background:#fff}\n.msq-toc-play{flex:0 0 auto;width:30px;height:30px;border-radius:50%;border:0;background:#1F4E79;color:#fff;font:inherit;font-size:.72em;line-height:30px;padding:0;cursor:pointer}\n.msq-toc-play.is-playing{background:#B4531A}\n.msq-toc-time{flex:0 0 auto;min-width:3.1em;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-toc a{color:#1B1F24;text-decoration:none;line-height:1.35}.msq-toc li.is-active a{font-weight:700;color:#1F4E79}\n.msq-audio-note{margin:10px 0 0;font-size:.82em;color:#4A5560}\nh2.wp-block-heading[id]{scroll-margin-top:24px}\n.msq-hplay{display:inline-block;vertical-align:middle;width:26px;height:26px;margin:0 0 0 10px;border-radius:50%;border:0;background:#1F4E79;cursor:pointer;padding:0;position:relative;top:-2px}\n.msq-hplay::before{content:'\u25b6\ufe0e';display:block;color:#fff;font-size:11px;line-height:26px;text-align:center}\n.msq-hplay.is-playing{background:#B4531A}.msq-hplay.is-playing::before{content:'\u2016';font-size:13px;font-weight:700}\n.msq-bar{position:fixed;left:0;right:0;bottom:0;z-index:9000;display:flex;align-items:center;gap:10px;padding:8px 12px;padding-bottom:calc(8px + env(safe-area-inset-bottom));background:#FFFFFF;border-top:1px solid #CBD8E6;box-shadow:0 -4px 16px rgba(0,0,0,.08);font-size:.92em;color:#1B1F24;transition:transform .2s ease}\n.msq-bar.is-hidden{transform:translateY(130%)}\n.msq-bar-play{display:inline-flex;align-items:center;gap:8px;border:0;border-radius:999px;background:#1F4E79;color:#fff;font:inherit;font-weight:700;padding:8px 14px 8px 12px;cursor:pointer;white-space:nowrap}\n.msq-bar-play.is-playing{background:#B4531A}\n.msq-bar-icon::before{content:'\u25b6\ufe0e';font-size:12px}.msq-bar-play.is-playing .msq-bar-icon::before{content:'\u2016';font-size:14px;font-weight:700}\n.msq-bar-chapter{flex:1 1 auto;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n.msq-bar-time{flex:0 0 auto;font-variant-numeric:tabular-nums;color:#4A5560;font-size:.9em}\n.msq-bar-rate,.msq-bar-close{flex:0 0 auto;border:1px solid #CBD8E6;background:#fff;color:#1B1F24;font:inherit;font-size:.85em;line-height:1;border-radius:8px;padding:7px 9px;cursor:pointer}\n.msq-bar-close::before{content:'\u2715'}\n.msq-bar.msq-bar-pill{left:auto;right:14px;bottom:14px;padding:6px;padding-bottom:6px;border:1px solid #CBD8E6;border-radius:999px;box-shadow:0 6px 20px rgba(0,0,0,.15)}\n.msq-bar.msq-bar-pill .msq-bar-chapter,.msq-bar.msq-bar-pill .msq-bar-time,.msq-bar.msq-bar-pill .msq-bar-rate{display:none}\nbody.msq-has-bar{padding-bottom:76px}\n@media (max-width:600px){.msq-bar-time{display:none}.msq-bar{gap:8px;padding-left:10px;padding-right:10px}}\n.msq-s.msq-now{background:#EEF3F8;box-shadow:0 2px 0 #1F4E79;border-radius:2px}\ntr.msq-now td,tr.msq-now th{background:#EEF3F8;box-shadow:inset 0 -2px 0 #1F4E79}\n@media (hover:hover){.msq-s,tr[data-i]{cursor:pointer}.msq-s:hover{background:#EEF3F8}}<\/style>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"AudioObject\",\"@id\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#audio\",\"name\":\"CoolWallet Review: The Card Format and Its Tradeoffs, read aloud\",\"description\":\"Synthetic voice reading of the article, recorded 18 October 2026.\",\"contentUrl\":\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/coolwallet-review-audio-202610181411.mp3\",\"encodingFormat\":\"audio\/mpeg\",\"duration\":\"PT11M55S\",\"uploadDate\":\"2026-10-18\",\"inLanguage\":\"en-GB\",\"isAccessibleForFree\":true,\"mainEntityOfPage\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/\",\"hasPart\":[{\"@type\":\"Clip\",\"name\":\"CoolWallet Review: The Card Format and Its Tradeoffs\",\"startOffset\":0,\"endOffset\":39},{\"@type\":\"Clip\",\"name\":\"What is CoolWallet, and who actually makes it?\",\"startOffset\":39,\"endOffset\":89,\"url\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#what-is-coolwallet-and-who-actually-makes-it\"},{\"@type\":\"Clip\",\"name\":\"Which CoolWallet models are actually on sale?\",\"startOffset\":89,\"endOffset\":251,\"url\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#which-coolwallet-models-are-actually-on-sale\"},{\"@type\":\"Clip\",\"name\":\"Is Bluetooth on a hardware wallet a security problem?\",\"startOffset\":251,\"endOffset\":338,\"url\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#is-bluetooth-on-a-hardware-wallet-a-security-problem\"},{\"@type\":\"Clip\",\"name\":\"What did Kraken Security Labs find in the CoolWallet S?\",\"startOffset\":338,\"endOffset\":413,\"url\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#what-did-kraken-security-labs-find-in-the-coolwallet-s\"},{\"@type\":\"Clip\",\"name\":\"How does the card format change your backup problem?\",\"startOffset\":413,\"endOffset\":481,\"url\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#how-does-the-card-format-change-your-backup-problem\"},{\"@type\":\"Clip\",\"name\":\"Does the card format suit the way you hold coins?\",\"startOffset\":481,\"endOffset\":525,\"url\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#does-the-card-format-suit-the-way-you-hold-coins\"},{\"@type\":\"Clip\",\"name\":\"What do the affiliate reviews leave out?\",\"startOffset\":525,\"endOffset\":609,\"url\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#what-do-the-affiliate-reviews-leave-out\"},{\"@type\":\"Clip\",\"name\":\"What has changed since this was first published?\",\"startOffset\":609,\"endOffset\":715,\"url\":\"https:\/\/getbitcoin.guide\/articles\/coolwallet-review\/#what-has-changed-since-this-was-first-published\"}],\"contentSize\":\"5.0 MB\"}<\/script>\n<p class=\"msq-audio-lead\"><strong>Listen to this article<\/strong>, about 12 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.<\/p>\n<audio class=\"msq-audio-player\" controls preload=\"metadata\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/10\/coolwallet-review-audio-202610181411.mp3\"><\/audio>\n<nav class=\"msq-toc\" aria-label=\"In this article\"><p class=\"msq-toc-title\">In this article<\/p>\n<ol>\n<li data-start=\"0.0\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"0.0\" aria-label=\"Play from: CoolWallet Review: The Card Format and Its Tradeoffs\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">0:00<\/span><a href=\"#top\">CoolWallet Review: The Card Format and Its Tradeoffs<\/a><\/li>\n<li data-start=\"38.54\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"38.54\" aria-label=\"Play from: What is CoolWallet, and who actually makes it?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">0:39<\/span><a href=\"#what-is-coolwallet-and-who-actually-makes-it\">What is CoolWallet, and who actually makes it?<\/a><\/li>\n<li data-start=\"89.08\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"89.08\" aria-label=\"Play from: Which CoolWallet models are actually on sale?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">1:29<\/span><a href=\"#which-coolwallet-models-are-actually-on-sale\">Which CoolWallet models are actually on sale?<\/a><\/li>\n<li data-start=\"250.78\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"250.78\" aria-label=\"Play from: Is Bluetooth on a hardware wallet a security problem?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">4:11<\/span><a href=\"#is-bluetooth-on-a-hardware-wallet-a-security-problem\">Is Bluetooth on a hardware wallet a security problem?<\/a><\/li>\n<li data-start=\"338.24\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"338.24\" aria-label=\"Play from: What did Kraken Security Labs find in the CoolWallet S?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">5:38<\/span><a href=\"#what-did-kraken-security-labs-find-in-the-coolwallet-s\">What did Kraken Security Labs find in the CoolWallet S?<\/a><\/li>\n<li data-start=\"412.9\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"412.9\" aria-label=\"Play from: How does the card format change your backup problem?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">6:53<\/span><a href=\"#how-does-the-card-format-change-your-backup-problem\">How does the card format change your backup problem?<\/a><\/li>\n<li data-start=\"480.6\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"480.6\" aria-label=\"Play from: Does the card format suit the way you hold coins?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">8:01<\/span><a href=\"#does-the-card-format-suit-the-way-you-hold-coins\">Does the card format suit the way you hold coins?<\/a><\/li>\n<li data-start=\"525.46\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"525.46\" aria-label=\"Play from: What do the affiliate reviews leave out?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">8:45<\/span><a href=\"#what-do-the-affiliate-reviews-leave-out\">What do the affiliate reviews leave out?<\/a><\/li>\n<li data-start=\"609.12\"><button type=\"button\" class=\"msq-toc-play\" data-start=\"609.12\" aria-label=\"Play from: What has changed since this was first published?\">&#x25B6;&#xFE0E;<\/button><span class=\"msq-toc-time\">10:09<\/span><a href=\"#what-has-changed-since-this-was-first-published\">What has changed since this was first published?<\/a><\/li>\n<\/ol><\/nav>\n<p class=\"msq-audio-note\">Recorded 18 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.<\/p>\n<script>var MSQ_SENT = [[0.0,\"h\",\"coolwalletreviewthecardf\",44],[3.08,\"p\",\"thiscoolwalletreviewcove\",128],[12.8,\"p\",\"thetradeoffisthatacardth\",108],[20.24,\"p\",\"onthispagethethreecardsc\",234],[38.54,\"h\",\"whatiscoolwalletandwhoac\",37],[41.62,\"p\",\"coolwalletisthehardwarew\",62],[46.14,\"p\",\"thepremiseisoneideacarri\",149],[55.98,\"p\",\"thecoolwalletproproductp\",122],[66.54,\"p\",\"theprivatekeyisgenerated\",40],[69.58,\"p\",\"thephoneappisthescreenth\",50],[73.54,\"p\",\"thatsplitisthesinglemost\",109],[80.22,\"p\",\"ifthephraseprivatekeyont\",103],[89.08,\"h\",\"whichcoolwalletmodelsare\",38],[91.8,\"p\",\"threeasof6september2026a\",53],[97.16,\"p\",\"mostreviewsitesstillwrit\",89],[103.16,\"t\",\"coolwalletgo\",197],[126.36,\"t\",\"coolwalletpro\",220],[152.48,\"t\",\"coolwallets\",184],[170.96,\"p\",\"thegoistheinterestingarr\",55],[175.32,\"p\",\"ithasnobatteryandnobluet\",98],[184.4,\"p\",\"bothcardsarelistedassupp\",131],[196.56,\"p\",\"acorrectiontoourownsepte\",35],[198.76,\"p\",\"thegosstandardwarrantyis\",199],[214.16,\"p\",\"thetableabovecompiledon6\",145],[225.24,\"p\",\"onenumberinthattabledese\",39],[228.0,\"p\",\"theprocarriesa15mahlithi\",112],[237.16,\"p\",\"abatteryisaconsumable\",21],[239.24,\"p\",\"adevicesoldpartlyonthepr\",163],[250.78,\"h\",\"isbluetoothonahardwarewa\",44],[254.02,\"p\",\"itisarealattacksurfacean\",59],[258.74,\"p\",\"on18december2020thecompa\",290],[279.06,\"p\",\"threeconditionshadtohold\",210],[293.46,\"p\",\"coolbitxfixeditincoolwal\",96],[303.34,\"p\",\"readthatasanargumentabou\",75],[307.86,\"p\",\"anyradiowidensthecircleo\",70],[312.54,\"p\",\"thegoanswersthisbyremovi\",106],[320.3,\"p\",\"coolwalletsellsthatascon\",32],[322.62,\"p\",\"itisalsothestrongersecur\",70],[327.58,\"p\",\"thesameargumentsplitssaf\",123],[338.24,\"h\",\"whatdidkrakensecuritylab\",45],[341.92,\"p\",\"on3april2020krakensecuri\",235],[359.64,\"p\",\"insteadpinverificationis\",42],[362.88,\"p\",\"acompromisedphonetherefo\",78],[368.0,\"p\",\"coolbitxrespondedthesame\",27],[370.56,\"p\",\"itdisabledcriticalloggin\",192],[383.72,\"p\",\"thosefixesaresixyearsold\",46],[387.2,\"p\",\"thearchitecturallessonha\",37],[389.68,\"p\",\"accealcertificationdescr\",48],[394.64,\"p\",\"thechipinthecoolwalletsw\",97],[401.8,\"p\",\"everywalletwhoseinterfac\",162],[412.9,\"h\",\"howdoesthecardformatchan\",43],[415.7,\"p\",\"itdoesnotchangeitatallan\",54],[419.62,\"p\",\"acoolwalletisawaytosignt\",65],[424.46,\"p\",\"itisnotawaytosurvivelosi\",33],[427.98,\"p\",\"ifthecardislostsnappedst\",131],[437.7,\"p\",\"whichraisestheobviousten\",41],[440.1,\"p\",\"thewholesellingpointisth\",102],[447.34,\"p\",\"adeviceyoucarrydailyneed\",84],[453.06,\"p\",\"thefailuremodesareboring\",114],[460.54,\"p\",\"oneruleholdsregardlessof\",32],[463.1,\"p\",\"yourrecoveryphraseisente\",79],[468.82,\"p\",\"nogenuinesupportagentver\",79],[475.1,\"p\",\"anysiteorpersonaskingyou\",65],[480.6,\"h\",\"doesthecardformatsuitthe\",39],[483.72,\"p\",\"thatdependsonaquestionab\",102],[490.24,\"p\",\"acardinyourpocketisbuilt\",51],[493.8,\"p\",\"ifyoumovefundsafewtimesa\",149],[503.72,\"p\",\"ifyoudosignoftenandfromy\",127],[512.8,\"p\",\"eitherwaythedecisionisas\",160],[525.46,\"h\",\"whatdotheaffiliatereview\",33],[527.78,\"p\",\"threethingsconsistently\",23],[530.7,\"p\",\"firstbiometrics\",15],[532.3,\"p\",\"awidelysyndicatedreviewo\",90],[538.78,\"p\",\"coolwalletsownprospecifi\",157],[551.5,\"p\",\"afacecheckonyourphoneisn\",86],[557.18,\"p\",\"secondthedisplay\",16],[558.66,\"p\",\"thesamespecificationpage\",135],[567.82,\"p\",\"thismattersmorethanitsou\",139],[576.86,\"p\",\"hardwarewalletswithroomi\",93],[583.38,\"p\",\"thirdthe2020advisories\",22],[586.26,\"p\",\"botharepublishedbycoolbi\",108],[593.86,\"p\",\"avendorthatdisclosesablu\",91],[599.98,\"p\",\"areviewthatomitsthediscl\",134],[609.12,\"h\",\"whathaschangedsincethisw\",40],[612.12,\"p\",\"asofoctober2026thecoolwa\",96],[621.08,\"p\",\"on6september2026thesamep\",49],[630.6,\"p\",\"thestoreappearstoshowpri\",119],[638.76,\"p\",\"correctedinoctober2026th\",110],[647.8,\"p\",\"septembersversionofthisa\",69],[652.08,\"p\",\"foundinoctober2026thepro\",166],[666.36,\"p\",\"wereportbothratherthanpi\",29],[668.36,\"p\",\"on15june2026coolbitxende\",112],[677.52,\"p\",\"thecompanysaysassetsonth\",44],[680.52,\"p\",\"asearchon18october2026fo\",87],[688.88,\"p\",\"inoctober2026aledgerinve\",140],[699.72,\"p\",\"thatcaseconcernsledgerde\",128],[708.88,\"p\",\"ourcomparisonofledgerdev\",78]];\n(function(){\n  function init(){\n  var root = document.querySelector('.msq-audio'); if (!root) { return; }\n  var audio = root.querySelector('audio'), items = Array.prototype.slice.call(root.querySelectorAll('.msq-toc li'));\n  var starts = items.map(function(li){ return parseFloat(li.getAttribute('data-start')) || 0; });\n  var names = items.map(function(li){ return li.querySelector('a').textContent; });\n  var anchors = items.map(function(li){ var h = li.querySelector('a').getAttribute('href') || ''; return (h.charAt(0) === '#' && h !== '#top') ? document.getElementById(h.slice(1)) : null; });\n  var article = root.getAttribute('data-article') || location.pathname, minutes = root.getAttribute('data-minutes') || '';\n  var marks = {}, started = false, pausedAt = -1, closed = false, ended = false;\n  var RATES = [1, 1.25, 1.5], rate = 1;\n  try { var saved = parseFloat(localStorage.getItem('msq-audio-rate')); if (RATES.indexOf(saved) >= 0) { rate = saved; } } catch (e) {}\n  audio.playbackRate = rate;\n  function track(name, extra){ try { if (typeof gtag === 'function') { var p = { article: article }; for (var k in extra) { p[k] = extra[k]; } gtag('event', name, p); } } catch (e) {} }\n  function current(){ var t = audio.currentTime, idx = 0; for (var i = 0; starts.length > i; i += 1) { if (t + 0.25 >= starts[i]) { idx = i; } } return idx; }\n  function onScreen(){\n    var line = window.innerHeight \/ 3, idx = 0;\n    for (var i = 0; anchors.length > i; i += 1) { var el = anchors[i]; if (el && line >= el.getBoundingClientRect().top) { idx = i; } }\n    return idx;\n  }\n  function fmt(s){ s = Math.max(0, Math.round(s || 0)); var m = Math.floor(s \/ 60), r = s % 60; return m + ':' + (10 > r ? '0' : '') + r; }\n  function play(from, source){\n    if (from !== null) { audio.currentTime = from; }\n    var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n    track(from === null ? 'audio_resume' : 'audio_chapter', { chapter: names[current()], start: Math.round(audio.currentTime), source: source });\n  }\n  var hbtns = anchors.map(function(el, i){\n    if (!el) { return null; }\n    var b = document.createElement('button'); b.type = 'button'; b.className = 'msq-hplay'; b.setAttribute('aria-label', 'Play this section: ' + names[i]);\n    b.addEventListener('click', function(){\n      if (!audio.paused && current() === i) { audio.pause(); track('audio_pause', { source: 'heading' }); return; }\n      play(starts[i], 'heading');\n    });\n    el.appendChild(b); return b;\n  });\n  var bar = document.createElement('div'); bar.className = 'msq-bar msq-bar-pill is-hidden'; bar.setAttribute('role', 'region'); bar.setAttribute('aria-label', 'Audio player');\n  var playBtn = document.createElement('button'); playBtn.type = 'button'; playBtn.className = 'msq-bar-play';\n  var icon = document.createElement('span'); icon.className = 'msq-bar-icon'; icon.setAttribute('aria-hidden', 'true');\n  var label = document.createElement('span'); label.className = 'msq-bar-label';\n  playBtn.appendChild(icon); playBtn.appendChild(label);\n  var chap = document.createElement('span'); chap.className = 'msq-bar-chapter';\n  var clock = document.createElement('span'); clock.className = 'msq-bar-time';\n  var rateBtn = document.createElement('button'); rateBtn.type = 'button'; rateBtn.className = 'msq-bar-rate'; rateBtn.setAttribute('aria-label', 'Playback speed');\n  var closeBtn = document.createElement('button'); closeBtn.type = 'button'; closeBtn.className = 'msq-bar-close'; closeBtn.setAttribute('aria-label', 'Close the audio bar');\n  bar.appendChild(playBtn); bar.appendChild(chap); bar.appendChild(clock); bar.appendChild(rateBtn); bar.appendChild(closeBtn);\n  document.body.appendChild(bar);\n  function showRate(){ rateBtn.textContent = (rate === 1 ? '1' : String(rate)) + 'x'; }\n  showRate();\n  rateBtn.addEventListener('click', function(){\n    rate = RATES[(RATES.indexOf(rate) + 1) % RATES.length]; audio.playbackRate = rate; showRate();\n    try { localStorage.setItem('msq-audio-rate', String(rate)); } catch (e) {}\n    track('audio_rate', { rate: rate });\n  });\n  closeBtn.addEventListener('click', function(){\n    closed = true; if (!audio.paused) { audio.pause(); } paint(); track('audio_bar_close', {});\n  });\n  function mode(){\n    if (!audio.paused) { return 'pause'; }\n    if (ended) { return 'again'; }\n    if (!started) { return 'listen'; }\n    return (pausedAt === onScreen()) ? 'resume' : 'section';\n  }\n  playBtn.addEventListener('click', function(){\n    var m = mode();\n    if (m === 'pause') { audio.pause(); track('audio_pause', { source: 'bar' }); return; }\n    if (m === 'again') { ended = false; play(0, 'bar'); return; }\n    if (m === 'resume') { play(null, 'bar'); return; }\n    play(starts[onScreen()], 'bar');\n  });\n  function paint(){\n    var idx = current(), playing = !audio.paused, m = mode();\n    items.forEach(function(li, i){\n      var on = (i === idx) && playing, b = li.querySelector('.msq-toc-play'), a = li.querySelector('a');\n      li.classList.toggle('is-active', on); b.classList.toggle('is-playing', on);\n      b.textContent = on ? '\u2016' : '\u25b6\ufe0e';\n      b.setAttribute('aria-label', (on ? 'Pause: ' : 'Play from: ') + a.textContent);\n    });\n    hbtns.forEach(function(b, i){ if (b) { var on = (i === idx) && playing; b.classList.toggle('is-playing', on); b.setAttribute('aria-label', (on ? 'Pause this section: ' : 'Play this section: ') + names[i]); } });\n    playBtn.classList.toggle('is-playing', playing);\n    label.textContent = m === 'pause' ? 'Pause' : m === 'again' ? 'Play again' : m === 'resume' ? 'Resume' : m === 'section' ? 'Play this section' : 'Listen, ' + minutes + ' min';\n    playBtn.setAttribute('aria-label', label.textContent);\n    chap.textContent = started ? names[(playing || m === 'resume') ? idx : onScreen()] : '';\n    clock.textContent = started ? fmt(audio.currentTime) + ' \/ ' + fmt(audio.duration) : '';\n    bar.classList.toggle('msq-bar-pill', !started);\n    var show = !closed && (started || 0 > root.getBoundingClientRect().bottom);\n    bar.classList.toggle('is-hidden', !show);\n    document.body.classList.toggle('msq-has-bar', show);\n  }\n  root.addEventListener('click', function(e){\n    var b = e.target.closest ? e.target.closest('.msq-toc-play') : null; if (!b) { return; }\n    var li = b.parentNode, s = parseFloat(b.getAttribute('data-start')) || 0;\n    if (!audio.paused && current() === items.indexOf(li)) { audio.pause(); track('audio_pause', { source: 'index' }); return; }\n    play(s, 'index');\n  });\n  audio.addEventListener('play', function(){ ended = false; closed = false; if (!started) { started = true; track('audio_play', { minutes: Math.round((audio.duration || 0) \/ 60) }); } paint(); });\n  audio.addEventListener('pause', function(){ pausedAt = current(); paint(); });\n  audio.addEventListener('timeupdate', function(){\n    paint();\n    if (audio.duration > 0) {\n      var pct = Math.floor(audio.currentTime \/ audio.duration * 100);\n      [25, 50, 75].forEach(function(m){ if (pct >= m && !marks[m]) { marks[m] = true; track('audio_progress', { percent: m }); } });\n    }\n  });\n  audio.addEventListener('ended', function(){ ended = true; track('audio_complete', {}); paint(); });\n  var ticking = false;\n  function onScroll(){ if (ticking) { return; } ticking = true; setTimeout(function(){ ticking = false; paint(); }, 80); }\n  window.addEventListener('scroll', onScroll, { passive: true }); window.addEventListener('resize', onScroll);\n  paint();\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', init); } else { init(); }\n})();\n\n(function(){\n  function start(){\n    var root = document.querySelector('.msq-audio'), audio = root ? root.querySelector('audio') : null;\n    var map = (typeof MSQ_SENT !== 'undefined') ? MSQ_SENT : [];\n    if (!root || !audio || !map.length) { return; }\n    var scope = root.closest('main') || root.closest('article') || root.closest('.entry-content') || document.body;\n    var SKIP = '.msq-audio,.msq,.msq-tool,.msq-end,.msq-bar,script,style,noscript,figcaption,#rank-math-faq,.rank-math-block,nav,header,footer';\n    function norm(s){ return s.toLowerCase().replace(\/[^a-z0-9]+\/g, ''); }\n    var nodes = [], stream = '', walker = document.createTreeWalker(scope, NodeFilter.SHOW_TEXT, null), n;\n    while ((n = walker.nextNode())) {\n      var el = n.parentElement; if (!el || el.closest(SKIP)) { continue; }\n      var raw = n.nodeValue, keep = [], norms = '';\n      for (var i = 0; raw.length > i; i += 1) { var c = raw.charAt(i).toLowerCase(); if (\/[a-z0-9]\/.test(c)) { keep.push(i); norms += c; } }\n      if (!norms) { continue; }\n      nodes.push({ node: n, a: stream.length, b: stream.length + norms.length, keep: keep });\n      stream += norms;\n    }\n    var segs = [], cursor = 0, lastRow = null;\n    map.forEach(function(m, idx){\n      var kind = m[1], f = m[2], len = m[3];\n      if (kind === 't') {\n        var rows = scope.querySelectorAll('tr'), after = !lastRow;\n        for (var r = 0; rows.length > r; r += 1) {\n          var tr = rows[r];\n          if (!after) { if (tr === lastRow) { after = true; } continue; }\n          var cell = tr.querySelector('td,th');\n          if (cell && norm(cell.textContent).indexOf(f) === 0) { tr.setAttribute('data-i', idx); lastRow = tr; break; }\n        }\n        return;\n      }\n      var p = stream.indexOf(f, cursor); if (0 > p) { return; }\n      segs.push({ i: idx, a: p, b: Math.min(p + len, stream.length) }); cursor = p + len;\n    });\n    var si = 0;\n    nodes.forEach(function(nd){\n      var frag = document.createDocumentFragment(), raw = nd.node.nodeValue, rawPos = 0, any = false;\n      for (var k = si; segs.length > k; k += 1) {\n        var sg = segs[k]; if (sg.a >= nd.b) { break; } if (nd.a >= sg.b) { continue; }\n        var s = Math.max(sg.a, nd.a), e = Math.min(sg.b, nd.b);\n        var rs = nd.keep[s - nd.a], re2 = nd.keep[e - nd.a - 1] + 1;\n        if (rs > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos, rs))); }\n        var span = document.createElement('span'); span.className = 'msq-s'; span.setAttribute('data-i', sg.i); span.textContent = raw.slice(rs, re2);\n        frag.appendChild(span); rawPos = re2; any = true;\n        if (sg.b > nd.b) { break; }\n      }\n      while (segs.length > si && nd.b >= segs[si].b) { si += 1; }\n      if (!any) { return; }\n      if (raw.length > rawPos) { frag.appendChild(document.createTextNode(raw.slice(rawPos))); }\n      nd.node.parentNode.replaceChild(frag, nd.node);\n    });\n    var starts = map.map(function(m){ return m[0]; }), curIdx = -1, lastUser = 0, timer = null, autoUntil = 0, dragging = false;\n    function idxAt(t){ var lo = 0, hi = starts.length; while (hi > lo + 1) { var mid = (lo + hi) >> 1; if (t + 0.15 >= starts[mid]) { lo = mid; } else { hi = mid; } } return (t + 0.15 >= starts[0]) ? lo : -1; }\n    function setNow(i){\n      if (i === curIdx) { return; }\n      Array.prototype.forEach.call(scope.querySelectorAll('.msq-now'), function(el){ el.classList.remove('msq-now'); });\n      curIdx = i; if (0 > i) { return; }\n      var els = scope.querySelectorAll('[data-i=\"' + i + '\"]'); if (!els.length) { return; }\n      Array.prototype.forEach.call(els, function(el){ el.classList.add('msq-now'); });\n      var r = els[0].getBoundingClientRect(), now = Date.now();\n      if (!dragging && now > lastUser + 2500 && (80 > r.top || r.bottom > window.innerHeight - 140)) {\n        var reduce = window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches;\n        autoUntil = now + (reduce ? 400 : 1600);\n        els[0].scrollIntoView({ block: 'center', behavior: reduce ? 'auto' : 'smooth' });\n      }\n    }\n    function tick(){ if (!audio.paused) { setNow(idxAt(audio.currentTime)); } }\n    function userScrolled(){ lastUser = Date.now(); }\n    ['wheel', 'touchmove', 'keydown'].forEach(function(ev){ window.addEventListener(ev, userScrolled, { passive: true }); });\n    window.addEventListener('scroll', function(){ if (Date.now() > autoUntil) { userScrolled(); } }, { passive: true });\n    window.addEventListener('mousedown', function(e){ if (e.clientX >= document.documentElement.clientWidth) { dragging = true; userScrolled(); } }, { passive: true });\n    window.addEventListener('mouseup', function(){ if (dragging) { dragging = false; userScrolled(); } }, { passive: true });\n    audio.addEventListener('play', function(){ if (timer) { clearInterval(timer); } timer = setInterval(tick, 150); tick(); });\n    audio.addEventListener('pause', function(){ if (timer) { clearInterval(timer); timer = null; } });\n    scope.addEventListener('click', function(e){\n      if (e.target.closest('a, button, input, select, textarea, label, summary, .msq, .msq-tool, .msq-end, .msq-audio, .msq-bar')) { return; }\n      var sel = window.getSelection ? String(window.getSelection()) : '';\n      if (sel && sel.trim()) { return; }\n      var el = e.target.closest('[data-i]'); if (!el) { return; }\n      var i = parseInt(el.getAttribute('data-i'), 10); if (isNaN(i)) { return; }\n      if (!audio.paused && i === curIdx) { return; }\n      lastUser = Date.now();\n      audio.currentTime = starts[i];\n      var p = audio.play(); if (p && p.catch) { p.catch(function(){}); }\n      try { if (typeof gtag === 'function') { gtag('event', 'audio_chapter', { article: location.pathname, source: 'sentence', start: Math.round(starts[i]) }); } } catch (err) {}\n    });\n    audio.addEventListener('seeked', tick);\n    audio.addEventListener('ended', function(){ setNow(-1); });\n  }\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', start); } else { start(); }\n})();<\/script>\n<\/div>\n\n\n\n<p class=\"msq-hook wp-block-paragraph\">On this page: the three cards CoolBitX actually sells and the battery inside one of them, the 2020 Bluetooth replay flaw and what fixed it, what Kraken Security Labs found in the S, why the card format changes nothing about your backup, and the three things the affiliate reviews leave out.<\/p>\n\n\n\n<div class=\"msq\" id=\"ms-quiz\" data-slug=\"coolwallet-review\" data-category=\"self custody\" data-list=\"1\">\n<style>.msq,.msq-hook,.msq-box,.msq-end,.msq-tool{--msq-accent:#1F4E79;--msq-accent-text:#FFFFFF;--msq-line:#CBD8E6;--msq-warn:#B4531A;--msq-muted:#4A5560;--msq-tint:#EEF3F8;--msq-base:#FFFFFF}\n.msq{margin:1.25em 0 1.75em}\n.msq-hook{border-left:3px solid var(--msq-accent);padding:6px 14px;color:var(--msq-muted);font-size:.97em}\n.msq-box{background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px;padding:0}\n.msq-box>summary{cursor:pointer;list-style:none;padding:14px 18px;font-weight:700;color:var(--msq-accent)}\n.msq-box>summary::-webkit-details-marker{display:none}\n.msq-box>summary::before{content:\"+\";display:inline-block;width:1.1em;font-weight:800}\n.msq-box[open]>summary::before{content:\"\\00d7\"}\n.msq-body{padding:2px 18px 18px}\n.msq-intro{margin:0 0 12px;font-size:.95em;color:var(--msq-muted)}\n.msq-list{margin:0;padding:0;list-style:none}\n.msq-q{margin:0 0 18px;padding:0}\n.msq-question{font-weight:700;margin:0 0 8px}\n.msq-options{display:flex;flex-direction:column;gap:8px}\n.msq-opt{text-align:left;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;padding:10px 12px;font:inherit;font-size:.95em;color:inherit;cursor:pointer;line-height:1.35}\n.msq-opt:hover{border-color:var(--msq-accent)}\n.msq-opt[disabled]{cursor:default}\n.msq-opt.is-right{border-color:var(--msq-accent);background:var(--msq-line);font-weight:700}\n.msq-opt.is-wrong{border-color:var(--msq-warn);color:var(--msq-warn)}\n.msq-explain{margin:8px 0 0;font-size:.92em;padding:10px 12px;border-left:3px solid var(--msq-accent);background:var(--msq-base);border-radius:0 8px 8px 0}\n.msq-explain[hidden]{display:none}\n.msq-verdict{font-weight:700}\n.msq-result{margin-top:14px;padding:14px 16px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:10px}\n.msq-result[hidden]{display:none}\n.msq-result h3{margin:0 0 6px;font-size:1.1em}\n.msq-result p{margin:0 0 8px}\n.msq-jump{margin:0 0 8px;padding-left:1.2em}\n.msq-form{margin-top:10px;display:flex;flex-wrap:wrap;gap:8px;align-items:center}\n.msq-form input[type=email]{flex:1 1 220px;padding:10px 12px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-btn{background:var(--msq-accent);color:var(--msq-accent-text);border:0;border-radius:8px;padding:11px 18px;font:inherit;font-weight:700;cursor:pointer}\n.msq-btn:hover{filter:brightness(.92)}\n.msq-btn[disabled]{opacity:.7;cursor:default}\n.msq-no{font-size:.9em;color:var(--msq-muted);margin-left:4px}\n.msq-privacy{margin:6px 0 0;font-size:.82em;color:var(--msq-muted);flex-basis:100%}\n.msq-hp{position:absolute;left:-5000px;width:1px;height:1px;overflow:hidden}\n.msq-msg{margin:8px 0 0;font-size:.92em}\n.msq-end{margin:1.5em 0;padding:18px;border:1px solid var(--msq-accent);border-radius:12px;text-align:center;background:var(--msq-tint)}\n.msq-end p{margin:0 0 12px}\n.msq-end .msq-body{text-align:left;padding:16px 0 0}\n.msq-end .msq-start-test[hidden]{display:none}\n.msq-tool{margin:1.5em 0;padding:18px 20px;background:var(--msq-tint);border:1px solid var(--msq-line);border-radius:12px}\n.msq-tool h3{margin:0 0 6px;font-size:1.15em}\n.msq-tool p{margin:0 0 10px}\n.msq-tool .msq-note{font-size:.85em;color:var(--msq-muted);margin:10px 0 0}\n.msq-check label{display:flex;gap:10px;align-items:flex-start;padding:9px 0;border-bottom:1px solid var(--msq-line);cursor:pointer;line-height:1.4}\n.msq-check label:last-of-type{border-bottom:0}\n.msq-check input{margin-top:5px;flex:0 0 auto;width:18px;height:18px;accent-color:var(--msq-accent)}\n.msq-check-count{font-weight:700;margin:10px 0 0}\n.msq-verdict-box{margin:12px 0 0;padding:10px 14px;border-radius:8px;background:var(--msq-base);border-left:3px solid var(--msq-warn)}\n.msq-verdict-box[hidden]{display:none}\n.msq-calc{display:grid;grid-template-columns:1fr 1fr;gap:10px 16px}\n.msq-calc label{display:flex;flex-direction:column;gap:4px;font-size:.92em}\n.msq-calc input,.msq-calc select{padding:8px 10px;border:1px solid var(--msq-muted);border-radius:8px;font:inherit;background:#fff}\n.msq-calc-out{grid-column:1 \/ -1;margin-top:6px;padding:12px 14px;background:var(--msq-base);border-radius:8px;border:1px solid var(--msq-line)}\n.msq-calc-out strong{font-size:1.15em}\n.msq-choose label{display:block;padding:9px 12px;margin:0 0 8px;background:var(--msq-base);border:1px solid var(--msq-line);border-radius:8px;cursor:pointer}\n.msq-choose input{margin-right:8px;accent-color:var(--msq-accent)}\n.msq-choice-result{margin-top:10px;padding:12px 14px;background:var(--msq-base);border-left:3px solid var(--msq-accent);border-radius:0 8px 8px 0}\n.msq-choice-result[hidden]{display:none}\n@media (max-width:600px){.msq-calc{grid-template-columns:1fr}}\nh2.wp-block-heading[id]{scroll-margin-top:24px}<\/style>\n<noscript><style>.msq-explain{display:block !important}<\/style><\/noscript>\n<details class=\"msq-box\">\n<summary>Think you already know this? Five questions, one minute.<\/summary>\n<div class=\"msq-body\">\n<p class=\"msq-intro\">Every answer is on this page. Answer from what you know now; the page fills in the rest.<\/p>\n<ol class=\"msq-list\">\n<li class=\"msq-q\" data-q=\"1\" data-answer=\"a\" data-title=\"Which CoolWallet models are actually on sale?\" data-section=\"#which-coolwallet-models-are-actually-on-sale\">\n<p class=\"msq-question\">1. What is unusual about the CoolWallet Go compared with the Pro?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 1 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">It has no battery, no Bluetooth radio and a lifetime warranty, with the same certified chip<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">It has a colour touchscreen<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">It works without a phone<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span><a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-go\" target=\"_blank\" rel=\"noopener\">The Go product page<\/a> describes NFC tap only, no Bluetooth, no USB. <a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-pro\" target=\"_blank\" rel=\"noopener\">The Pro<\/a> carries a 15 mAh lithium ion battery, a consumable inside a device sold on holding coins for years. <a class=\"msq-section\" href=\"#which-coolwallet-models-are-actually-on-sale\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"2\" data-answer=\"a\" data-title=\"Is Bluetooth on a hardware wallet a security problem?\" data-section=\"#is-bluetooth-on-a-hardware-wallet-a-security-problem\">\n<p class=\"msq-question\">2. What three conditions did the December 2020 seed replay attack on the CoolWallet S need?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 2 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">An outdated app during wallet creation or recovery, an attacker within about 30 metres at that moment, and a second prepared CoolWallet<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">Only the card&#8217;s serial number<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">A phishing email<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span><a href=\"https:\/\/www.coolwallet.io\/blogs\/blog\/bluetooth-security-vulnerability-seed-replay-attack\" target=\"_blank\" rel=\"noopener\">CoolBitX&#8217;s advisory<\/a> fixed it in CoolWallet App 2.9.1 and firmware 106. Read it as an argument about firmware currency rather than about Bluetooth: any radio widens the circle of people who can talk to your wallet without touching it. <a class=\"msq-section\" href=\"#is-bluetooth-on-a-hardware-wallet-a-security-problem\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"3\" data-answer=\"a\" data-title=\"What did Kraken Security Labs find in the CoolWallet S?\" data-section=\"#what-did-kraken-security-labs-find-in-the-coolwallet-s\">\n<p class=\"msq-question\">3. What did Kraken&#8217;s April 2020 assessment find?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 3 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">The Android app stored the PIN, pairing password and seed in plaintext, and PIN verification happened on the phone rather than the card<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">The card&#8217;s chip could be read by walking past<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">Nothing<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span><a href=\"https:\/\/blog.kraken.com\/post\/4384\/inside-kraken-security-labs-flaws-found-in-coolwallet-s-hardware-wallets\/\" target=\"_blank\" rel=\"noopener\">Kraken&#8217;s write up<\/a> is the clearest illustration that a CC EAL certification describes the chip, not the product. CoolBitX responded the same day, disabling the logging and blocking screenshots while a seed or PIN is on screen. <a class=\"msq-section\" href=\"#what-did-kraken-security-labs-find-in-the-coolwallet-s\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"4\" data-answer=\"a\" data-title=\"How does the card format change your backup problem?\" data-section=\"#how-does-the-card-format-change-your-backup-problem\">\n<p class=\"msq-question\">4. How does the card format change the backup problem?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 4 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">It does not change it at all; the recovery phrase is the only thing between you and total loss if the card is lost<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">The card is the backup<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">CoolBitX keeps a copy<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>A card that travels in the object most likely to be pickpocketed, sat on or left in a taxi needs a backup you have actually tested, stored somewhere the card never goes. No support agent, verification page or migration tool needs the phrase, without exception. <a class=\"msq-section\" href=\"#how-does-the-card-format-change-your-backup-problem\">Read the section<\/a><\/p>\n<\/li>\n<li class=\"msq-q\" data-q=\"5\" data-answer=\"b\" data-title=\"What do the affiliate reviews leave out?\" data-section=\"#what-do-the-affiliate-reviews-leave-out\">\n<p class=\"msq-question\">5. What does CoolWallet&#8217;s own Pro specification page list for biometric verification?<\/p>\n<div class=\"msq-options\" role=\"group\" aria-label=\"Question 5 options\"><button type=\"button\" class=\"msq-opt\" data-opt=\"a\">Fingerprint and facial recognition on the card<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"b\">No biometric verification method at all; a face check on your phone is not a check performed by the card<\/button><button type=\"button\" class=\"msq-opt\" data-opt=\"c\">An iris scanner<\/button><\/div>\n<p class=\"msq-explain\" hidden><span class=\"msq-verdict\"><\/span>The specification page fetched on 6 September 2026 lists dimensions, battery, chip certification and range, and no biometric method and no display specification. The affiliate reviews also skip the 2020 advisories, which leaves readers unable to answer the only question that matters: whether their firmware is current. <a class=\"msq-section\" href=\"#what-do-the-affiliate-reviews-leave-out\">Read the section<\/a><\/p>\n<\/li>\n<\/ol>\n<div class=\"msq-result\" hidden><\/div>\n<\/div>\n<\/details>\n<script>(function(){\n  if (window.__msqInit) { return; }\n  window.__msqInit = true;\n  var root = document.getElementById('ms-quiz');\n  if (!root) { return; }\n  var meta = { slug: root.getAttribute('data-slug'), category: root.getAttribute('data-category'),\n               list: root.getAttribute('data-list') || '1' };\n  function qs(el, s){ return el.querySelector(s); }\n  function qsa(el, s){ return Array.prototype.slice.call(el.querySelectorAll(s)); }\n  function track(name, params){\n    try { if (typeof gtag === 'function') { var p = params || {}; p.article = meta.slug; gtag('event', name, p); } } catch (e) {}\n  }\n  function jumpList(missed){\n    if (!missed.length) { return ''; }\n    return '<ul class=\"msq-jump\">' + missed.map(function(q){\n      return '<li><a href=\"' + q.getAttribute('data-section') + '\">' + q.getAttribute('data-title') + '<\/a><\/li>';\n    }).join('') + '<\/ul>';\n  }\n  function emailForm(){\n    return '<div class=\"msq-sub\"><p><strong>Get the next one.<\/strong> We publish new articles on ' + meta.category\n      + ' most weeks and recheck this page on Sundays. Email me when a new article goes up or this page changes.<\/p>'\n      + '<form class=\"msq-form\" method=\"post\" action=\"\/mail\/form.php\" novalidate>'\n      + '<input type=\"hidden\" name=\"list\" value=\"' + meta.list + '\">'\n      + '<input type=\"hidden\" name=\"name\" value=\"\">'\n      + '<label class=\"msq-hp\" aria-hidden=\"true\">Leave this empty<input type=\"text\" name=\"website\" tabindex=\"-1\" autocomplete=\"off\"><\/label>'\n      + '<input type=\"email\" name=\"email\" placeholder=\"you@example.com\" required aria-label=\"Email address\" autocomplete=\"email\">'\n      + '<button type=\"submit\" class=\"msq-btn\">Email me the updates<\/button>'\n      + '<a href=\"#\" class=\"msq-no\">No thanks<\/a>'\n      + '<p class=\"msq-privacy\">We store your email and this page\\'s topic, nothing else. Unsubscribe any time.<\/p>'\n      + '<\/form><p class=\"msq-msg\" aria-live=\"polite\"><\/p><\/div>';\n  }\n  \/* The autoresponder always answers 200 with its own page. A \".msg.err\" box means the\n     address was rejected, \"You're subscribed\" means accepted, and a redirect only happens\n     after a successful subscribe. Same reading as the landing pages on the other sites. *\/\n  function sendForm(form){\n    return fetch(form.getAttribute('action'), { method: 'POST', body: new FormData(form), credentials: 'same-origin', redirect: 'manual' })\n      .then(function(res){\n        if (res.type === 'opaqueredirect') { return { status: 'ok' }; }\n        if (res.status === 404) { return { status: 'notlive' }; }\n        if (!res.ok) { throw new Error('HTTP ' + res.status); }\n        return res.text().then(function(t){\n          var doc = new DOMParser().parseFromString(t, 'text\/html');\n          var err = doc.querySelector('.msg.err');\n          if (err) {\n            var m = err.textContent.trim();\n            if (\/something went wrong\/i.test(m)) { throw new Error(m); }\n            return { status: 'rejected', message: m };\n          }\n          if (\/you.re subscribed\/i.test(doc.body.textContent)) { return { status: 'ok' }; }\n          return { status: 'unknown' };\n        });\n      });\n  }\n  function wireForm(sub){\n    var form = qs(sub, '.msq-form'), msg = qs(sub, '.msq-msg');\n    qs(form, '.msq-no').addEventListener('click', function(e){\n      e.preventDefault();\n      sub.innerHTML = '<p class=\"msq-msg\">No problem. The Sunday refresh keeps this page current either way.<\/p>';\n      track('quiz_email', { result: 'declined' });\n    });\n    form.addEventListener('submit', function(e){\n      e.preventDefault();\n      var input = qs(form, 'input[name=email]'), btn = qs(form, '.msq-btn');\n      var email = input.value.trim(); input.value = email;\n      if (!\/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$\/.test(email)) { msg.textContent = 'That email does not look right.'; return; }\n      btn.disabled = true; btn.textContent = 'Sending';\n      function reset(){ btn.disabled = false; btn.textContent = 'Email me the updates'; }\n      sendForm(form).then(function(r){\n        if (r.status === 'ok' || r.status === 'unknown') {\n          sub.innerHTML = '<p class=\"msq-msg\"><strong>Done.<\/strong> We will email you when the next article on ' + meta.category\n            + ' goes up and when this page changes. If a confirmation email arrives, click it.<\/p>';\n          track('quiz_email', { result: r.status });\n          if (r.status === 'ok') { track('generate_lead', { method: 'quiz' }); }\n        } else if (r.status === 'notlive') {\n          msg.textContent = 'Sign up is not switched on yet for this site. Nothing was stored.'; reset();\n          track('quiz_email', { result: 'notlive' });\n        } else {\n          msg.textContent = r.message || 'Please check the email address and try again.'; reset();\n          track('quiz_email', { result: 'rejected' });\n        }\n      }).catch(function(){\n        msg.textContent = 'Could not reach the sign up service just now. Nothing was stored.'; reset();\n        track('quiz_email', { result: 'error' });\n      });\n    });\n  }\n  function finish(container, mode, score, total, missed){\n    var result = qs(container, '.msq-result');\n    track('quiz_complete', { mode: mode, score: score, total: total });\n    var h;\n    if (mode === 'pre') {\n      h = '<h3>You knew ' + score + ' of ' + total + ' before reading.<\/h3>';\n      h += (score === total) ? '<p>All of them. Read on anyway; the sections below carry the detail behind each answer.<\/p>'\n                             : '<p>The rest is below. Jump straight to what you missed:<\/p>' + jumpList(missed);\n      try { sessionStorage.setItem('msq-pre-' + meta.slug, String(score)); } catch (e) {}\n    } else {\n      var pre = null;\n      try { pre = sessionStorage.getItem('msq-pre-' + meta.slug); } catch (e) {}\n      h = '<h3>You got ' + score + ' of ' + total + '.<\/h3>';\n      if (pre !== null) { h += '<p>Before reading you had ' + pre + ' of ' + total + '.<\/p>'; }\n      if (missed.length) { h += '<p>Worth a second look:<\/p>' + jumpList(missed); }\n      h += emailForm();\n    }\n    result.innerHTML = h; result.hidden = false;\n    if (mode !== 'pre') { wireForm(qs(result, '.msq-sub')); }\n    result.scrollIntoView({ behavior: 'smooth', block: 'nearest' });\n  }\n  function setup(container, mode){\n    var qEls = qsa(container, '.msq-q'), answered = 0, score = 0, missed = [];\n    qEls.forEach(function(q){\n      var answer = q.getAttribute('data-answer'), opts = qsa(q, '.msq-opt'), explain = qs(q, '.msq-explain');\n      q.removeAttribute('data-done'); explain.hidden = true; qs(explain, '.msq-verdict').textContent = '';\n      opts.forEach(function(b){ b.disabled = false; b.classList.remove('is-right', 'is-wrong'); });\n      opts.forEach(function(b){\n        b.addEventListener('click', function(){\n          if (q.getAttribute('data-done')) { return; }\n          q.setAttribute('data-done', '1');\n          var ok = b.getAttribute('data-opt') === answer;\n          opts.forEach(function(o){ o.disabled = true; if (o.getAttribute('data-opt') === answer) { o.classList.add('is-right'); } });\n          if (ok) { score += 1; } else { b.classList.add('is-wrong'); missed.push(q); }\n          qs(explain, '.msq-verdict').textContent = ok ? 'Right. ' : 'Not quite. ';\n          explain.hidden = false;\n          answered += 1;\n          track('quiz_answer', { mode: mode, question: q.getAttribute('data-q'), correct: ok ? 1 : 0 });\n          if (answered === qEls.length) { finish(container, mode, score, qEls.length, missed); }\n        });\n      });\n    });\n  }\n  var box = qs(root, '.msq-box');\n  setup(root, 'pre');\n  if (box) { box.addEventListener('toggle', function(){ if (box.open) { track('quiz_open', { mode: 'pre' }); } }); }\n  \/* The end block sits far below this script, so it does not exist yet while this runs\n     during parsing. A delegated listener finds it at click time. *\/\n  document.addEventListener('click', function(e){\n    var startBtn = (e.target && e.target.closest) ? e.target.closest('.msq-start-test') : null;\n    if (!startBtn) { return; }\n    var end = startBtn.closest('.msq-end');\n    if (!end) { return; }\n    var mount = qs(end, '.msq-mount');\n    var clone = qs(root, '.msq-body').cloneNode(true);\n    var intro = qs(clone, '.msq-intro');\n    if (intro) { intro.textContent = 'The same five questions, now that you have read the page.'; }\n    var res = qs(clone, '.msq-result'); if (res) { res.hidden = true; res.innerHTML = ''; }\n    mount.innerHTML = ''; mount.appendChild(clone);\n    setup(mount, 'test');\n    startBtn.hidden = true;\n    track('quiz_open', { mode: 'test' });\n    mount.scrollIntoView({ behavior: 'smooth', block: 'start' });\n    var first = qs(mount, '.msq-opt'); if (first) { first.focus({ preventScroll: true }); }\n  });\n  \/* Shared tool behaviour: checklists remember their ticks on this device, and a chooser\n     shows the result for the option picked. Calculators carry their own small script. *\/\n  function initTools(){\n    qsa(document, '.msq-check').forEach(function(box){\n      var key = 'msq-check-' + meta.slug + '-' + (box.getAttribute('data-id') || 'x');\n      var boxes = qsa(box, 'input[type=checkbox]'), count = qs(box, '.msq-check-count');\n      var yes = qs(box, '.msq-verdict-yes'), no = qs(box, '.msq-verdict-no');\n      var saved = {};\n      try { saved = JSON.parse(localStorage.getItem(key) || '{}'); } catch (e) {}\n      boxes.forEach(function(cb, i){ if (saved[i]) { cb.checked = true; } });\n      function refresh(){\n        var n = boxes.filter(function(cb){ return cb.checked; }).length, state = {};\n        boxes.forEach(function(cb, i){ if (cb.checked) { state[i] = 1; } });\n        try { localStorage.setItem(key, JSON.stringify(state)); } catch (e) {}\n        if (count) { count.textContent = n + ' of ' + boxes.length + (box.getAttribute('data-verb') || ' done'); }\n        if (yes && no) { yes.hidden = n === 0; no.hidden = n !== 0; }\n      }\n      boxes.forEach(function(cb){ cb.addEventListener('change', function(){ refresh(); track('tool_check', { tool: box.getAttribute('data-id') }); }); });\n      refresh();\n    });\n    qsa(document, '.msq-choose').forEach(function(box){\n      var results = qsa(box, '.msq-choice-result');\n      qsa(box, 'input[type=radio]').forEach(function(r){\n        r.addEventListener('change', function(){\n          results.forEach(function(el){ el.hidden = el.getAttribute('data-for') !== r.value; });\n          track('tool_choose', { tool: box.getAttribute('data-id'), choice: r.value });\n        });\n      });\n    });\n  }\n  \/\/ read progress: how far down the article the reader has scrolled, fired once per quarter\n  (function(){\n    var art = root.closest('article') || root.parentNode, fired = {};\n    function check(){\n      var top = art.getBoundingClientRect().top + window.pageYOffset, h = art.offsetHeight || 1;\n      var seen = (window.pageYOffset + window.innerHeight - top) \/ h * 100;\n      [25, 50, 75, 100].forEach(function(m){ if (seen >= m && !fired[m]) { fired[m] = true; track('read_progress', { percent: m }); } });\n    }\n    window.addEventListener('scroll', check, { passive: true }); window.addEventListener('load', check);\n  })();\n  if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', initTools); } else { initTools(); }\n})();<\/script>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-is-coolwallet-and-who-actually-makes-it\">What is CoolWallet, and who actually makes it?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">CoolWallet is the hardware wallet line from CoolBitX, a Taiwanese company. The premise is one idea carried through stubbornly: build the wallet to the dimensions of a bank card so it lives in the slot beside your travel card instead of a drawer you never open. The <a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-pro\" target=\"_blank\" rel=\"noopener\">CoolWallet Pro product page<\/a> gives the card as 85.6 by 53.98 by 0.8 millimetres, which is credit card footprint at slightly under a millimetre thick.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The private key is generated and held on the card. The phone app is the screen, the keyboard and the address book. That split is the single most important thing to understand about the product, and every section below is really a consequence of it. If the phrase private key on the device is doing no work for you yet, start with <a href=\"https:\/\/getbitcoin.guide\/articles\/non-custodial-crypto-wallet\/\">what non custodial actually means<\/a> and come back.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-coolwallet-models-are-actually-on-sale\">Which CoolWallet models are actually on sale?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Three, as of 6 September 2026, according to <a href=\"https:\/\/www.coolwallet.io\/\" target=\"_blank\" rel=\"noopener\">CoolWallet&#8217;s own store<\/a>. Most review sites still write as though there are two, which tells you roughly when they last opened the page.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr>\n<th>Model<\/th><th>How it talks to your phone<\/th><th>Power<\/th><th>Secure element<\/th><th>Price on the CoolWallet store<\/th>\n<\/tr><\/thead><tbody>\n<tr><td>CoolWallet Go<\/td><td>NFC tap only, described on the product page as &#8220;no Bluetooth, no USB&#8221;<\/td><td>Battery free, with a lifetime warranty<\/td><td>CC EAL 6+ certified microcontroller<\/td><td>NT$2,167<\/td><\/tr>\n<tr><td>CoolWallet Pro<\/td><td>Encrypted Bluetooth, working &#8220;within 10 m of the authorized mobile device&#8221;<\/td><td>15 mAh rechargeable lithium ion, about 2 hours to charge<\/td><td>CC EAL 6+ certified microcontroller<\/td><td>NT$4,679<\/td><\/tr>\n<tr><td>CoolWallet S<\/td><td>Encrypted Bluetooth<\/td><td>Rechargeable, older generation<\/td><td>Described by Kraken in 2020 as EAL 5+<\/td><td>Listed on the homepage with no price shown<\/td><\/tr>\n<\/tbody><\/table><figcaption class=\"wp-block-table__caption\">Specifications and prices as published on CoolWallet&#8217;s own product pages, checked 6 September 2026.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The Go is the interesting arrival and the one almost nobody covers. It has no battery and no Bluetooth radio, and the <a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-go\" target=\"_blank\" rel=\"noopener\">Go product page<\/a> puts the same CC EAL 6+ certified chip inside it as the Pro. Both cards are listed as supporting 35 or more blockchains and over 12,000 tokens, and both require Android 7.0 or later, or iOS 15.6 or later on an iPhone 6S or newer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A correction to our own September reading. The Go&#8217;s standard warranty is two years with no registration needed, and the lifetime cover is an add on: the <a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-go\" target=\"_blank\" rel=\"noopener\">Go product page<\/a>, read on 18 October 2026, says it has to be registered within 30 days of the invoice date or bought within 30 days of the card. The table above, compiled on 6 September 2026, called it a lifetime warranty without that condition, which is exactly the sort of shortcut this review complains about in others.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One number in that table deserves a second look. The Pro carries a 15 mAh lithium ion battery, quoted at roughly two weeks on about two transactions a day and up to three months on standby. A battery is a consumable. A device sold partly on the promise of holding coins for years contains a component that measurably does not last years, and no review that earns a commission on the sale will open with that sentence.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1376\" height=\"768\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/different-card-models-comparison-coolwallet-review.jpg\" alt=\"Three different thin card hardware wallets laid out for a coolwallet review comparison.\" class=\"wp-image-155\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/different-card-models-comparison-coolwallet-review.jpg 1376w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/different-card-models-comparison-coolwallet-review-300x167.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/different-card-models-comparison-coolwallet-review-1024x572.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/different-card-models-comparison-coolwallet-review-768x429.jpg 768w\" sizes=\"auto, (max-width: 1376px) 100vw, 1376px\" \/><figcaption class=\"wp-block-image__caption\">Different card models offer distinct security features and connection options.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-chart.png\" alt=\"Coolwallet review price chart in New Taiwan dollars: Go at 2,167, Pro at 4,679, from the CoolWallet store on 6 September 2026.\" class=\"wp-image-256\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-chart.png 1600w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-chart-300x169.png 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-chart-1024x576.png 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-chart-768x432.png 768w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-chart-1536x864.png 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><figcaption class=\"wp-block-image__caption\">Prices as published on CoolWallet&#8217;s product pages on 6 September 2026, in New Taiwan dollars. The battery free Go carries the same certified chip as the Pro and no radio.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"is-bluetooth-on-a-hardware-wallet-a-security-problem\">Is Bluetooth on a hardware wallet a security problem?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It is a real attack surface, and CoolBitX has had to close a hole in it once. On 18 December 2020 the company published <a href=\"https:\/\/www.coolwallet.io\/blogs\/blog\/bluetooth-security-vulnerability-seed-replay-attack\" target=\"_blank\" rel=\"noopener\">an advisory describing a seed replay attack<\/a> against the encrypted Bluetooth protocol used by the CoolWallet S. The advisory states that an attacker could &#8220;re-execute the commands with the same payloads on the second CoolWallet with the data retrieved from the Bluetooth protocol from the first CoolWallet&#8221;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three conditions had to hold at once: the owner used basic wallet creation or recovery through an outdated app version, a malicious actor was physically within 30 metres at that moment, and that actor had a second CoolWallet already prepared to intercept. CoolBitX fixed it in CoolWallet App version 2.9.1 and CoolWallet S firmware version 106, and told users to update both.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Read that as an argument about firmware currency rather than an argument about Bluetooth. Any radio widens the circle of people who can talk to your wallet without touching it. The Go answers this by removing the radio: an NFC tap works over centimetres, so the attacker has to be close enough for you to elbow. CoolWallet sells that as convenience. It is also the stronger security position of the two, and it is worth saying so plainly. The same argument splits SafePal&#8217;s range, where <a href=\"https:\/\/getbitcoin.guide\/articles\/safepal-wallet-review\/\">two models sign by QR code and the Bluetooth X1 does not<\/a>, a distinction the review sites tend to flatten.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-did-kraken-security-labs-find-in-the-coolwallet-s\">What did Kraken Security Labs find in the CoolWallet S?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On 3 April 2020, <a href=\"https:\/\/blog.kraken.com\/post\/4384\/inside-kraken-security-labs-flaws-found-in-coolwallet-s-hardware-wallets\/\" target=\"_blank\" rel=\"noopener\">Kraken Security Labs published<\/a> its assessment of the CoolWallet S. The finding was that the Android application stored the wallet PIN, the pairing password and the hardware seed in plaintext, and that &#8220;PIN verification cannot be performed on the hardware wallet itself. Instead, PIN verification is performed on the host&#8221;. A compromised phone therefore handed an attacker everything needed to drain the paired card.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CoolBitX <a href=\"https:\/\/www.coolwallet.io\/blogs\/blog\/our-response-to-kraken-security-labs\" target=\"_blank\" rel=\"noopener\">responded the same day<\/a>. It disabled critical logging so sensitive data stopped being written out, blocked third party screenshots and screen recording while a seed or PIN is on screen, and changed memory handling so sensitive values are collected faster. Those fixes are six years old now and long since shipped.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The architectural lesson has not aged at all. A CC EAL certification describes the chip, not the product. The chip in the CoolWallet S was doing its job the entire time; the companion app was the part writing secrets into logs. Every wallet whose interface lives on your phone inherits that shape of risk, which is the same reason a phone based wallet like <a href=\"https:\/\/getbitcoin.guide\/articles\/trust-wallet-review\/\">Trust Wallet is not cold storage<\/a> no matter how careful you are with it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-does-the-card-format-change-your-backup-problem\">How does the card format change your backup problem?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It does not change it at all, and that is the part worth sitting with. A CoolWallet is a way to sign transactions without exposing a key to your phone. It is not a way to survive losing the card. If the card is lost, snapped, stolen inside your wallet or simply flat when you need it, the recovery phrase is the only thing standing between you and a total loss.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"627\" src=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-3.jpg\" alt=\"Craftsman engraving metal under a focused lamp, the durable backup a coolwallet review points readers toward\" class=\"wp-image-95\" srcset=\"https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-3.jpg 1200w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-3-300x157.jpg 300w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-3-1024x535.jpg 1024w, https:\/\/getbitcoin.guide\/articles\/wp-content\/uploads\/2026\/09\/coolwallet-review-3-768x401.jpg 768w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><figcaption class=\"wp-block-image__caption\">The card is replaceable. The recovery phrase behind it is not.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Which raises the obvious tension with the format. The whole selling point is that the card travels with you, in the object most likely to be pickpocketed, sat on, or left in a taxi. A device you carry daily needs a backup you have actually tested, stored somewhere the card never goes. The failure modes are boringly consistent across every brand, and they are catalogued in <a href=\"https:\/\/getbitcoin.guide\/articles\/your-recovery-phrase\/\">the ways people actually lose a recovery phrase<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One rule holds regardless of hardware. Your recovery phrase is entered on the device itself during setup or recovery, and nowhere else. No genuine support agent, verification page, airdrop checker or wallet migration tool needs it. Any site or person asking you to type it is stealing from you, without exception.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"does-the-card-format-suit-the-way-you-hold-coins\">Does the card format suit the way you hold coins?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">That depends on a question about behaviour rather than a question about products: how often do you actually sign something? A card in your pocket is built around frequent, mobile signing. If you move funds a few times a year and otherwise leave them alone, you are paying a portability premium, and carrying your keys through airports, for a convenience you will use twice.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you do sign often and from your phone, the card format is a genuinely good answer to a real problem, and the Go removes the radio from the equation entirely. Either way the decision is a security fit question, not a shopping question, and <a href=\"https:\/\/getbitcoin.guide\/articles\/best-crypto-wallet\/\">how to choose a crypto wallet<\/a> and <a href=\"https:\/\/getbitcoin.guide\/articles\/what-is-a-cold-wallet\/\">what cold storage actually means<\/a> both frame it better than a star rating ever will.<\/p>\n\n\n\n<div class=\"msq-tool msq-choose\" data-id=\"sign-96\">\n<h3>How often do you actually sign something?<\/h3>\n<p>The card format is a behaviour question before it is a product question. Pick the honest answer. Nothing here is a recommendation to buy anything.<\/p>\n<label><input type=\"radio\" name=\"sign96\" value=\"rare\">A few times a year, then I leave it alone<\/label>\n<label><input type=\"radio\" name=\"sign96\" value=\"often\">Often, and mostly from my phone<\/label>\n<label><input type=\"radio\" name=\"sign96\" value=\"owner\">I already own a CoolWallet S<\/label>\n<div class=\"msq-choice-result\" data-for=\"rare\" hidden><strong>You would be paying a portability premium<\/strong> for a convenience you would use twice, and carrying your keys through airports to do it. A device that lives in a drawer suits that pattern; the card was built for pockets.<\/div>\n<div class=\"msq-choice-result\" data-for=\"often\" hidden><strong>The card answers a real problem.<\/strong> The Go removes the radio entirely, so an attacker has to be close enough to elbow, which is the stronger security position of the two. Either way the backup, tested and stored somewhere the card never goes, is what survives losing the card.<\/div>\n<div class=\"msq-choice-result\" data-for=\"owner\" hidden><strong>Check the firmware first.<\/strong> CoolBitX named CoolWallet App 2.9.1 and CoolWallet S firmware 106 as the versions that closed the 2020 Bluetooth seed replay flaw, and the Kraken finding the same year was fixed in the app. If either is older than that, updating is the whole point of the advisories.<\/div>\n<p class=\"msq-note\">Whichever you pick, the recovery phrase is entered on the device during setup or recovery and nowhere else, ever.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-do-the-affiliate-reviews-leave-out\">What do the affiliate reviews leave out?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Three things, consistently. First, biometrics. A widely syndicated review of the Pro describes fingerprint and facial recognition protecting the wallet. CoolWallet&#8217;s own Pro specification page, fetched on 6 September 2026, lists dimensions, battery, chip certification and operating range, and does not list any biometric verification method. A face check on your phone is not a check performed by the card, and the two are routinely blurred together.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, the display. The same specification page lists no display specification, so treat descriptions of the on card screen as reported rather than confirmed from the manufacturer. This matters more than it sounds: the size of the screen you verify a transaction on determines how much of that transaction you can actually check before you approve it. Hardware wallets with roomier screens, such as the <a href=\"https:\/\/getbitcoin.guide\/articles\/ledger-nano-x-review\/\">Ledger Nano X<\/a> or a <a href=\"https:\/\/getbitcoin.guide\/articles\/trezor-hardware-wallet\/\">Trezor<\/a>, make a different bet on that tradeoff.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Third, the 2020 advisories. Both are published by CoolBitX itself and neither is hard to find, yet the pages ranking for this product mostly do not mention them. A vendor that discloses a Bluetooth flaw, names the fixed versions and tells people to update is behaving well. A review that omits the disclosure is not, and it leaves the reader unable to answer the only question that matters here, which is whether their firmware is current.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-has-changed-since-this-was-first-published\">What has changed since this was first published?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>As of October 2026 the CoolWallet store shows the <a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-pro\" target=\"_blank\" rel=\"noopener\">Pro at 149 US dollars<\/a> and the <a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-go\" target=\"_blank\" rel=\"noopener\">Go at 69 US dollars<\/a> for a set of two cards. On 6 September 2026 the same pages showed NT$4,679 and NT$2,167. The store appears to show prices in the visitor&#8217;s currency, so read this as a change in what our visit was shown, not as evidence that the price moved.<\/li>\n\n\n\n<li>Corrected in October 2026: the Go&#8217;s warranty is two years as standard, with lifetime cover as a registered add on, per the <a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-go\" target=\"_blank\" rel=\"noopener\">Go product page<\/a>. September&#8217;s version of this article said lifetime warranty without the condition.<\/li>\n\n\n\n<li>Found in October 2026: the <a href=\"https:\/\/www.coolwallet.io\/products\/coolwallet-pro\" target=\"_blank\" rel=\"noopener\">Pro product page<\/a> gives two different battery figures, about 2 hours to charge and up to 3 months on standby in its specification list, and 4 to 6 hours and 2 to 3 months in its own FAQ. We report both rather than pick one.<\/li>\n\n\n\n<li>On 15 June 2026 CoolBitX ended the fiat on and off ramp inside the CoolWallet App, which a partner called Bridge had run, per <a href=\"https:\/\/www.coolwallet.io\/blogs\/blog\/important-notice-termination-of-fiat-on-off-ramp-services-on-coolwallet-app\" target=\"_blank\" rel=\"noopener\">its own notice<\/a>. The company says assets on the card were not affected. A search on 18 October 2026 found no new CoolBitX security advisory since the two from 2020 covered above.<\/li>\n\n\n\n<li>In October 2026 a Ledger investigation into devices sold by its authorised South East Asia reseller CryptoBilis, <a href=\"https:\/\/decrypt.co\/380706\" target=\"_blank\" rel=\"noopener\">reported by Decrypt<\/a>, put supply chains back in the news. That case concerns Ledger devices and we found no confirmed case involving a CoolWallet, but the lesson applies to every card: a reseller badge is not a seal. Our <a href=\"https:\/\/getbitcoin.guide\/articles\/ledger-device-comparison\/\">comparison of Ledger devices and the reseller risk<\/a> sets out what the investigation found.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-q-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does a CoolWallet work without a phone?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. The card has no independent interface for building a transaction, so the CoolWallet app on a paired Android or iOS device is required to use it. CoolWallet lists Android 7.0 or later and iOS 15.6 or later, on an iPhone 6S or newer.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What happens to my coins if CoolBitX stops trading?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Your coins are on the blockchain, not on the card, and your recovery phrase is a standard seed. It can be restored into other compatible wallet software. That is true of any hardware wallet and it is the practical reason the phrase matters more than the device.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is the CoolWallet S still worth updating if I own one?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>If you hold funds on one, keeping the app and firmware current is the whole point of the 2020 advisories. CoolBitX named CoolWallet App 2.9.1 and firmware 106 as the versions that closed the Bluetooth seed replay issue, and the app has moved on considerably since then.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can someone read my CoolWallet by walking past me?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Not in the sense of extracting a key. The 2020 Bluetooth advisory required an outdated app, a second prepared CoolWallet and proximity of about 30 metres during wallet creation or recovery. The NFC based Go removes the radio range question because a tap needs contact.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does an EAL 6+ certification mean the wallet cannot be hacked?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. The certification applies to the secure element chip, not to the app, the phone or the person using them. The Kraken finding in 2020 is the clearest illustration available: the certified chip held, and the companion software was the weak point.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-q-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is a card shaped wallet less durable than a stick shaped one?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>CoolWallet gives the card as 0.8 millimetres thick and does not publish a durability rating we could verify, so treat bend and water claims found elsewhere as unconfirmed. Whatever the answer, durability is a reason to test your backup, not a reason to skip it.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<div class=\"msq-end\" id=\"ms-quiz-end\">\n<p><strong>Finished the page?<\/strong> The same five questions from the top, to see what stuck.<\/p>\n<button type=\"button\" class=\"msq-btn msq-start-test\">Test Your Understanding of This Article<\/button>\n<div class=\"msq-mount\"><\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. You are responsible for your own security decisions.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CoolWallet builds hardware wallets the shape of a bank card. Here is what CoolBitX documents, what its own security advisories said, and where the format costs you.<\/p>\n","protected":false},"author":1,"featured_media":93,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","rank_math_title":"CoolWallet Review: The Card Format and Its Tradeoffs","rank_math_description":"A coolwallet review of the Go, Pro and S cards: what CoolBitX documents, the two security advisories of 2020, and what the card format really costs.","rank_math_focus_keyword":"coolwallet review","rank_math_canonical_url":"","rank_math_breadcrumb_title":"","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_facebook_image":"","rank_math_twitter_title":"","rank_math_twitter_description":"","rank_math_twitter_image":"","rank_math_pillar_content":"","rank_math_robots":[],"rank_math_advanced_robots":[]},"categories":[2],"tags":[],"class_list":["post-96","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wallets"],"_links":{"self":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/96","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/comments?post=96"}],"version-history":[{"count":9,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/96\/revisions"}],"predecessor-version":[{"id":650,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/posts\/96\/revisions\/650"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media\/93"}],"wp:attachment":[{"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/media?parent=96"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/categories?post=96"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/getbitcoin.guide\/articles\/wp-json\/wp\/v2\/tags?post=96"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}