Bitcoin Stack Exchange is a question and answer site for Bitcoin users, developers, and enthusiasts. It only takes a minute to sign up.
Sign up to join this community
Open source Bitcoin wallets are clearly in demand for obvious reasons. Users want to know what the code is intended to do and what may be possible.
Is it even possible for closed source wallets to be completely trustless (meaning I do not need to trust anyone other than myself to keep my Bitcoin secure)? How can this be verified without seeing the source code of the hardware or software wallet?
The term trustless is often misunderstood. I suspect you mean not needing to trust anyone, but if a program being open source helps for that, aren't you implicitly relying on the people who are capable of reviewing the source code to have actually done so? Isn't that also a form of trust? Of course it is. Every production system needs to trust various aspects of the infrastructure: the hardware it's running on, the compiler that was used, the operating system, and last but not least the human operating it.
The trust we're talking about in "trustless" is an abstract technical term. A distributed system is called trustless when it does not require any trusted parties to function correctly. In that sense, a "trustless wallet" does not make sense: wallets are an implementation aspect of a cryptocurrency, the design of which may or may not rely on trusted parties. The wallet software being open or closed source doesn't change this.
Does that mean you should use a closed-source wallet? Hell no. Not because it's "trustless" or not, but because there is no chance it'll have been sufficiently reviewed (unless, perhaps, you have access to the source code under NDA and paid for thorough review yourself).
No because bitcoin wallets always have access to private keys and have the ability to communicate across the Internet. With this combination of capabilities, closed source wallets could become attacked (either by an insider or an outsider) in a manner that would be unknown to the user. The biggest concern would be a key stealing/ exfiltrating module that would relay private keys to a malicious party.
