A Dark Day for Self-Custody

The Coldcard Failure and How to Protect Against It

Dear Bitcoiners,

Over the past weeks, we have been comparing this bottom formation to previous cycles and analyzing it from many angles, including the On-Chain Value Map, CVDD, Realized Price, STH Bands, and Capitulation Zones.

We have also discussed the possibility of a final leg down. In the previous cycle, it took an FTX-style event for that to happen.

This bear market is progressing with its own set of events: treasury companies became net sellers, chain-split risk is on the rise due to BIP-110, and an even more immediate and important threat emerged: a serious vulnerability affecting seed phrases generated by Coldcard hardware wallets, resulting in many wallets being swept.

Unlock access to the Bitcoin Strategy Platform with all premium curated live charts and indicators. Claim your 25% lifetime discount today!

A Dark Day for Self-Custody

This is one of the darkest days for self-custody. People who secured their Bitcoin with a respected hardware wallet and believed they had done everything right are now having their wallets drained. As we watch the Coldcard situation unfold, there is confusion, fear, and a growing number of victims.

My heart goes out to everyone affected, and I truly hope you are unaffected. If you generated a seed on an affected Coldcard, please take action as soon as possible, but carefully.

My hope is that many Coldcard users, who are generally more tech-savvy, have protected themselves against this type of attack.

In this newsletter, I will explain what happened and what we can do to protect ourselves against similar attacks in the future, which will get more common with advances in AI.

AI Threat

Most likely, AI has been used to review old versions of the open-source firmware and discover the vulnerability. However, this has not been proven. But it is clear that AI models allow attackers to inspect software much faster and identify vulnerabilities that are much more difficult to find through conventional code review. Therefore, especially if you use a single seed setup, whether with a Coldcard or another hardware wallet, read this newsletter carefully.

Affected Versions

The most serious vulnerability affects seeds generated on a Coldcard Mk3. Independent analysis also flagged some Mk2 devices. Seeds generated on affected versions of the Mk4, Mk5, and Q are also at risk. However, these later devices retained more entropy, making them much more difficult to attack.

👉 Key insight: This is a seed-generation vulnerability.

If you created the seed somewhere else and only imported it into the Coldcard, that seed was not generated through the vulnerable process.

Updating the firmware does not repair an existing vulnerable seed. You need to generate a completely new seed, preferably with a different hardware wallet provider, and move the funds to the new wallet.

If you added physical dice rolls when generating your seed, you should be secure.

Randomness

A secure seed phrase depends on randomness, but computers are deterministic, which means they follow programmed instructions. Creating truly unpredictable numbers therefore requires carefully designed Random Number Generators and secure sources of physical randomness.

Coldcard’s seed generation was not implemented correctly due to an integration error. For Mk3 devices, the software generator was mainly initialized using device information and timing data. These values could look random but were potentially predictable or reconstructable. The later Coldcard models added randomness from secure elements, which made them safer than the Mk3, but the implementation still did not provide the intended level of security.

Entropy

The difficulty of guessing a seed phrase is expressed through entropy.

• A normal 12-word seed contains 128 bits of entropy.

• A normal 24-word seed contains 256 bits of entropy.

The Coldcard Mk3 seeds only seem to have around 40 bits of entropy.

Affected Mk4, Mk5, and Q seeds are estimated to have around 72 bits of entropy, much lower than the intended 128-bit security target.

👉 Key insight: Guessing the vulnerable Coldcard seeds was roughly as difficult as guessing four missing words from your seed.

40 bits still represents many possible combinations, but as we are finding out, it is not enough against specialized brute-force attacks. Unfortunately, in the case of Coldcard, their 24 words did not create additional security, they simply encoded more of the limited randomness generated by the vulnerable process.

Other Hardware Wallets

I generally do not expect other hardware wallets to fail the minimum 128-bit security target. After all, this is supposed to be one of the most important parts of their core business.

The conclusion is that Coldcard’s development process was truly below par. A simple apology doesn’t cut it, in my opinion.

👉 Key insight: The valuable lesson is that you shouldn’t trust your life savings to a single seed. While I generally expect other hardware wallets to be secure, the rise of AI makes it worth protecting against these attacks.

This newsletter is supported by Roxom. Create an account to access Bitcoin-denominated capital markets. Click here or use code ROOT.

Protecting Against These Attacks

This particular attack was only possible because everything depended on a single seed that was generated by vulnerable software. We could give up on self-custody and send our Bitcoin to an exchange or an ETF. But that, of course, introduces an entirely different set of attacks.

👉 Not your keys, not your coins.

That is not the solution. Bitcoin is about self-sovereignty.

The better approach is to remove the single seed as the single point of failure.

Multisig

Multisig allows several independent seeds to jointly control Bitcoin.

For example, a 2-of-3 multisig wallet has three separate seeds, but only two are needed to spend:

• Key A + Key B

• Key A + Key C

• Key B + Key C

Compromising only one seed is not enough.

👉 Key insight: With 2-of-3 multisig, one weak seed, one hacked device, or one compromised location does not need to result in lost funds.

Migrating to Multisig

If you use another hardware wallet and have no reason to believe its seed is compromised, you can use that existing seed as one signer in a new multisig wallet.

You then need to generate two additional independent seeds.

Important: Your Bitcoin in the existing single-signature wallet does not automatically become multisig. You must create a new multisig wallet and send the Bitcoin to its new receiving address.

If you have an affected Coldcard seed, do not reuse that seed in the new setup. Generate a completely new one, preferably with a different hardware wallet provider.

A setup could look like this:

• Keystore 1: Hardware wallet from provider A.

• Keystore 2: A hot wallet using either a computer generated or independently generated seed.

• Keystore 3: Hardware wallet from provider B.

Each seed should be generated independently.

The devices and their backups should be stored across separate secure locations. No single location should contain enough information to reconstruct two complete signing keys.

A hot wallet using either a computer generated or independently generated seed could serve as the third option. While hot wallets are generally less secure, this still provides protection against a single weak hardware-wallet seed because the attacker would need both keys. However, one of the two keys does need to come from a hardware wallet, as we need at least one device disconnected from the internet.

Main Attack Surfaces

The main risks are:

• Weak seed generation: a device creates a predictable seed.

• Device compromise: a device, computer, or wallet application is hacked.

• Physical compromise: a device is lost, destroyed, or stolen.

We can reduce these risks through three simple principles:

• Different keys.

• Different devices.

• Different locations.

Creating the Multisig

To create the multisig, we need a tool that supports multisig, such as 👉 Sparrow Wallet. Sparrow allows us to combine the three keystores into one multisig wallet. Sparrow supports single-signature and multisig wallets and most common hardware wallets.

The multisig is defined by a descriptor, which will look like this:

wsh(sortedmulti(2, Keystore1, Keystore2, Keystore3))

The wsh means the wallet uses SegWit, a newer way Bitcoin transactions are structured. The sortedmulti means the order of the keystores does not matter because they are sorted automatically. The 2 means that at least two signatures are needed.

The three keystores represent the extended public-key information from the three individual seeds. Sparrow does not need the private keys from hardware wallets.

When you want to spend:

1. Sparrow creates the transaction.

2. You sign it with one device.

3. You sign the same transaction with either of the other two devices.

4. Sparrow combines and broadcasts the completed transaction.

The three signing devices do not need to communicate with each other or be connected at the same time.

Additional Burden of Multisig

The seeds are not the only backups you need.

It is best to back up the multisig wallet descriptor, as it contains the following information:

• The 2-of-3 policy.

• The three extended public keys.

• Their fingerprints.

• Their derivation paths.

• The wallet’s script type.

With this information, the descriptor tells the wallet software how the three seeds form the wallet. Sparrow can export an output descriptor as a text file or display it as a QR code that you can save and print.

It is best to keep a copy of the descriptor at each location. If the descriptor is lost, you should still be able to reconstruct it, but you would need all three seeds or devices instead of two.

Keep It Simple

Multisig removes the single point of failure, but it introduces more complexity. A single-signature setup may still be a good solution, depending on the value and risk tradeoff in your personal situation. However, if you do consider moving to multisig, consider the following.

Before moving substantial funds:

• Practice with a small amount.

• Confirm that all three devices recognize the wallet.

• Verify receiving addresses on the signing devices.

• Complete a test spend using different combinations of signers.

• Test whether you can restore the wallet from your seeds and descriptor.

• Make sure trusted family members understand the recovery process.

The purpose is to keep things as simple as possible while ensuring that no single failure can destroy our savings.

Wrap-Up

I sincerely hope you are not affected by this terrible incident.

I am heartbroken for the victims because many believed they had done everything right. They bought a respected hardware wallet and trusted the device to generate their seed securely. This is a serious setback for the community. Trust in hardware wallets and self-custody has understandably been damaged.

But abandoning self-custody is not the answer. Bitcoin itself did not fail. It was a single wallet implementation that failed, with terrible consequences.

We can protect ourselves by removing single points of failure with multisig. No setup is completely risk-free. However, compromising one seed, one device, or one location should not be enough to steal your life savings.

We learned the hard way: don’t trust, verify.

The pain is real and recent, but we will learn from this and come out stronger! 🧡

Stay safe, 🫡

Until next week, 👊

-Root