Key facts
- A critical entropy bug in Coldcard hardware wallets, active since at least 2021, has been exposed.
- The bug allowed hackers to guess private keys, leading to potential loss of funds.
- Self-custody experts are now recommending multi-vendor multisignature setups as a new security baseline.
- Multi-vendor multisig requires multiple keys from different hardware wallet manufacturers to authorize transactions.
- This strategy aims to mitigate risks associated with single-vendor dependency and hardware vulnerabilities.
- Nick Neuman, CEO of Casa, reported that 233,000 BTC were moved to safety in response to the Coldcard incident.
A significant entropy bug discovered in Coldcard hardware wallets, which had been present since at least 2021, has prompted a reassessment of Bitcoin self-custody practices. The vulnerability allowed for the guessing of private keys, leading to concerns about fund security and potential theft.
In response, self-custody advocates and experts are now widely recommending a shift towards multi-vendor multisignature setups. This approach involves using hardware wallets from different manufacturers to generate keys, requiring multiple signatures to authorize any transaction. The theory is that by distributing trust across multiple vendors, users can mitigate the risk of a single hardware provider's failure, such as the entropy bug seen in Coldcard.
Nick Neuman, CEO of Casa, noted that approximately 233,000 bitcoins were moved to safety following the Coldcard incident. This event underscores the inherent risks in relying on a single point of failure for private key generation, even with reputable wallet providers. Multisig setups, particularly those employing keys from distinct vendors, are seen as a more robust defense against both hardware-specific bugs and other threats like theft.
Examples of multisig configurations include using a Trezor wallet for one key, a Ledger for another, and a third key from a multisig provider like Casa, requiring two out of three signatures. Specialized multisig wallet providers such as Casa, Nunchuck, Sparrow desktop wallet, and Unchained Capital facilitate the creation and management of these complex security structures. Some providers, like Casa and Unchained Capital, offer a company-controlled recovery key, while others, like Nunchuck and Sparrow, emphasize full user autonomy.