Unchained has published an analysis of the Coldcard security incident, arguing that multisig wallet structures shielded thousands of bitcoin while singlesig users were left immediately exposed.
On July 30, 2026, Coinkite issued a security advisory covering a vulnerability affecting most Coldcard hardware wallets.
According to Unchained’s breakdown, the flaw sat in the device’s random number generator, meaning the entropy behind key generation was far weaker than users believed.
“The entropy wasn’t nearly as unpredictable or random as people believed, and the number of possible seeds and keys that could be produced was much smaller than it needed to be.”
Because entropy is the base layer, every layer above it inherited the weakness:
“Because entropy is the foundational starting point, its lack of security means every other layer built on top of it is insecure as well.”
Attackers scanned common derivation paths and found keys tied to live balances.
“As soon as they found a key that was controlling a balance, the attacker could then use the key to move the bitcoin into a wallet they alone control, stealing the bitcoin.”
In a 2-of-3 setup, a single compromised key is not enough.
“If one key is stolen (or in this case, compromised by an existential RNG bug), the thief doesn’t have enough keys to access any bitcoin.”
Even wallets built entirely from Coldcard keys retained some protection, since attackers would need to correctly pair three key sets against an address.
“It’s clear at this point that multisig gave many users additional fault-tolerance and time to respond.”
Unchained also rolled out direct-to-miner transaction submission to reduce RBF attack risk while spends sat unconfirmed in public mempools.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
