1/ Earlier today, our Bitcoin engineering and security teams at Block began investigating reports of non-Bitkey wallets being drained. To proactively protect our customers, we began investigating immediately. Here’s what we found 🧵

we made a kiosk. we made it really smart. you can talk to it if you want. and it looks pretty good too. 

squ.re/kiosk

I enjoyed sitting down with @natbrunell to chat about all the things, including how @Bitkey works and the thought process behind its design.

Lots of people have been asking for a demo of Bitkey's Emergency Exit Kit. So here it is!

This is the way you can move your funds if access to the official Bitkey app ever becomes unavailable to you for any reason.

Hell yeah. Let us know what you think!

Unpopular opinion: word choice isn't the hardest problem we should be solving in self-custody right now

"To our longtime customers, those who have just joined us, and those still exploring self-custody solutions, our team appreciates all your questions and comments."

Far too many people previously dismissed @Bitkey because of group-think

We've changed nothing about our approach: engaging diligently, answering all concerns transparently, winning trust in a time of panic

And now many people's eyes have been opened that it's a great product

We’ve always had @Bitkey source on github and published design information to our blog. Now we’re sharing even more - to help people understand the security updates we ship. Great move from the team!

Some good ideas here - tell us what resonates and what else you want to see from @Bitkey

We’ve been getting a lot of questions about entropy in Bitkey, and answering them in threads. Now our security team has brought the receipts. Take a look: x.com/i/article/2084…

Entropy is the word of the week and we've been getting lots of questions from current and prospective @Bitkey customers.

Our answer below, with many citations:

Short version: depends on the key, either 256 or 512 bits.

Full version for the curious:
Bitkey is a 2-of-3 multisignature wallet, which means your funds are protected by three independently generated keys — one on your phone, one on your Bitkey hardware device, and one in our server-side secure module (WSM). No single key can move funds on its own. Each key is generated locally on its own device from a cryptographically secure random number generator, with no shared or coordinated seed, so the entropy protecting your wallet is the combination of three independent sources.

-- The app key is derived from a 256-bit seed produced by the operating system's cryptographic RNG (SecRandomCopyBytes on iOS and java.security.SecureRandom on Android).

-- The hardware key is generated entirely on your Bitkey device from a 256-bit seed produced by the hardware true-random-number generator (TRNG) inside the secure element of its main chip — a Silicon Labs EFR32MG24 with Secure Vault. The seed is drawn directly from the chip's Secure Engine (via sl_se_get_random), whose TRNG conforms to the NIST SP 800-90 standard, is used to derive the device's BIP32 key, and never leaves the chip.

-- The server key is generated inside an AWS Nitro secure enclave from a 512-bit master seed drawn from the enclave's cryptographic RNG, backed by the Nitro platform's hardware entropy.

Feedback requested: is an insurance policy something you would pay for on your multi-sig self custody setup?

Downside: likely requires KYC (unlike @Bitkey)

Upside: obvious

It's something we've done a decent amount of looking into in the past. Let us know.

We’ve welcomed a lot of new customers, and one request keeps coming up: coin control. So we’ve fast-tracked it.

Here’s an early proof of concept. Take a look and share your feedback—it’ll help shape what we launch.

The most common question I am getting right now in the fall out of the news of COLD CARD MK3, MK4, MK5 and Q having compromised entropy, is:

"Rob, what would you do right now if you were in my shoes? Where would you send your bitcoin to be safe?"

I will share with you my list of what I would do, but first, there is AN URGENT SECURITY ADVISORY IN THE BITCOIN ECOSYSTEM.

Below is my personal assessment of the situation.

If you or someone you know:

Uses an MK3, MK4, MK5, or Q in a single signature

OR

A multi signature wallet where the cold card devices can move the funds on their own (Example, 2 cold cards and a Ledger).

Please continue reading. You may be in danger. If this does not apply to you, keep on reading if you like, but you are not impacted by this issue.

If you are still here, there are three identified mitigations that protect you at the moment. They are all different forms in which you may have brought your own entropy.

A: DICE - This is done by either rolling dice from the start, or adding dice rolls to the generated seed phrase. At least 50 dice rolls would be my threshold at 128 bits of entropy.

OR

B: PASSPHRASE - You used a passphrase of sufficient entropy (128 bits).

128 Bits of entropy pass phrase examples include RANDOM combinations of the following:

- 12 BIP 39 seed words.
- 10 common words in the english language
- 25 mixed lower case letters and numbers
- 20 if you use ASCII characters

Note on pass phrases: This does not include the same word 12 times, 10 words in a sentence, etc. This combinations of characters/numbers OR words should never have been seen or spoken before in the total sum of all human knowledge and experiences. It needs to be RANDOM for it to be entropy.

OR

C: EXTERNAL ENTROPY - Your seed phrase was derived entirely outside of the cold card ecosystem. (It was imported into the cold card, not generated on it)

Now, if you are still reading, and you do not have any of these mitigations in place, you need to move your funds. The urgency of circumstances are as follows:

TIER 1: AS SOON AS POSSIBLE

Scenario A: If you are in a signature wallet with an effected device, and did not use any of the mitigations listed above. You need to move funds right now. Find someone to help you, any moment your funds can be stolen.

Scenario B: If you have an N of N (eg 2 of 2, 3 of 3, etc) multisig of just cold card devices that did not have mitigations listed above (dice and/or passphrase).

Attackers will be grinding all of the combinations of compromised keys. They know all your seed phrases. You are compromised. It is just a matter of time for them to assemble the puzzle pieces together and steal your funds.

If this scenario is you, I will have more below on how to mitigate risk when broadcasting your transaction.

TIER 2: URGENTLY

If you are in a single signature wallet with an effected device, and you used either less than 50 dice rolls OR a pass phrase less secure than what I shared above. The entire security of your bitcoin is reliant on how much of Dice AND Passphrases you applied to your wallet.

Attackers know your seed phrase. Your entropy from dice or pass phrase is the only thing protecting you. Did you add a pass phrase of 'bitcoin'? You are basically in tier 1. Did you use 6 words? You are not at tier 1, but you aren't safe. You need to make plans to move funds quickly.

TIER 3 SOON, BUT IMPORTANT CONTEXT:

You have a multi signature wallet where the compromised devices have sufficient ability to move the funds. An example is a 2 of 3 multisig where you have 2 cold cards and another signer.

The issue with Tier 3 is that an attacker may have already figured out your insecure seed phrases. This means when you broadcast your bitcoin transaction, an attacker in theory can then steal your funds.

NOTE: IF YOU ARE IN THIS SITUATION, AND YOU HAVE REUSED ADDRESSES, ALL REUSED ADDRESSES PUT YOU RIGHT BACK AT THE TIER 1 MOVE RIGHT AWAY YOUR FUNDS ARE AT RISK AT THIS VERY MOMENT

You should look into finding a way to use the @MARAFoundation_ slipstream service, which uses a private mempool. This means that by the time an attacker could see your attempted recovery, it is already in a block and not possible for them to steal funds.

TIER 4: KEY ROTATION. This is where you have an insecure cold card(s) in your multisig quorum, and you know that the other keys in your quorum are not impacted by this bug.

If there is a MK3,MK4,MK5 or Q in the quorum, BUT they either: 1. Rolled sufficient dice (50 min) 2. Have a strong pass phrase (as defined above). 3. Used entropy not sourced from the device, they are not impacted by this bug in the Cold Card (see notes earlier on mitigations).

You are in a position where a minority of your keys are compromised. Funds are safe, but you are at reduced security. Make plans when you are able to remove the compromised device from your wallet.

Now. With that security advisory out of the way, back to the question, what would I do in this situation?

Below is just my opinion, but you should not rely on only my opinion, you will have to make your own choices based on what you feel is best for you.

I want to be clear, if you are not on this list. It is not that I think your product/business is bad, insecure or at risk, I am directly answering the question of what I would do. This is my personal judgement given my decade of experience in bitcoin.

First, a disclaimer:

My bitcoin is at my company @AnchorWatch. I have full skin in the game in that if I'm offering a custody solution, there will never be another place I store large amounts of bitcoin long term for myself or my family, and it will be this way as long as I am here.

I was the first bitcoin that went on our Trident Vault platform. If the day ever comes, I will be the last bitcoin to leave the platform.

The years of what we built at AnchorWatch were for exactly moments like this. Avoiding catastrophic risk of ruin scenarios.

We offer 2 products:

1. Our Flagship Product where you as the customer can hold 1 or 3 keys, and we act as a cosigner. We leverage bitcoin native smart contracts which allow for your bitcoin to have different ways it can be spent across time.

2. Multi Institution Custody, where we let you distribute your keys across 3 institutions of ourselves, @bitgo and @CoinCorner. 2 of the 3 institutions must sign off on the transaction, and you have to present a Yubikey signature before withdrawing to mitigate deepfake and compromised accounts.

For both products as, since we are a cosigner, we are able to enforce rules like whitelisted addresses, and velocity controls (how much bitcoin can you send how often). You can even disable the send button on the platform if you so choose!

We also offer 1:1 insurance backed by Lloyd's of London.

If you want to learn more about what we do, hit up @_joerodgers or @BeccaAmilee to learn more, or check out our website.

Now with that out of the way, places where I'd leave my bitcoin (besides @AnchorWatch) in no particular order:

Custodian:

I'd trust my life savings at @River under a duress situation. This is one of those times. @Leishman and the entire team at River are elite operators. It is my favorite bitcoin services business in the market today outside of my own.

They own their own custody infrastructure, and at times like this, you want those who have extreme ownership and control over how their customer's money is being managed.

@River does monthly proof of reserves, and you can turn on the force field feature which will freeze withdrawals of bitcoin. They have a world class custody team as well, and are making improvements regularly with a larger upgrade that has been planned for a long time, happening later this year.

Collaborative Custody:

1. The @Bitkey is an incredible product with an elite team of engineers supported by the @BlockEng organization. They have exceptional bitcoin developers across @spiral_xyz and @CashApp teams who deeply understand Bitcoin.

@jack has been a long time believer in bitcoin who has built an organization that has no peer in the resources they have not just understanding bitcoin, but building on bitcoin.

You can pick it up a Bitkey at best buy today!

I do want to add a disclaimer that all keys are managed within the Bitkey ecosystem. The Bitkey team has gone to great lengths to keep things secure, but in light of recent events, I want to call that out. At the moment, the Bitkey is my only exception to a purist ideal of multi vendor multisig (more below).

2. @CasaHODL - @Nneuman and @lopp have been on top of this incidence response, and have built a very clean user experience to let people be safe. You can either use a 2 of 3 or 3 of 5 multisig with a great mobile app. Casa is the best UX for soverign collaborative multisig that exists in the market today.

3. @uncahined - Unchained pioneered the collaborative custody model and the multi institution custody model. They have been working around the clock trying to support customers and have even been able to use slip stream going the extra mile on short notice to keep customers bitcoin safe.

Self Custody:

I have spent close to $5k on LLM tokens over the past 24 hours scanning over a hundred bitcoin related repositories. As of now, I have seen no vulnerability that has me concerned about any hardware device outside of the Cold Cards.

Even so, you can't be sure. So I would follow the @mflaxman "Bitcoin 10x security guide". Its how I held my bitcoin before I founded @AnchorWatch, and even though the guide is 6 years old, the principles are timeless. I would remove his suggestion of using the cold card and replace it with any other hardware wallet. I would replace the cold card with a @Ledger at this time if it were my decision. You can pick up a Ledger up at Best Buy in the US.

Michael pioneered multi vendor multisig as a concept, and if you want a fully sovereign solution, as of today there is no better mental model on how to think through this, he has advanced tabs to further increase the security. For his cold card guide he fairly calls out the added benefit of rolling dice, which would have saved you today.

I think the future is combining the tech we use at @AnchorWatch to move beyond the single signature/ multi signature paradigm of custody, with the principles of @mflaxman's 10x security guide and the support of collaborative custody.

More on that later, but I would check out @lianabitcoin from @Wizardsardine as well, they offer a fully open source wallet that enables these more advanced smart contracts and are security researchers in the bitcoin ecosystem.

With that, I'm going to get back to work. I will post a followup reply if I have additional information or any corrections or clarifications to make.

Update on the 8/1/26 Bitkey bug report. Team and I will be hopping on a spaces here at 5pm PT to talk through our analysis and answer questions from the community. x.com/i/article/2083…

Sharing our initial findings on a reported vulnerability. Our recommendation is to continue to use your Bitkey normally.

The reported vulnerability would require exceptional circumstances to exploit, and can only occur at a specific narrow time during inheritance setup. Even if an attacker was able to exploit this vulnerability (including exploiting TLS internet security), they would not have enough cryptographic material to access funds. This is Bitkey’s defense-in-depth in action.

Our assessment is this presents no risk of remote drains or immediate funds loss. We appreciate @1440000bytes who reported this issue to us directly.

We will share a more thorough technical report imminently, and follow that with a hosted space on X where the team will talk through the details with the community and answer any questions. We'll submit a patch to the mobile app to both stores today.

@MomsInBitcoin1b@Bitkeyl disclosure, I lead the team that builds Bitkey. Gonna share some thoughts to help you make a decision and aim to be totally honest and transparent here. Hope you're OK with a long post so I can just share my full thoughts. This isn't canned, this is me just sharing my thoughts live.

What's great?

The 2-of-3 multi-sig setup is a superpower for a number of reasons. It helps protect against the type of things that happened in this incident. Our entropy is solid, but if it weren't on one of the keys, that's not alone enough to threaten your bitcoin. We generate entropy in 3 different environments (the phone, the hardware, and the server). This helps diversify, where a bug in one wouldn't be present in the others.

On top of this, 2-of-3 gives you flexibility where you can spend funds without Bitkey being involved. Even if @blocks disappeared (we have the Emergency Exit Kit for that). Block can be involved when you lose a key and need to recover.

You can also turn on a feature that lets you set a daily limit you'd like to spend on the go. With this on, our server will co-sign with your app key up to that limit daily, so you don't have to take your hardware if you'd like to spend while you travel or are out and about.

Our recovery system is unmatched. Lose your phone? Tap your wallet on your new phone and you're back in. Lose your Bitkey? Tap your new hardware, wait 7 days while we make sure nobody contests your recovery request, and you're in. Lose your phone and your Bitkey? If you've spent the 2 mins it takes to set up a recovery contact, they can help decrypt your app key from your cloud, without ever having access to it.

The 2 of 3 also allow us to provide an inheritance feature that is extremely easy to set up. It requires that your beneficiary have a Bitkey, but we give you a discount when you set it up and within minutes, your loved ones are protected.

We have a design without a seed phrase, which just means we take care of storing the seed for you in a redundant, resilient way. Because of this, onboarding is dead simple and takes less than 5 minutes and is easy enough for anyone of any age / experience level.

We're the only collaborative custody service that can't see any of your activity except one's we're involved in signing. This is because we invented Chaincode Delegation (bitkey.world/blog/chain-cod…).

We're fully FOSS. Our code is online and editable.

Where can we get better?

We need more utility features and we've already planned many of them. We've got support for transaction notes on the way, which is our first step towards ultimately supporting UTXO labeling and coin control. We're talking about how we can use this to support features like account separation.

We don't yet support lightning. Do we want to? Yes. Is it hard to do native lightning for mobile self custody? Yes. But there are lots of really interesting newish options that some type of lightning support much more straightforward and we will talk to the community about the right shape/tradeoffs for this when we make it past some of the other stuff I mentioned.

The lack of seed phrases is a tradeoff. We think it's the right one for most who self custody now and will in the future, but certainly not for all. If portability of your keys to other wallets is a crucial feature for you, Bitkey isn't right wallet. And that's OK. If portability of your funds is most important, then luckily we have Bitcoin transactions which allow you to move your funds from Bitkey to any other wallet.

So many of the things that make Bitkey great are because of the seedless decision. It reduces phishing capability, takes the burden of securing cryptographic materials off of customers, and in our opinion, greatly reduces the stress of self custody.

I'm not trying to do a sales pitch, so pardon if any of it sounds that way! There are other great products and services on the market as well. I do want people who have questions about our product to get the answers they're looking for. I'm really sorry you've gone through the roller coaster you've been on.

1/ During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps. That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps.

TL;DR: ColdCard-generated seeds are guessable. You need to move your funds.

If you did any of the following, your seed is harder to guess, but still not safe enough:

- Added a passphrase
- Used a newer device (MK4, Q)
- Created a multisig using multiple ColdCards.

The only ColdCard-generated seeds that appear to be safe are:

- Seeds from an MK1 or MK2.
- Seeds generated using dice