Unchained has published an analysis of the Coldcard security incident, arguing that multisig wallet structures shielded thousands of bitcoin while singlesig users were left immediately exposed.
On July 30, 2026, Coinkite issued a security advisory covering a vulnerability affecting most Coldcard hardware wallets.
How the bug worked
According to Unchained’s breakdown, the flaw sat in the device’s random number generator, meaning the entropy behind key generation was far weaker than users believed.
Unchained wrote:
“The entropy wasn’t nearly as unpredictable or random as people believed, and the number of possible seeds and keys that could be produced was much smaller than it needed to be.”
Because entropy is the base layer, every layer above it inherited the weakness:
“Because entropy is the foundational starting point, its lack of security means every other layer built on top of it is insecure as well.”
Singlesig users hit first
Attackers scanned common derivation paths and found keys tied to live balances.
Unchained explained:
“As soon as they found a key that was controlling a balance, the attacker could then use the key to move the bitcoin into a wallet they alone control, stealing the bitcoin.”
Why multisig held up
In a 2-of-3 setup, a single compromised key is not enough.
Unchained noted:
“If one key is stolen (or in this case, compromised by an existential RNG bug), the thief doesn’t have enough keys to access any bitcoin.”
Even wallets built entirely from Coldcard keys retained some protection, since attackers would need to correctly pair three key sets against an address.
The firm concluded:
“It’s clear at this point that multisig gave many users additional fault-tolerance and time to respond.”
Unchained also rolled out direct-to-miner transaction submission to reduce RBF attack risk while spends sat unconfirmed in public mempools.
