Nunchuk reports no subscriber losses and explains why its architecture held
nunchuk-no-subscriber-loss
- Author
- @nunchuk_io
- Organisation
- Nunchuk
- Evidence role
- custody-provider-guidance
- Posted
- 11 Aug 2026, 13:00 UTC
- Capture status
- capture held
Nunchuk states that no subscriber has lost bitcoin during the Coldcard seed-generation vulnerability and begins a thread explaining why its architecture held. Held as a dated organisational incident-response statement from a wallet-service provider. The claims are Nunchuk's own and are not independently verified here.
This post is registered as evidence and has a locally held capture. The original remains the canonical publication. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
The conversation
Captured . 11 replies held, 2 muted as low signal. Posts are in the archive's own order, oldest first, not the order X ranks them in.
-
capture taken
Over the past week, a serious vulnerability in Coldcard’s seed generation put funds across the Bitcoin ecosystem at risk. To date, no Nunchuk subscriber has lost any bitcoin. This incident tested the principles we’ve built on since 2022. Here’s what happened, and why the architecture held:
Replies held in this capture (11)
Low-signal replies are collapsed to one line, never removed. A reply is collapsed only on mechanical grounds: fewer than 40 characters, no text, mentions only, no letters or digits, a bare link, or text identical to another reply in the same capture. What a reply argues is never a reason. Each one says which rule collapsed it, and its screenshot is one click away.
-
capture taken
show the capture
capture taken
-
capture taken
Nunchuk mobile wallet is my favorite, however desktop app has room for improvment. I prefer sparrow because of more control and transparency of what you are doing.
show the capture
capture taken
-
capture taken
I hear you. It’s something we are aware of and working on.
show the capture
capture taken
-
capture taken
You guys offered a 2 of 3 multisig (2 keys required to spend) and you hold one key. Then you used a cold card to generate it and didn’t tell users not to use another card, Making a single point of failure to steal bitcoin and that’s the exact reason people used you (was to create a multi vendor multisig). Did I get anything wrong here? If not any claim that funds haven’t been stolen is impossible to verify, but we do know funds were put at risk by knucklechucks.
show the capture
capture taken
-
capture taken
I see that the honey badger plan requires a Tapsigner or Coldcard for the inheritance key. Is that planned to be changed?
show the capture
capture taken
-
capture taken
show the capture
capture taken
-
capture taken
Can you confirm no coldcard hardware is used in the generation or control of the seeds you handle on customers behalf @nunchuk_io in the past or currently ?
show the capture
capture taken
-
capture taken
Yes.
show the capture
capture taken
-
capture taken
"We reached out to these clients individually, explained the situation, and helped them migrate." What information did Nunchuk have that allowed you to identify & contact affected clients individually? What wallet metadata? Xpubs, wallet descriptors, balances, tx history? Thx!
show the capture
capture taken
-
capture taken
Thanks for putting effort to add new hardware support. I unfortunately had already bought Coldcards to set up my multisig with. Fortunately I hadent got around to it before the hack and the new coldcards are just sitting as wasted $$.
show the capture
capture taken
-
capture taken
We only reached out to our paid users, who signed up using their email addresses (many of which are anonymous emails).
show the capture
capture taken
The remaining 0 replies
This capture reached the end of the conversation as X served it: it stopped because nothing further loaded, not because a limit was hit. X decides what a reader is shown, so that is not the same as a guarantee of every reply.
Held captures
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
thread: 2087162119552987288 url: https://x.com/nunchuk_io/status/2087162119552987288 author: nunchuk_io post: 2087162119552987288 role: focal author: nunchuk_io name: nunchuk_io created: 2026-08-11T13:00:01Z media: 0 body: Over the past week, a serious vulnerability in Coldcard’s seed generation put funds across the Bitcoin ecosystem at risk. To date, no Nunchuk subscriber has lost any bitcoin. This incident tested the principles we’ve built on since 2022. Here’s what happened, and why the architecture held: post: 2087168496031371568 role: reply author: overtorment name: @overtorment created: 2026-08-11T13:25:21Z media: 1 body: post: 2087169746319847508 role: reply author: moonbd3j name: toni created: 2026-08-11T13:30:19Z media: 0 body: Nunchuk mobile wallet is my favorite, however desktop app has room for improvment. I prefer sparrow because of more control and transparency of what you are doing. post: 2087171956223459563 role: reply author: nunchuk_io name: nunchuk_io created: 2026-08-11T13:39:06Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.