The wider response
What custody providers, vendors and researchers published, separated from commentary about what the incident means, with each publisher's commercial interest stated.
No code. Written to be actionable.
The public response combined operational guidance, technical analysis and broader arguments about self-custody. This page records those categories separately. A quoted position is evidence that the speaker expressed it, not that this archive endorses it.
Published operational guidance
Unchained recommended rotating every COLDCARD-generated key to one generated on another device. It identified two COLDCARD-generated keys in its 2-of-3 vault as the most severe case. It also said that one compromised key is normally below threshold, while recommending that clients replace it as soon as practical.
Casa presented multi-key, multi-vendor custody as a way to remove a single manufacturer's failure from the spending threshold. Nick Neuman published a migration video that starts with the user's current COLDCARD as one key in a new Casa multisig, and said moving the assets there eliminates loss risk from this vulnerability. That statement depends on the resulting policy, the provenance of every other key and whether the affected key is below threshold. Casa and Neuman have a commercial interest in the service being recommended.
Ledger reported that its devices are not affected. It attributed that conclusion to a certified true-random-number generator inside its Secure Element and said each 24-word recovery phrase receives 256 bits of entropy. This archive has captured the vendor statement but has not independently reviewed the relevant Ledger implementation or runtime output. Ledger is a competing hardware-wallet vendor.
Hamilton published preliminary on-chain accounting for the first observed wave: 500 transactions, 1,324 inputs and approximately 594.48 BTC over about 15 minutes. The exact reconciliation on the funds page later established four blocks, 960,188 through 960,191. His original post described a three-block window, so the archive preserves both the preliminary statement and the corrected chain measurement.
Independent technical analyses
Two long-form analyses published on 1 August 2026 go beyond guidance and make checkable technical assertions. Both are recorded here with the interest of their publisher stated, and both have been adjudicated claim by claim on the pages where the underlying evidence lives.
Kevin Loaec published a post-mortem whose central contribution to this record is its enumeration of COLDCARD features that drew their own randomness from the affected generator without consulting the user's mnemonic. Its consequence, stated in the accompanying X post, is that a user who imported a seed or generated one with sufficient dice can still be exposed through those features. This archive checked each asserted feature against the pinned firmware and libngu clones. The mechanism holds at every call site checked and several of the specific numbers are quotable from source comments, one claim about HSM secrets needs narrowing because per-user credentials use the intact hardware path, and the list is not exhaustive. The per-claim adjudication is on the blast-radius page.
Wizardsardine sells Liana, a competing wallet product. The post-mortem's first section addresses Liana users and it closes by recommending the company's institutional offering. The author separately describes the post as written quickly under stress by three people in parallel and invites corrections. Both facts are disclosed on the same basis as Foundation Devices' competing interest around the OPENDIME test.
A commit-history reconstruction of how the predictable path entered the tree. Its commit hashes, line counts and quoted source largely reproduce against the clones held here, but its dating of the defect's introduction to a May 2021 commit does not: the same board configuration is present in the first public firmware commit of July 2018, and became a live defect only when a March 2021 change routed seed generation through the library that calls the missing symbol. The adjudication and that reconciliation are on the developer-response page, and the piece also bears on the question of how the defect was found.
Provider-held keys in the threshold count
In collaborative custody, the relevant count includes every key that can satisfy the spending policy, including keys held by a provider. The public record held here does not establish how any particular provider generated its own key. The appropriate check is therefore factual: ask the provider which device and firmware generated each key it controls, and when.
flowchart TB
VAULT["Example 2-of-3 collaborative vault"] --> K1["Owner key 1<br/>affected COLDCARD seed"]
VAULT --> K2["Owner key 2<br/>other origin"]
VAULT --> K3["Provider-held key<br/>origin must be confirmed"]
K3 --> A{"Was the provider key also<br/>generated by an affected COLDCARD?"}
A -->|"No"| B["One affected key<br/>below the 2-of-3 threshold"]
A -->|"Yes"| C["Two affected keys<br/>threshold may be met"] An example only. Actual exposure depends on the wallet policy, which keys were generated by affected firmware, and any independent passphrase or dice entropy.
Reported positions about the incident
Secondary coverage quoted several broader interpretations. They are listed here as attributed positions, with the incident evidence that is relevant to each one. The incident itself cannot determine which custody model a reader should prefer, because the alternatives carry risks that are not measured by this theft.
| Attributed position | What this incident establishes | Basis / dispute |
|---|---|---|
| Some commentators cited the incident as evidence against single-signature hardware-wallet custody. | The first-wave transactions are reported, and this archive's own chain check observed them spending single-signature outputs, which describes the spent scripts rather than each owner's wallet configuration. It does not measure the independent operational risks of multisig or third-party custody. | Reported |
| Casa CEO Nick Neuman said that asking most users to roll dice is not a workable default. | Pure dice generation and mixed dice input are separate paths. Sufficient pure dice entropy avoided dependence on the faulty generator; the archive does not have adoption data. | Reported |
| Some coverage presented open-source firmware as creating attacker access to latent bugs. | The source was public. The same availability also allowed Block and independent researchers to inspect the path. The discovery method remains unknown. | Reported Contested |
| Some researchers warned that urgent multisig migration can reveal a previously hidden script and enable a competing spend. | That condition is technically possible when the attacker controls enough affected keys but lacks the script or descriptor needed to construct the spend. | Derived |
An adjacent event that is not this incident
What follows concerns a different product and a different defect. It is recorded here only because the same company appears on both sides of that boundary, and because a reader meeting the two stories on the same day could otherwise merge them. Nothing in it describes COLDCARD, the entropy defect, or any exposure of a COLDCARD user.
Block is a primary party in this record: its engineering disclosure is a source the archive relies on, and its Mk4-class entropy model appears on the entropy page and in the precedent comparison. On 1 August 2026 the same company also published initial findings on an unrelated vulnerability in Bitkey, its own hardware wallet, reported to it by a third party. The two events share a date and a company and nothing else.
Garrett said the reported Bitkey issue would require exceptional circumstances to exploit and can arise only during a narrow window in inheritance setup; that an attacker who exploited it, including by defeating TLS, would still not obtain enough cryptographic material to access funds; and that Block's assessment is that it presents no risk of remote drains or immediate loss of funds. He credited the reporter, @1440000bytes, said a mobile-app patch would be submitted to both stores the same day, and said a fuller technical report and a hosted X space would follow. Block's recommendation was that owners continue using their Bitkey normally.
These are the vendor's own initial findings about its own product, published before the technical report it promises. This archive holds the statement and has not reviewed the Bitkey implementation, the reporter's write-up or the patch. As of 2 August 2026 no follow-up technical report has been captured here.
The underlying quotations and operational claims are linked from the evidence record. For configuration-specific action, use the risk guide rather than a general position about custody. The code-level scope of the COLDCARD defect, including the features that do not depend on how a seed was produced, is on the blast-radius page.