Public statements and actions

These statements answer different questions. Unchained and Casa described changes to customer policies. Ledger and Trezor described their own implementations and said they were not affected. None is treated as a neutral comparison of custody products.

1. 31 July 2026 · Unchained

   Rotate every COLDCARD-generated key

   Unchained recommended replacing every COLDCARD-generated key with one generated on another device. It described two COLDCARD-generated keys in its 2-of-3 vault as the most severe case, while saying one affected key is normally below threshold. R2

2. 31 July 2026 · Casa and Nick Neuman

   Keep one manufacturer's failure below threshold

   Casa presented multi-key, multi-vendor custody as a way to keep a single manufacturer's failure below a spending threshold. Nick Neuman also published a migration video using Casa. Both have a commercial interest in the service being recommended, and the result depends on the policy and origin of every key in it. R3

3. 31 July 2026 · Ledger

   A competing vendor says its devices are not affected

   Ledger attributed its not-affected claim to a true-random-number generator inside its Secure Element and said each 24-word recovery phrase receives 256 bits of entropy. This archive holds the statement but has not independently reviewed that implementation. Ledger is a competing hardware-wallet vendor. R4

4. 5 August 2026 · Trezor

   A second competing vendor says its devices are not affected

   Trezor said wallets originally generated on a Trezor are unaffected, described its own generation as drawing on several independent sources of randomness including the connected host and, on newer models, a Secure Element, and told anyone who restored a Coldcard-generated backup onto a Trezor to migrate to a newly generated wallet. This archive has not independently reviewed that implementation. Trezor is a competing hardware-wallet vendor. R5 On 6 August Trezor edited that article: where it had told affected readers to follow Coinkite's official guidance, it now points them at Trezor's own instructions. V6

5. 6 August 2026 · Casa

   A support page starts recommending device replacement

   Casa added a security advisory to its Coldcard troubleshooting page saying that funds generated on affected firmware may be at risk and that it does recommend replacing the device as soon as the owner is able. Casa dates the advisory 1 August; this collector held the page without it on 3 August and with it on 6 August, so the record fixes only when it appeared here. Casa sells a multi-key service that Coldcard devices can be part of, and has a commercial interest in the advice it gives about them. R7 The same day Casa's chief security officer published an account of what the company did after 30 July: reviewing every place its own systems touch entropy and key generation, running its automated pentest out of cycle weighted toward this class of defect, contacting members with affected devices below their vault quorum, and offering free security consultations to non-members migrating off an affected setup. None of those internal actions is observable from this archive, and the consultation offer is an offer to prospective customers. R8

6. 7 August 2026, 00:00 UTC · Casa

   A free multisig workshop offered to people reconsidering their setup

   Casa announced a live session on moving from one key to multiple keys across different hardware vendors, addressed to people whom the incident has prompted to reconsider how they hold bitcoin. The session promotes the company's own product area, and the workshop itself is not something this archive observed. R9

The threshold mechanics behind the provider statements live on the technical conditions page. The publishers' migration recommendations and their limits live in the migration record.

The statements below are the vendor's own accounts of operations that are not observable from this archive. They are preserved as published and linked to the captured posts.

1. 2 August 2026, 18:04 UTC · Coinkite

   Shipments halted and remaining affected stock destroyed

   Coinkite said it halted shipments once the vulnerability was confirmed, destroyed remaining units carrying affected firmware and emailed customers whose devices had shipped. The post also said SATSCARD, OPENDIME and TAPSIGNER use different codebases and are not affected. R10

   captured 3 Aug 2026, 03:56 UTC

2. 2 August 2026, 23:00 UTC · Coinkite

   The Sunday update acknowledges lasting damage

   The vendor described customer outreach and migration help, thanked community members who helped through the weekend and said the damage done is permanent, with hard questions remaining about the company. R11

   captured 3 Aug 2026, 04:08 UTC

3. 6 August 2026, 19:45 UTC · Coinkite

   Firmware work pointed at GitHub, and customer key migration

   The vendor said its next firmware updates can be followed on GitHub and that it was focusing on the next release and on customer key migration. What that work consists of is visible in the firmware repositories the record already tracks; the description of priorities is the vendor's own. R12

4. 7 August 2026, 02:12–02:19 UTC · Coinkite

   More releases promised, alongside doubt that the company survives

   Replying to a question and to two critics in three posts within seven minutes, the vendor said it had multiple pull requests under review with new versions coming, that it was doing all the investigation it can and was devastated, adding that the hacker could have disclosed responsibly, and that it was very likely not going to be around but should keep trying to give people the best firmware it can. The 2 August Sunday update had put the same subject as hard questions remaining about the company; the 7 August reply states an expectation rather than a question. R13

No held source carries Coinkite's own words on the scale of customer losses. Two held sources relay a Bloomberg report of 6 August that the vendor will publish a post-mortem once its investigation is complete and declines to estimate those losses: a Cointelegraph post of 7 August and a BitcoinTalk post of the same day that quotes the report at greater length. The Bloomberg article itself is not held here, and neither relay is a capture of anything Coinkite published. R14

The outreach and data-retention exchange

Coinkite said phone numbers and customer personal data are deleted, that many customers were therefore unreachable by email and that an earlier post could have been worded better. R15 Satochip then asked how store customers received emails if Coinkite deletes data after 90 days. The 90-day period is Satochip's premise, not an established fact, and Satochip is a competing hardware-wallet vendor. R16 Coinkite's separate June paper-spam statement gives 120 days for deletion of customer data including physical addresses. On 7 August Coinkite published an update on customer data retention that states the same period: its standard practice is to blank customer records automatically after 120 days, retaining only email addresses and country of residence, with accelerated blanking available on request after delivery. The same post says that automated blanking has been temporarily suspended because of legal obligations arising from the incident, and that a customer who does not want their data preserved may ask for the standard policy to be applied instead. V17 That account puts the period at 120 days rather than the 90 days Satochip's question assumed, and puts email addresses among the fields the blanking keeps rather than among those it removes. Both the 2 August reply and the 7 August post are the vendor's own accounts of its own systems, and no held source tests either against what was actually stored.

NCFA Canada argued that self custody removes the custodian but not the vendor layer beneath it: the device, its firmware, seed-generation code and update path. This defect did sit in that layer. Its comparison with regulated custody is an argument about where risk is placed, not something this incident measures, and its loss figures are carried secondhand from Galaxy Research. NCFA Canada is a fintech industry association whose members include financial-technology and digital-asset businesses. R18

On 7 August Ledger published an argument by its chief technology officer that open source is valuable but is not itself a security property, quoting the line that a security model resting on the crowd saving you is a hope rather than a model. That is a position about how review works, prompted by this incident rather than settled by it, and the linked article is not held here: the record holds the post and the line it quotes. Ledger is a competing hardware-wallet vendor whose not-affected statement is recorded above. R19

Other broad positions are kept beside the evidence needed to read them: the open-source and AI discovery dispute, dice claims, and the first-spend debate. This avoids maintaining a second verdict table here.

1. 2 August 2026 · Marty Bent

   An endorsement apology and an account of migration help

   Bent apologised to people who bought a COLDCARD on his recommendation and described spending the weekend helping people move funds. R20

2. 2 August 2026 · Pledditor

   A community member describes direct owner outreach

   One individual described finding older posts that mentioned buying a COLDCARD and replying with an alert about the incident, while accepting the risk of account moderation. R21

3. 2 August 2026, 20:44 UTC · OpenSats

   NVK steps down from the OpenSats board

   OpenSats announced the departure as immediately effective and said the board would continue with eight members. The post gave no reason. Its timing falls within the incident weekend, but the source itself does not connect the two. R22

4. 6 August 2026 · OpenSats

   Code RED: priority funding for people red teaming Bitcoin software

   The same organisation announced a funding path for people auditing critical Bitcoin software after the incident, including reimbursement of past LLM token costs, and said it would prioritise those applications for the foreseeable future. The post frames the programme as support for the people who spent the days after disclosure triaging and red teaming. Whether any grant was made is not visible from this archive. V23