Bitkey customers do not need to move their bitcoin or take any other action because of this issue.
If you use Bitkey, you do not need to move your bitcoin or take any other action because of the reported Coldcard issue.
Bitkey’s engineering and security teams helped investigate the incident and reviewed Bitkey’s systems. The affected Coldcard software is not used by Bitkey, and none of Bitkey’s three key-generation paths were compromised.
Bitkey isn’t affected for two reasons:
- Bitkey does not use the Coldcard firmware or random-number generator involved in the reported issue.
- Bitkey generates three keys in three different environments, hardware, phone, and server; a compromise to a single environment does not compromise the entire wallet.
Below, we answer common questions about what happened and what it means for Bitkey customers.
Was Bitkey affected, and do I need to move my bitcoin?
No. Bitkey does not use the affected Coldcard software, and we found no evidence that the incident affected Bitkey wallets. You do not need to move your bitcoin or take any other action because of this issue.
What happened, and what caused it?
Public reports that bitcoin had moved from certain hardware wallets prompted an investigation. Our team’s technical analysis identified an issue in the way certain Coldcard firmware generated the randomness used to create wallet seeds.
This makes the seed phrases guessable by an attacker. Some affected seeds are easier to guess than others, depending on the Coldcard version, passphrase, or multisig setups. Coinkite has published separate guidance for its customers.
Read the full Block technical analysis for more detail.
Why wasn't Bitkey affected?
Bitkey does not use the software involved in the reported Coldcard issue. Bitkey uses three keys created in separate environments, none of our keys are impacted:
- An app key created on your phone
- A hardware key created inside your Bitkey device
- A server key created in a protected server environment
Moving bitcoin requires two of these three keys. A problem isolated to one key would not be enough to move your funds. Bitkey is open-source, so anyone can review how these keys are generated and how the 2-of-3 security model works.
Could something like this happen to Bitkey?
No security system can guarantee that a future software or hardware issue will never occur. All bitcoin wallets need to generate secure keys, and an issue with key generation can compromise a wallet.
Bitkey’s 2-of-3 security model is designed to limit the impact of a problem isolated to one key. An attacker would still need access to a second key before they could move bitcoin from a Bitkey full account.
Bitkey’s open-source code also allows security researchers to inspect how the product works and report potential issues.
How would I know if Bitkey customers needed to act?
If Bitkey customers ever needed to take action, we'd provide clear instructions through our official channels. Depending on the situation, that may include the Bitkey app, our Help Center, official email, or other contact information associated with your account.
If a response required an app or firmware update, we'd provide clear instructions on how to install it. If customers needed to move their bitcoin, we'd explain exactly how to do so and how to verify each step.
Just as importantly, here's what Bitkey will never ask you to do:
- Share your private keys, Recovery Contact codes, Emergency Exit Kit, or other secret information
- Share a seed phrase (Bitkey doesn't use seed phrases)
- Send your bitcoin to an address provided by Bitkey Support to "protect" or "secure" your wallet
- Install software or follow instructions from anyone claiming to be Bitkey support unless those instructions are also available through our official Bitkey channels
If you ever receive an unexpected email, phone call, text message, or social media message claiming to be from Bitkey, and you're unsure whether it's legitimate, contact us through the Bitkey app or our official Help Center before taking any action.
Is there anything I need to do?
No action is required for bitcoin held in your Bitkey wallet because of this issue.
As general guidance, keep your Bitkey app and hardware firmware up to date, periodically review the recommendations in the Security Hub, and follow official Bitkey guidance when making security-related changes to your wallet.
If you’re a Coldcard customer considering Bitkey
How should I protect potentially affected funds now?
If you believe your funds may be affected, do not wait for new hardware to arrive. Consider moving them to a wallet or exchange you already know and trust while you evaluate your longer-term options.
Move carefully and remain alert to phishing attempts. Never share your seed phrase or passphrase with a website, social media account, or anyone claiming to provide support.
How do I safely move from Coldcard to Bitkey?
When you set up Bitkey, it creates new keys for your Bitkey wallet. Bitkey does not import your Coldcard seed phrase.
Once your Bitkey wallet is set up:
- Review the Security Hub and complete the recommended protections
- Generate a receiving address in the Bitkey app
- Send a small test transaction
- Confirm that the test transaction arrived before transferring the remaining balance
How do I purchase Bitkey?
You can purchase a Bitkey wallet at bitkey.world/product. To help people receive new hardware sooner, we’re offering 15% off and covering all shipping costs.
Orders within the U.S. are shipping with overnight delivery. International orders are shipping with a service that typically delivers within one to three business days.
Read the technical analysis
For more detail on the investigation and the reported random-number issue, read the full technical analysis.
Sources
Authored by
