Coldcard has disclosed a vulnerability in how their devices generate random numbers for seeds, and outside researchers have corroborated the issue. While the issue originated in Coldcard’s firmware and not Unchained tech stack, at this time, and out of an abundance of caution, our recommendation is to rotate any Coldcard-generated key to a key generated on a different device.

This issue is most severe if you use two Coldcard-generated keys for your Unchained 2-of-3 multisig vault. Within any standard 2-of-3 configuration, if only one key is compromised, funds are generally considered safe. However, clients should still replace their key as soon as practicable.

Moving too quickly or panicking can lead to mistakes. Scammers target people who are fearful. When communicating with our team, always verify your Unchained representative using Support PINs: t.co/stNEGfqfWA