Multi-Vendor Multisig Is What Survived Coldcard. Single-Sig Didn’t

In the wake of Coldcard’s catastrophic entropy bug, self-custody advocates and experts have begun recommending a new standard, multi-vendor multisignature wallets, an approach that looks to minimize —among other threats— dependency on any single hardware wallet manufacturer.

The Coldcard entropy bug that went undiscovered since at least 2021 has taught a hard lesson to the Bitcoin self-custody advocates and users. No matter how legitimate or competent a wallet provider might seem, how well recommended and reputable, a major bug may be possible. As a result, Bitcoiners are questioning old recommendations and assumptions, including many declaring the ‘death of single sig’ the popular self-custody method of trusting the private key pair generation to one wallet alone. 

The Threat Model

Self-custody by any measure is an advanced practice in Bitcoin. Advocates recommend it as a way to protect user funds from exchange malfeasance like that seen in the cases of FTX and MtGox, among many others. But recent events have driven a revaluation of custody practices, with many bitcoin owners moving coins to exchanges — at least temporarily — while others upgrading or changing their self-custody setups altogether. Nick Neuman, CEO of Casa, claimed that 233k bitcoins moved to safety in reaction to the Coldcard hack.