Coldcard and Ledger Failures Put Multisignature Security in Focus

Two hardware-wallet incidents involving Coldcard and Ledger have renewed attention on recovery-phrase security, as a seed-generation bug and a hardware implant show how one compromised credential can put funds at risk.

The incidents share a security risk: a single key can authorize spending even when its seed was generated poorly or exposed through a compromised device. BitGo offers multisignature services, giving the company a commercial interest in the security model it recommends.

Coinkite, Coldcard’s maker, said firmware versions dating from 2021 through July 2026 had a flaw that weakened seed entropy. Its guidance recommends at least 50 independent, private dice rolls or a strong, unique BIP-39 passphrase to mitigate the risk. A firmware upgrade does not restore entropy to a phrase created while the flaw was active.

Ledger said a hardware implant was added to affected devices after they left the company’s control, with the aim of capturing recovery phrases during setup. Ledger maintained that its servers, device chip and operating system remained uncompromised, describing the incident as an attack on the distribution channel.

On-chain losses were estimated at $102 million across 335 wallets on six networks as of Oct. 16 at 10:40 a.m. ET (14:40 UTC). The estimate used asset prices from the morning of Oct. 9. The wallet count rose from 324 after 11 more TRON wallets were added, while the estimated dollar total remained unchanged. Ledger’s Oct. 15 public response did not provide a loss total or affected-wallet count.

A multisignature wallet adds an authorization threshold. In a 2-of-3 setup, signing requires two keys from a set of three. One compromised key cannot approve a transfer by itself if the keys are independently controlled. Shared devices, suppliers or recovery methods can expose more than one signer, while a malicious transaction can still pass if enough signers approve it.