The Entropy Bug of Coldcard and the Birth of Multi-Vendor Multisig

In the aftermath of the catastrophic entropy bug of Coldcard, experts and self-custody advocates are recommending a new standard: multi-vendor multisignature wallets. This approach aims to minimize, among other threats, dependence on a single hardware wallet manufacturer.

The Lesson of the Coldcard Bug

The entropy bug of Coldcard, which went unnoticed at least since 2021, has taught a harsh lesson to Bitcoin users and self-custody advocates. No matter how legitimate or competent a wallet provider may seem, a significant bug is always possible. Consequently, many Bitcoiners are questioning old recommendations and assumptions, with some even declaring the 'death of single sig', the popular self-custody method that relies on generating the private key pair from a single wallet.

The Threat Model

Self-custody, to any extent, is an advanced practice in the world of Bitcoin. Experts recommend it as a way to protect users' funds from exchange malfeasance like those seen in cases such as FTX and MtGox, among many others. However, recent events have prompted a reevaluation of custody practices, with many Bitcoin owners moving their coins to exchanges - at least temporarily - while others update or change their self-custody setups. Nick Neuman, CEO of Casa, has stated that 233,000 Bitcoin have been moved to safety in response to the Coldcard hack.

To understand when self-custody makes sense and for whom, it is essential to understand your personal threat model. A threat model is an accurate analysis of the threats to an individual, with the aim of designing security practices and structures in advance.

A simple threat model practice can be to take a step back and think about all the things that concern you about self-custody and add them to a list. Then, think about all the things that experts warn users about and add them to the same list. Next, order or rank the items on that list based on which are most likely to happen to you and which are most likely to happen in general. Finally, you can rank each item on the list based on how catastrophic it would be if it occurred; can your current setup and plans survive the realization of that threat?

Common Causes of Fund Loss

Two of the most likely causes of fund loss in Bitcoin self-custody are user errors related to backups or forgotten passwords and, of course, theft. Many of the Bitcoins considered lost that have not moved derive from incorrect private key backups in the early days, resulting in data loss after a computer failure. Others have simply used passwords too complex to brute force and then forgotten them, encrypting their private keys forever.

On the theft front, bad entropy attacks likely rank among the most successful attacks on self-custody to date, with Coldcard joining a significant list of other wallets that have suffered from bugs of this type, intentional or not, such as Trust Wallet, and many lesser-known and possibly malicious mobile wallets. In some cases, fake wallets like Sparrow Wallet have been used to trick users into revealing their private keys. It is crucial to verify the authenticity of any wallet software before use.

Advantages of Multi-Vendor Multisig

The main advantage of multi-vendor multisig is redundancy. If a hardware wallet provider is compromised or a device is lost or damaged, users can still access their funds using the keys provided by other devices. Additionally, by distributing keys among multiple providers, users can mitigate the risk of a single point of failure.

Another advantage is added security. Even if a hacker manages to gain access to one device, they will not be able to access the funds without the keys from the other devices. This makes it much harder for hackers to steal users' funds.

The entropy bug of Coldcard has highlighted the importance of security in Bitcoin self-custody. As users continue to seek ways to protect their funds, multi-vendor multisig emerges as a promising solution. By distributing keys among multiple devices and providers, users can enhance security and reduce the risk of fund loss. However, it is important to remember that self-custody requires careful management and a thorough understanding of security practices.