Coldcard Update: The Setup That Slept Through Last Week

First, a quick status update, because the feed has moved on and the situation has not. Coinkite posted another URGENT reminder yesterday: the vulnerability is still being exploited. Galaxy Research now counts 1,596 BTC drained from about 7,300 addresses, and Chainalysis puts the losses near $110M. The strange footnote: about 90% of the stolen coins have not moved since they were taken. None of this is a reason to panic. It is a reason to finish the move calmly if you have not, and to build somewhere a vendor bug cannot follow. That is what this email is about.

Today's email is brought to you by Casa, and here is why Bitcoin Breakdown was glad to take this one. While those coins were walking out the door, the Casa team was everywhere we looked. CEO Nick Neuman posted a free video walkthrough for getting a Coldcard wallet to safety, ran a live Space to answer questions one by one, and told people to just DM him. Casa opened free security consults to anyone affected, member or not. Jameson Lopp, who helped found Casa, spent the week publishing the calmest, clearest guidance of the entire mess, including the early warning that saved people from bricking loaded devices. When bitcoiners say bitcoiners take care of bitcoiners, this week it looked a lot like Casa.

So instead of a pitch, here is the thing our Monday advisory could not fit: what the good setup actually looks like, with Casa's vault as the example.

Three keys, any two to spend. One lives in the Casa app on your phone. One sits on a hardware device you already own; your existing Coldcard counts, alongside Jade, Trezor and others. The third sits with Casa, and it can never move funds alone. Casa cannot spend your bitcoin. Losing one key locks you out of nothing. And because the keys live on hardware from different vendors, a bug like last week's touches one key and stops there. People with this setup read the Coldcard news and went back to their weekend.

Then you do not even need new hardware to start, but one distinction matters first. If your seed was born on the device without added dice rolls or a strong passphrase, treat it as exposed: get your funds off it today, not on a schedule. If you did roll dice or run a long passphrase and are moving because the trust is gone, you have the calm version of the same play. Either way Neuman's advice holds: do not wipe the device, and do not generate a fresh seed on it. Pair the Coldcard you already own into a Casa vault. The vault is a brand new wallet the moment it is funded, and the suspect key becomes a minority vote you rotate out, promptly if your seed was exposed, at your leisure if it was not, with an advisor on the line and a health check making sure nothing gets funded until every key can sign.

The consult is free, it is with a human, and it is open to you whether or not you ever pay Casa a dollar. They spent the past week proving they will help either way. If your bitcoin still lives on one device, take the call while last week is still fresh.

Membership starts at $250 a year if you want them in your corner for good. Tomorrow: the failure point nobody rotates out, and what Casa includes for it in every vault.

Naiw

Bitcoin Breakdown