Security alert · Oct 9, 2026: Ledger devices bought from a reseller in Southeast Asia were drained. Buy hardware wallets only from the maker. What to do →

Multisig Setup

Checklist

Security alerts

Last reviewed: October 2026

Problems with hardware wallets or wallet software that matter for a self-custody setup, newest first. A multisig limits the damage from any single one of these, but you still need to act.

October 9, 2026: Ledger devices from a reseller drained

What happened. Ledger said it is investigating loss of funds by users in Southeast Asia who bought Ledger devices from a reseller called CryptoBilis, and asked that reseller to pause all sales and shipments. The cause isn’t confirmed; it looks like a supply chain attack on devices before they reached the buyer.

What to do. Bought from that reseller in the last 90 days? Don’t set the device up. Already set it up? Replace that key and move your funds. Buy hardware wallets only from the maker or from Amazon.com itself, never from a reseller. Details, Ledger’s statement and sources: Ledger reseller attack: October 2026.

July 30, 2026: weak seeds on some Coldcard devices

What happened. From July 30, 2026, bitcoin started disappearing from Coldcard wallets in waves. A build error had made some Coldcard firmware generate seeds with a weak software fallback instead of the device’s hardware random number generator. Attackers could work those seeds out without ever touching the device.

Affected. Seeds created on (per Coinkite’s advisory):

  • Mk2 and Mk3 with firmware 4.0.1 (March 2021) to 4.1.9
  • Mk4 and Mk5 before 5.6.0 (Edge: before 6.6.0X)
  • Q before 1.5.0Q (Edge: before 6.6.0QX)

What to do. A firmware update doesn’t repair a seed that already exists. If a Coldcard created one of your seeds with an affected version, treat that seed as known to others:

  1. Update the Coldcard, or use another device, and create a completely new seed.
  2. In a multisig: build a new wallet with the new key replacing the old one, back it up and test it (steps 6 to 10).
  3. Move all funds from the old wallet to the new one.

In a 2-of-3, one exposed key isn’t enough for a thief, so there’s time to do this calmly. Don’t leave it, though: your safety margin is gone until you’ve replaced that key. Seeds protected by a strong, unique passphrase were far harder to attack, but moving to a new seed is still the safe answer.

Sources: Coinkite’s advisory and BlockSec’s analysis. More on Coldcards in a multisig: Coldcard multisig with Sparrow.