‍What happened: Coinkite recently disclosed a vulnerability affecting seed phrase generation on some Coldcard devices. For Unchained clients whose vaults used Coldcard-generated keys, the disclosure created an urgent need to move bitcoin while limiting exposure during the transaction.

If you use or have used a Coldcard on our platform, we urge you to take immediate action to keep your bitcoin secure.

In addition to working around the clock fielding the unprecedented amount of client calls, tickets, and chats, the Unchained team has also been hard at work making sure every single client’s bitcoin remain secure. We want you to be as up-to-date as possible.

1. We’re reaching out to every identified high-risk client 

Team members are reviewing vault configurations (to the best of our ability) to identify affected client groups who use multiple Coldcard devices. Every identified high-risk client should receive outreach through email, phone calls, voicemail, or in-app messages.

There are still a number of high-risk clients we have not been able to reach.

Please keep an eye on your phone or your inbox to ensure you receive all communication from the Unchained team. When communicating with our team, always verify your Unchained representative using Support PINs. Follow-up will continue until each identified client has been reached.

2. Slipstream can help reduce public mempool exposure

This weekend, we built, tested, and shipped MARA Slipstream integration for vault withdrawals and sales. Slipstream submits a transaction directly to a bitcoin mining pool, keeping it out of the public mempool before confirmation. 

Moving bitcoin away from affected keys requires creating and broadcasting a transaction. Sending that transaction to the public bitcoin mempool could temporarily expose certain affected clients to a replacement-by-fee, or RBF, sniping attack.

This feature supports vault withdrawals and bitcoin sales, and is available to all clients with a Coldcard, or by request for others who may need it.

Caution: This feature involves you placing some trust in the operators of Slipstream. Unchained does not operate Slipstream. It is operated by MARA Holdings, Inc., a mining company which is publicly traded on the NASDAQ. Unchained does not control or have liability for the actions of MARA.

3. A lower-friction path to secure your bitcoin

We temporarily paused new key replacements to ensure you move bitcoin safely and efficiently. We recommend creating a new vault with newly generated keys, moving your bitcoin from the affected vault, and retiring the old vault once the transfer is complete.

If you already started a key replacement and have a pending sweep, we have also added the functionality to cancel it directly from the Unchained platform with no support ticket required. Canceling the pending sweep will clear the blocked transaction so you can begin the recommended migration process.

This gives you a straightforward path forward while avoiding unnecessary delays. Please move carefully, verify every step, and contact Client Services if you need guidance.

4. If you need another hardware option

We added support for compatible QR-based hardware-wallet workflows so you can use a broader range of signing devices when replacing an affected key.

This also makes it easier to use hardware wallets from different manufacturers within the same vault. Because every device and manufacturer carries some risk, combining multiple vendors reduces your dependence on any one manufacturer. 

5. Office hours to field your questions live

On Friday, we hosted an online office hours to explain the Coldcard vulnerability and address immediate concerns. We consolidated the information from the webinar down and published it as part of our Coldcard security advisory. Please stay tuned for more content explaining the nuances of this event specifically and how to ensure you eliminate single points of failure going forward.

Bitcoiners helping bitcoiners

We’re working through the queue as fast as possible. Throughout this incident, our support queue has been overwhelming, but team members are working through weekends and after hours to triage cases, respond to clients, and escalate issues requiring technical help. 

Again, we believe there to still be impacted and vulnerable clients in the wild who are unaware of what’s happening. Please communicate with your network, check in your friends, and lean on the community. It is our hope we can find every last impacted client. 

If someone you know needs help evaluating or understanding multivendor multisig, we have a library of resources, and our team is available to help. It’s now easier than ever to get someone to safe harbor.

Moments like these reveal the importance of having a human connection in a technology filled world. Multivendor multisig absolutely provides technical resilience and removes single points of failure, but the people behind it provide judgment, coordination, and steady hands when circumstances change or you're just not sure.

These past few days have been trying, and there’s still work to be done, but it’s also been a great reminder of why we do what we do.

We're grateful for all the support and ask that no one rests until every bitcoin is secure.