The recent Coldcard hack should be a wake-up call for anyone storing a serious amount of Bitcoin on a single hardware wallet.
A lot of people treat hardware wallets as if they remove trust from the equation. They do not. They simply move the trust somewhere else.
When you use a single-signature wallet, you are trusting one seed, one device, one firmware implementation, one random number generator and usually one manufacturer. If any critical part of that process fails, your entire wallet can be exposed.
That is the real problem with single-sig.
It creates one point of failure.
You Are Still Trusting Code
People often say that self-custody means you do not need to trust anyone.
That is not completely true.
You are still trusting the code running on the device that creates and stores your keys. You are trusting that the seed was generated with proper randomness. You are trusting that the firmware is not compromised. You are trusting that the device displays the correct address. You are trusting that it signs the transaction you actually intended to sign.
If the seed generation is flawed, your funds may be at risk before you even receive your first transaction.
If the firmware is malicious or compromised, the device may leak information or approve something different from what you see.
If the manufacturer makes a serious mistake, there may be nothing you can do after the fact.
The point is not that Coldcard is uniquely bad. The point is that no manufacturer should be trusted as the only line of defence protecting someone’s life savings.
Replacing one Coldcard with one Ledger, Trezor, BitBox or another device does not fix the underlying problem. You are still relying on one signer.
You have only changed which company you are trusting.
A Strong Passphrase Is Not Optional
Anyone using single-sig for a meaningful amount of Bitcoin should be using a strong BIP-39 passphrase.
A passphrase is not the PIN used to unlock the hardware wallet. It is additional secret information used together with the seed words to create a completely separate wallet.
Without the passphrase, the seed words alone do not lead to the protected wallet.
This matters because if there is ever a weakness in the seed generation process, an attacker would still need to discover the passphrase before they could access the funds.
Of course, the passphrase needs to be genuinely strong.
A name, birthday, quote, song lyric, short password or memorable sentence is not enough. Attackers can test guesses offline without rate limits or account lockouts.
A proper passphrase should be long, unique and generated using real randomness. Several randomly selected words can work well, but they need to be selected randomly, not chosen because they form a clever sentence.
The passphrase also needs to be backed up separately from the seed.
If the seed and passphrase are stored together, then the passphrase offers very little protection if someone finds both.
At the same time, losing the passphrase means losing the wallet. There is no password reset. There is no support department that can recover it.
That is why self-custody needs to be treated seriously. A passphrase improves security, but it also increases the importance of proper backups and recovery planning.
Multisig Is the Better Solution
For substantial amounts of Bitcoin, multisig is the better security model.
A common setup is 2-of-3 multisig. Three separate keys exist and any two are required to move the funds.
Ideally, those keys should be generated using devices from different manufacturers.
For example, one key could be generated on a Coldcard, another on a BitBox and another on a Trezor. The devices should be stored in different locations and the backups should not all be kept together.
This means that one compromised signer is not enough to steal the wallet.
- A firmware bug affecting one manufacturer is not enough.
- A weak seed generated by one device is not enough.
- The theft of one backup is not enough.
- The destruction or loss of one signer is not enough to permanently lock the owner out.
That is what real defence in depth looks like.
You are no longer depending on one device, one company or one implementation being perfect.
Do Not Build Fake Multisig
Multisig only works properly when the signers are genuinely independent.
Using three identical devices from the same manufacturer is better than using one device, but it still leaves shared risks.
The devices may use the same firmware, the same seed generation logic, the same secure element, the same companion software or the same supply chain.
A serious flaw could affect all of them at once.
A stronger setup uses different manufacturers, separate seed generation processes, different storage locations and independent backups.
The wallet configuration also needs to be backed up.
With multisig, the seed words alone may not be enough to easily reconstruct the wallet. You may also need the extended public keys, derivation paths, key order and wallet policy.
This information is not usually secret, but it is still essential for recovery.
Anyone setting up multisig should test the full recovery process before depositing a large amount. Do not assume it works because the wallet software says it does.
Set it up, send a small amount, recover it from the backups and make sure you can still spend.
Multisig Is Not Magic
Multisig does not remove every risk.
A badly designed multisig setup can still fail.
People can lose the wallet configuration. They can store every backup in the same house. They can approve a malicious transaction without checking the address on multiple devices. They can leave inheritance instructions that nobody understands. They can create a complicated system that even they cannot recover.
The goal is not to create something that can never fail.
The goal is to make sure one mistake, one stolen device, one compromised company or one software bug cannot take everything.
That is the main advantage over single-sig.
Self-Custody Is Not Automatically Safer
There is a popular idea in Bitcoin that self-custody is always the safest option.
That is not true for everyone.
Self-custody gives you control, but it also gives you all of the responsibility.
- You are responsible for generating the keys securely.
- You are responsible for backups.
- You are responsible for protecting against theft.
- You are responsible for recovery.
- You are responsible for inheritance.
- You are responsible for making sure your family can access the funds if something happens to you.
If someone is not willing to learn how passphrases, backups, recovery and transaction verification work, then placing their entire life savings on one hardware wallet may be more dangerous than using a regulated financial product.
There is no shame in admitting that.
An ETF or Regulated Custodian May Be Better for Some People
Some people only want exposure to the Bitcoin price.
They do not want to manage seed words, passphrases, hardware wallets, multisig policies, metal backups or inheritance instructions.
For those people, a regulated Bitcoin ETF may be the more sensible option.
They do not own Bitcoin directly and they cannot withdraw it on-chain, but custody and key security become someone else’s responsibility.
A regulated exchange or custodian may also be a better option for someone who is not comfortable managing their own keys.
That does not mean custodians are risk-free.
Accounts can be frozen. Withdrawals can be delayed. Companies can fail. Insurance may not cover every type of loss. Regulations do not guarantee that every customer will be made whole.
Still, for many people, those risks may be easier to understand and manage than the risk of permanently losing a seed or having a single hardware wallet compromised.
The choice is fairly simple.
If you want full control and sovereign ownership, then you need to accept the responsibility that comes with it and build a proper security setup.
If you mainly want investment exposure, then an ETF or regulated custodian may be the more honest option.
What makes very little sense is putting your entire life savings behind one device, one seed and no strong passphrase, then calling that secure because the keys are technically in your possession.
The Real Lesson
The lesson from the Coldcard hack is not that everyone should abandon Coldcard and buy a different hardware wallet.
The lesson is that every signer can fail.
- Every company can make a mistake.
- Every firmware implementation can contain a serious bug.
- Every random number generator can be flawed.
- Every supply chain can be attacked.
- Every security review can miss something.
A hardware wallet should be one part of a security system. It should not be the entire system.
For small balances, single-sig may be perfectly reasonable.
For larger balances, a strong and unique passphrase should be considered the minimum.
For life-changing amounts, properly designed multisig using signers from multiple manufacturers is the best practice.
For anyone who does not want the responsibility, an ETF or regulated custodian may be safer than pretending a single hardware wallet is enough.
Bitcoin itself did not fail.
The security model around the keys did.
Need Help Setting Up Multisig?
If you need help creating a proper and secure multisig setup, please contact us at multisig@yggdrill.com.
We can explore the available options with you, guide you through the setup process, advise on best practices, explain how to store and separate your backups safely, and help you understand how recovery works before you move any significant amount of Bitcoin.
A multisig setup should not be rushed or copied blindly from a guide. It needs to match the amount being protected, the people involved, the available storage locations, and your recovery and inheritance requirements.
