A few words given the recent exploits on hardware signing devices:
• The Ledger supply chain attack represents one of the most sophisticated attacks thus far on the wallet ecosystem. In many ways it’s a lot more sophisticated than the Coldcard RNG exploit, because that one was software only. This one took a cross-border company buyout, tampering with the devices (implanting an eSIM, an LTE module and a CPU) and manufacturing the implants at scale.
• These sorts of attacks have been predicted by early Bitcoiners, but in Bitcoin they remained theoretical or crude until this year. It shows that the level of sophistication of attacks has risen quickly, and what was previously “good enough” advice on wallets and self-custody is no longer sufficient.
• When we started Nunchuk a few years ago, our premise was that multisig, and multi-vendor multisig, needs to become the standard for self-custody in the future. But even we didn’t expect how fast it would materialize. This is likely due to 2 factors: Bitcoin getting more mainstream, and the rise of AI-assisted attacks. This is a Sputnik moment for Bitcoin self-custody. The defenses need to level up.
• Passphrases wouldn’t have helped in the Ledger case, since you are required to enter the passphrase into the device for it to sign any transactions. A compromised device that phones home the seed phrase can also easily phone home the passphrase the moment you enter it.
• Similarly, generating the private key somewhere else (even by rolling dice) and subsequently importing it onto a tampered device wouldn’t save you here. The device can phone home the seed phrase the moment it’s imported.
• Anti-tampering techniques might help, such as transparent casing or bricking the device if it’s tampered with. Or forever displaying a message once the seal is broken. Or using on-device encryption between the internal hardware components. But a dedicated and resourceful enough attacker can still find ways to get around these layers. Tampering and anti-tampering have long been a cat-and-mouse game. In 2008, card readers doctored right off a Chinese production line sent card data and PINs over mobile networks to Pakistan. The Ledger attack is the same playbook, 18 years later. The bigger the target, the more attackers spend on overcoming the defenses.
• You should order directly from the vendors as much as possible, using a PO box for privacy.
• Any setup that relies on a single hardware/software stack or a single vendor should be considered at risk.
• Building your own hardware signers from generic parts is a good option for technical users.
• Multi-vendor multisig should become the standard. Each signer should have a completely independent hardware/software stack from the other signers. The point is that there shouldn’t be any single-point-of-failure anywhere in your setup.
• Many advanced protocols rely on timelocks and the recovery path being a simple singlesig. The recent attacks and exploits should highlight how dangerous this could be. Timelocks simply delay a risk. If a seed is compromised and there’s a timelock involved, the attacker just needs to wait out the timelock. (For Miniscript wallets, there’s the wallet descriptor too, but presumably it also gets sent to the device at some point.) Vault-like protocols face a similar problem: any withdrawal or recovery path that relies on a single key is a potential single point of failure.
• For our on-chain timelock assisted wallets, in a few weeks we are adding the option to customize the recovery path to be an M-of-N, so that, if you want, spending would require multiple keys at all points during the wallet’s lifetime. (Our off-chain timelock assisted wallets have always been M-of-N).
To those who recommend exchanges or centralized custodians over self-custody: that is a lose-lose situation.
Number 1, enterprises face the same problem as end users. They also rely on multisig to secure funds, or on proprietary and largely unproven protocols built on newer cryptography like MPC, which might make them more susceptible to AI-assisted attacks. They also rely on particular combinations of hardware/software stacks. Bybit lost $1.5B from its multisig cold wallet in 2025, because all of its signers used the same compromised web interface. Bitfinex lost ~120k BTC in 2016, despite a multisig setup with BitGo. It’s true that enterprises and huge custodians likely spend orders of magnitude more than the average user to custody funds, but the reward (of breaching security) is also orders of magnitude higher for the attackers. It might simply delay and MAGNIFY the tail risks once user funds concentrate in a few hands. The exchanges and centralized custodians also become huge honeypots, easily succumbing to 6102-style attacks, which will arrive as fiat monies inflate in the coming years.
Number 2, this sort of future inevitably ruins Bitcoin, whose purpose was to be censorship-resistant money. Encouraging people to move funds to exchanges benefits exchanges but is similar to sawing off the branch you’re sitting on. If Bitcoin loses the battle for self-custody, it will have completely lost its soul.
Bitcoin self-custody tools will get better. They have to. Bitcoin is too important to the future to lose.
