News, data and analysis on tokenized assets, market design and digital economic systems.
Maker of the Coldcard bitcoin signing devices. It holds no customer assets: it sells the hardware by which holders custody their own keys, which is why a flaw in how those devices generate seeds is a custody event.
A Canadian manufacturer of bitcoin hardware, best known for the Coldcard family of air-gapped signing devices and for Opendime. It is filed here under custody because that is the business its products serve, but the distinction matters and the register should not obscure it: Coinkite never holds customer assets, and a Coldcard owner is their own custodian. That is precisely what made the seed-generation advisory of 30 July 2026 consequential. Where a custodian's failure is absorbed by the custodian's balance sheet and its insurers, a failure in self-custody tooling falls entirely on the holder, and the only remedy available is for every affected user to act.
Developments in which Coinkite Inc. is a named party, newest first.
Coinkite warned that Coldcard devices generated seeds with too little entropy; within a day, onchain observers were attributing the draining of hundreds of bitcoin to keys an attacker could simply recompute.
Coinkite published a security advisory on 30 July 2026, updated on 1 August, saying Coldcard devices had generated seeds with insufficient entropy: about 72 bits rather than 128 on later models, and weak seeds on Mk2 and Mk3 firmware 4.0.1 to 4.1.9 unless dice rolls were used. The advisory confirms no thefts; outside analysts attributed large automated sweeps of bitcoin to the flaw the following day.
What issued, what settled, what the supervisors changed, with the numbers behind it and a note on what the numbers do not show. One email, Thursday mornings.
Unsubscribe in one click.