Coldcard registered multisig wallets without checking it was a cosigner
Who is affected
Users who registered a multisig wallet on a Coldcard on firmware 3.1.9 or earlier through a compromised computer could end up with a wallet the attacker controls or can hold to ransom. Coinkite disputes that this is a remote attack, since it requires a compromised computer at wallet creation.
What happened
On 9 February 2021 Hugo Nguyen of Nunchuk and Marko Bencun of Shift Crypto published a flaw in how Coldcard registered multisig wallets: through firmware 3.1.9 the device did not check that one of the registered cosigner keys (xpubs) was its own.
According to the researchers, a malicious computer or wallet app could substitute attacker-controlled xpubs during setup. The Coldcard would then show addresses of a wallet the attacker controls, and the user’s address checks on the device would still pass. In setups where the user holds only one key, such as 1-of-2 or 2-of-2, the attacker could later move the funds or, in N-of-N setups, hold them for ransom. The researchers say a wallet set up only between Coldcards via microSD, without a computer, was not affected, and rated the flaw critical because it can be carried out remotely and at scale.
Coinkite states the issue can only affect multisig wallets created while an attacker controlled the user’s computer, does not affect wallets after creation, and is not a remote attack. It credits Hugo Nguyen and recommends upgrading to 3.2.2. The researchers say the fix shipped in 3.2.1 on 8 January 2021; Coinkite’s advisory names 3.2.2, and its disclosure history lists the fix in 3.2.1.
Timeline: reported to Coinkite on 7 November 2020, fixed on 8 January 2021, published on 9 February 2021. According to the researchers, the January release notes did not present the change as a security fix.
What Coinkite advises:
- Upgrade Coldcard firmware as soon as possible and keep it current.
- Some wallet software may require the multisig wallet to be imported into the Coldcard again after the stricter checks.
Cryptocurrency is a digital or virtual currency secured by cryptography, operating on decentralized blockchain networks to enable secure, peer-to-peer transactions.
Coldcard is an air-gapped hardware wallet for Bitcoin, made by Coinkite, that stores private keys offline and signs transactions without internet exposure.
Multisig (multi-signature) is a security feature that requires multiple private keys to authorize a transaction, enhancing protection against unauthorized access in blockchain networks.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionA cosigner is one of multiple parties in a multisig wallet who signs transactions with their private key. All required cosigners must approve before the transaction executes.
Read full definitionXPUB is an extended public key (xpub) in hierarchical deterministic (HD) wallets. It derives child public keys and addresses from a master public key without exposing private keys.
Read full definitionRemote Key Extraction is a vulnerability where attackers steal private keys from hardware wallets remotely via exploits, without physical access.
Read full definitionSources
Independent reporting and research this entry was checked against.
- benma's blog — Remote multisig theft attack on the Coldcard hardware wallet (9 Feb 2021)
- Nunchuk — The Missing Multisig Standard (9 Feb 2021)
- Coinkite — Version 3.2.2 Update Recommended (Multisig Security Update) (9 Feb 2021)
- CriptoNoticias — Coinkite habría ocultado que sus monederos eran vulnerables a ataques remotos (10 Feb 2021)
Learn more
Guides on protecting yourself against this type of incident (Firmware vulnerability) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideIs a Hardware Wallet Really Safe?
Hardware wallets are the safest option for most people — but you can still make mistakes. Here's what to know.
Read GuideFirmware
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Bootloader
A bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.
Firmware Update
Firmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.
Cite this entry
WalletInsights. “Coldcard registered multisig wallets without checking it was a cosigner”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/coldcard-multisig-xpub-substitution-2021/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.