Security
How is your crypto actually held?
Recent incidents show that a single device or recovery phrase can put everything at risk. Here is what happened and how to reduce that risk.
An approach built around your situation
Who this is for
Bitcoin holders reviewing a hardware wallet, recovery setup or single-key risk, and families seeking a more resilient custody arrangement.
What we work on
We review how your crypto is held, then work through key separation, backups, recovery and migration steps. A 2-of-3 multisig setup requires two independent signatures: one compromised key alone cannot authorise a spend. It still needs careful setup and recovery planning.
Your first conversation
Describe your devices and your concerns without sharing recovery words or private keys. We discuss your situation in a free introduction before agreeing the support needed. Multisig reduces certain risks; it does not remove every risk.
A cold wallet is not enough. Review how your crypto is protected.
Two different attacks, one lesson: security depends on your entire setup, not just the wallet brand. Review where your devices come from, how recovery phrases are created, your backups and how you approve transfers.
Coldcard · 1,789.28 BTC tracked
According to Bitquery, the thefts occurred from July 30 to August 3, 2026, in four waves totalling 1,789.28 BTC. October refers to tracking the funds, not the attack date. Coinkite confirmed a generation bug that weakened some recovery phrases. Updating firmware alone does not secure an already affected phrase: consult the official migration procedure.
Bitquery timeline and tracking · July 30–August 3, 2026
Ledger / CryptoBilis · Estimated $102M
Bitquery estimates $102M stolen from 335 wallets, in analysis verified October 16. Ledger confirmed physical implants in devices returned to distribution through resellers in Southeast Asia, capturing recovery phrases during setup. According to Ledger, its systems and operating system were not compromised; this does not affect every Ledger device.
Bitquery investigation · October 16, 2026Brands shown for the news story only — no recommendation, no partnership.
Verified October 23, 2026 · Analyst estimates, not final totals.
- 1-to-1 review of your devices, keys, backups and procedures
- Guided migration to 2-of-3 multisig with independent keys
- Well-designed multisig reduces single-key compromise risk; no setup is invulnerable
Response within 24h · We never custody your assets or ask for your recovery phrase
Try it
Three keys, two signatures.
Tap the keys: two are needed to open the vault. One lost or stolen key is not enough to lock you out or rob you.
The solution
What multisig is, in plain terms.
A normal wallet depends on one key. Whoever gets it takes everything. A multisig wallet requires several separate keys to authorise a transfer. We recommend 2-of-3: three keys exist, any two are enough to sign.
3 keys, 3 locations
Three devices from different manufacturers, stored in three separate places. No single vendor flaw can compromise the vault.
2 signatures per transfer
Every payment needs two keys. A thief holding one key can't move a satoshi.
Backup built in
Lose a key? The other two still open the vault. Losing one key is no longer enough to lose everything.
Single-signature wallet
- One key = one point of failure
- Weak or leaked seed = instant drain
- Lost backup = lost funds
- No separation of duties within the family
2-of-3 multisig vault
- Compromising one key isn't enough
- Different vendors = no shared risk
- Losing one key is fully survivable
- Inheritance organised via the third key
Yes, it's more complex to set up. That's exactly why we do it with you, step by step, on your own devices. We never hold a key.
Plan my migration