COLDCARD Bug Highlights Correlated Risks in Self-Custody Security

A recent COLDCARD random number generation issue has highlighted the importance of considering correlated risks in self-custody, according to Mixin. The incident occurred due to a bug in certain firmware versions that did not use the intended hardware random number generation path when creating wallet seeds, resulting in an effective search space below the original security target.

The issue was discovered after several years and can only be corrected by generating new seeds and migrating assets. This incident serves as a reminder that even well-reviewed and widely-used components can have vulnerabilities, emphasizing the need for users to evaluate not just individual components but also their shared sources of failure.

Mixin Safe, a multisignature self-custody product, has highlighted this issue by demonstrating how multiple key roles generated using the same device, firmware, or random number implementation can share a common vulnerability. This is known as correlated risk in self-custody and emphasizes the importance of considering who generates and controls keys, devices, entropy sources, and code or infrastructure dependencies.

Mixin Safe's three-key roles, Owner Key, Members Key, and Recovery Key, use multisignature and relative timelocks to ensure security isolation and recovery paths in case of device damage, lost keys, unavailable co-managers, or individual MPC node failures. The product provides a resilient self-custody option by reducing dependence on any single component.