Nunchuk Urges Users of Coldcard Multisig Wallets to Migrate Amid Security Incident

iconKuCoinFlash
Share
AI summary iconSummary
Nunchuk has issued an urgent alert regarding a security breach affecting Coldcard multisig wallet users. The company urges those with Coldcard keys at or near the signing threshold to migrate their funds immediately. Others are advised to act promptly. On-chain data indicates the risk correlates with the number of Coldcard keys in a wallet. Nunchuk’s upcoming mobile update will introduce Slipstream for paid users, helping them avoid public mempools. Free users can migrate manually.

Odaily Planet Daily reports: Bitcoin wallet service Nunchuk has released a major update, advising users of multisignature wallets containing keys generated by Coldcard to migrate their funds as soon as possible in response to recent Coldcard-related security incidents.

Nunchuk has defined different response levels based on the number of Coldcard-generated keys in the multisig wallet: If the number of Coldcard-generated keys meets or exceeds the signature threshold, an attacker could theoretically transfer funds directly—users in this situation should migrate immediately. If the wallet contains only one Coldcard-generated key and that number is below the signature threshold, a single compromised key cannot move funds on its own, posing a relatively lower risk; however, migration is still recommended as soon as possible. If users are unable to confirm the exact number of Coldcard keys in their wallet, they should treat the situation as high risk.

In addition, Nunchuk has announced that its upcoming mobile update will automatically enable Slipstream channels for paid users. At that time, any transaction from a multisig wallet containing at least one Coldcard key will bypass the public mempool and be submitted via Slipstream to reduce the risk of transaction monitoring and replacement. For users who wish to act immediately or for free users, Nunchuk provides a manual migration option: users must create a migration transaction, complete the multisignature signing but do not broadcast it, then submit the raw transaction data to the Slipstream platform.

Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.