Hong Kong, China, August 6th, 2026, Chainwire

Mixin Safe, a multisignature self-custody product developed by Mixin, enables users to manage their Owner Key with a hardware wallet and combines MPC and timelock mechanisms in a layered security architecture.

Mixin highlighted how the recently disclosed COLDCARD random number generation issue has renewed industry attention on the security of hardware wallet key generation. COLDCARD, manufactured by Coinkite, is a popular Bitcoin-only hardware wallet widely used for self-custody among Bitcoin holders who prioritize air-gapped signing and open-source firmware.

According to a technical report published by Coinkite, certain affected firmware versions did not use the intended hardware random number generation path when creating wallet seeds, resulting in an effective search space below the original security target. The quality of entropy—the randomness used to generate cryptographic seeds—is foundational to the security of every cryptocurrency wallet, since predictable or reduced entropy can make keys vulnerable to brute-force attacks.

Because the issue occurred during seed generation, upgrading the firmware can only correct seeds generated afterward and cannot change previously generated affected keys. Coinkite has advised users to assess their exposure based on device model, firmware version, and seed-generation method and, where applicable, generate a new seed and migrate their assets.

The issue entered the COLDCARD seed-generation process as early as 2021. Although the code had long been publicly available and subject to ongoing industry review, the problem remained undiscovered for several years.

The incident does not diminish the value of hardware wallets or open-source review. However, it demonstrates that any individual device, firmware version, or security implementation may encounter problems. In crypto asset self-custody, users should consider not only the security of each component but also whether multiple critical components share a common source of failure.

Multisignature Security Depends on More Than the Number of Keys

Multisignature can reduce the impact of a single key being lost or compromised. However, if multiple keys required to meet the signing threshold are generated using the same device, firmware, or random number implementation, a shared vulnerability could affect several keys simultaneously.

For example, in a 2-of-3 multisignature wallet, if two keys depend on the same key-generation implementation, a common vulnerability could weaken the security isolation that multisignature is intended to provide.

This is known as correlated risk in self-custody. The concept has long been discussed in Bitcoin security circles, where practitioners emphasize that the benefit of multisignature is only realized when keys are generated using independent entropy sources, different hardware vendors, or different software implementations. When evaluating a multisignature architecture, users should consider not only how many keys it uses but also who generates and controls them, which devices and entropy sources they use, and whether they depend on the same code or infrastructure.

Mixin Safe's Three Key Roles

Mixin Safe defines three key roles—Owner Key, Members Key, and Recovery Key—and uses multisignature and relative timelocks to determine how they can be combined for routine spending and recovery.

• Owner Key: Generated and managed by the user through a compatible software or hardware wallet.
• Members Key: An MPC/TSS-based signing key whose use is authorized through the co-manager approval process. MPC (Multi-Party Computation) and TSS (Threshold Signature Scheme) are cryptographic techniques that distribute signing across multiple parties so that no single party holds the complete private key.
• Recovery Key: Used for recovery and permitted to participate in spending with one of the other key roles only after the relative timelock has been satisfied.

Routine Spending and Delayed Recovery

Before the relative timelock has been satisfied, Mixin Safe's routine spending path is:

Owner Key + Members Key

Once the relative timelock reaches its predefined condition, the Recovery Key becomes eligible to participate in recovery, enabling two additional recovery spending paths:

Owner Key + Recovery Key

or:

Members Key + Recovery Key

A relative timelock does not unlock all assets on a fixed calendar date. Instead, it begins counting after the relevant UTXO receives block confirmation. Each newly created UTXO has its own waiting period. This mechanism leverages Bitcoin's consensus rules—specifically the CheckSequenceVerify (CSV) op-code introduced via BIP 68, 112, and 113—which enforce timelock conditions at the protocol level.

The condition is validated by Bitcoin nodes under consensus rules and is not determined or modified by Mixin Safe. Regardless of whether the timelock has been satisfied, no single key role can move assets independently.

Reducing the Impact of a Single Point of Failure

Through separate key roles, co-management approvals, the MPC network, and on-chain time conditions, Mixin Safe provides security isolation and recovery paths for situations involving device damage, lost keys, unavailable co-managers, or individual MPC node failures.

If the hardware wallet holding the Owner Key is compromised, an attacker would still lack the Members signature. If a single MPC node fails, it cannot independently generate a complete signature. If the Recovery Key is compromised, it cannot participate in spending before the timelock has been satisfied and must still be combined with another valid key role afterward.

If a user loses the Owner Key, the Members Key and Recovery Key can be used together to complete recovery under the predefined on-chain conditions once the timelock has been satisfied.

This design reduces the dependence of asset control on any single device, key, co-manager, or network node.

Self-custody security is not about assuming that every component will remain infallible. It is about ensuring that the failure of any one component is insufficient to compromise the entire asset-control system.

Mixin will continue to monitor security practices and technical research across the crypto asset industry while improving Mixin Safe to provide users with more resilient self-custody options.

About Mixin

Founded in 2017, Mixin is a privacy wallet focused on security and ease of use. Its technology architecture combines MPC, CryptoNote privacy features, and Signal Protocol encrypted communication. Mixin supports more than 40 blockchains and over 10,000 assets, serves more than 10 million users globally, and enables users to securely manage more than $1 billion in self-custodied digital assets across multiple blockchain networks.

For more information, visit Mixin.

Sonny Liu, Mixin Ltd — [email protected]