Bitcoin.com News analyzed how 13 leading manufacturers of these crucial devices communicated on X — the main social media channel dedicated to all matters related to crypto assets — since the crisis began in late July and throughout August.
SPEED AND CLARITY
The teams differed in speed, clarity, usefulness, tone, degree of self-promotion, as well as whether they continued to monitor the situation after a few days and now, several weeks later. For example, the manufacturer Bitkey — the American company Block, which participated in the initial Coldcard investigation — was one of the first to alert its users and the broader community about the vulnerability, soon followed by the Canadian company Blockstream, the maker of Jade. Meanwhile, it took some other companies over a day to post a message on X. One industry leader — the European company Ledger — informed its X followers approximately 14 hours after the crisis began.
However, those who responded the fastest were not always the most thorough.
BROAD SELF-CUSTODY POSSIBILITIES
In any case, among the trends evident in wallet manufacturers' communications, particular attention was paid to methods of entropy generation, as teams tried to differentiate themselves from Coldcard. Additionally, some teams emphasized support for user-generated entropy as a way to reduce reliance on the device's own random number generator (RNG).
There was also a varied approach in how closed-source and open-source device manufacturers tried to reassure their users. Devices with a stronger open-source focus (Passport Prime, Trezor, Bitbox, Keystone, Blockstream Jade) relied on verifiability, while devices with a more closed-source nature (Ledger, Tangem, Ngrave) leaned more on certifications and audits.
Furthermore, not all teams discussed multi-signature (multisig) setups as a structural protection, especially when it came to configurations involving multiple vendors, while several companies seized the moment to promote broader self-custody best practices in general.
HELP AND BRAGGING
Regarding follow-up actions, Trezor, Bitkey, Bitbox, and Blockstream Jade stood out as more active participants, providing additional information, while Ledger, Tangem, Safepal, and Ngrave were relatively less active in this regard.
Additionally, not every team provided practical migration guidance for affected users, with Foundation (maker of Passport Prime), Bitkey, Ellipal, Jade, Bitbox, and Trezor standing out with their specific recommendations. Meanwhile, Foundation and Trezor also reported on their additional security enhancement measures. Ngrave and Ellipal appeared to use the most flamboyant advertising language, such as "the world's most secure," "leader in air-gap technology," etc.
Now let's briefly review the communications from each wallet. They are ranked by the date of the first post on X during the crisis.
THE RESPONSE OF 13 LEADING BITCOIN HARDWARE WALLET MARKET LEADERS TO THE COLDCARD CRISIS
Bitkey
July 30, 10:07 PM EDT
Bitkey and its manufacturer, Block, took early initiative in the Coldcard crisis: the Block team independently investigated the thefts and published a detailed technical analysis confirming that the seedless Bitkey wallet was not affected. Beyond clear explanations in accessible language and warnings that vulnerable Coldcard seeds remain compromised even if moved elsewhere, the team also advised against rushing to set up new self-custody systems. An FAQ published in mid-August reiterated that Bitkey was unaffected, no action was required, and detailed its core "2 of 3" multi-signature architecture. Subsequent communication shifted focus to educating users about multisig and recovery, rather than repeating crisis messages.
Blockstream Jade
July 30, 11:20 PM EDT
This team immediately ensured that Jade's seed phrases are generated from multiple independent entropy sources. Furthermore, it published a practical blog post outlining a four-step migration process for affected Coldcard users. The team detailed Jade's multi-source entropy architecture and emphasized its fully open-source nature. Subsequent posts focused on answering user questions, explaining the wallet's security features, and announcing new offline entropy generation methods.
Passport Prime
July 30, 11:33 PM EDT
The Passport Prime wallet manufacturer responded with a statement that all its models have always generated correct entropy and are secure. This was followed by detailed technical posts explaining the Coldcard failure and its own multi-source hardware entropy architecture. Additionally, the team shared a post-incident deeper analysis of its entropy architecture. Among the specific new measures announced were enhanced health monitoring to prevent low-entropy seeds from hardware failures, releasing a Passport Prime app for entropy testing available to users, and plans to publish AI-powered code verification reports with each software release.
Trezor
July 31, 3:16 AM EDT
Trezor assured users that their funds were safe but soon added that anyone who transferred a seed generated by Coldcard to Trezor was still at risk. Similar warnings were present in most other wallets. A few days later, the team published a technical breakdown of the wallet's entropy architecture. Communication continued into mid-August: the company pinned its stance and reiterated explanations about entropy, phishing warnings, and mentioned potential future support for dice-based entropy. Meanwhile, on August 13, Trezor reported that nearly 14,000 of its customers were affected by a data breach at ShipMonk, one of Trezor's delivery service providers.
OneKey
July 31, 4:24 AM EDT
Reassuring its users that their devices were unaffected by the incident, OneKey clarified that entropy is generated exclusively on the device itself by combining independent random number sources. Subsequent posts reiterated the same key points, including the device's two entropy sources, certification, open-source firmware, and ongoing scrutiny by security experts, along with more detailed articles, including on multisig and how to enhance seed phrase security levels.
Bitbox
July 31, 4:52 AM EDT
Even before its first substantive statement on July 31, the team had already replied in a separate earlier thread that its devices were safe. BitBox also clarified that its seed phrases combine five independent entropy sources. Subsequent posts detailed these entropy sources presented as part of a "multi-layered defense" concept, also mentioning open-source firmware, internal AI-powered audits, a bug bounty program, and support for a manual dice-based entropy generator. BitBox also explained the advantages and disadvantages of a multisig setup. Separately, unrelated to Coldcard, BitBox disclosed and fixed its own firmware bugs. No instances of their exploitation were reported.
Keystone
July 31, 6:47 AM EDT
Keystone's initial posts addressed entropy generation without mentioning the Coldcard crisis, but a further statement on August 4 confirmed that internal checks showed all Keystone devices were safe. Later, the team detailed their device design, emphasizing that the generation process was verified at every stage. They also offered two additional solutions: adding a BIP-39 passphrase or using the device's "dice roll" feature. Subsequent replies in early August focused on the multi-source architecture and the dice roll/passphrase options, also encouraging users to review the open-source firmware and public audit reports for independent verification.
Ledger
July 31, 12:16 PM EDT
After an initial message stating that the Coldcard issue did not affect Ledger, pointing to the certified true random number generator built into the secure element, a more detailed explanation from the company's CTO, Charles Guillemet, followed on August 2. Subsequent posts focused on differentiating their technology, also offering advice on multisig, warning that more complex storage schemes could be riskier, and suggesting other solutions like Miniscript and MuSig2 — a two-round Bitcoin multisig protocol. Additionally, the team discussed how it is preparing for AI-powered security attacks. Although Ledger itself suffered no security breaches, its customers were affected by two personal data leaks related to third-party incidents.
Tangem
July 31, 3:08 PM EDT
Tangem was also quick to emphasize that this seedless device runs on completely different code from Coldcard. Later in August, Tangem stated that security is ensured through architecture, testing, and independent verification, not just open-source. Furthermore, the company published an explanation of why malware targeting seed phrases doesn't work against Tangem. Subsequently, the team's main statements focused on architecture and certification.
Ellipal
August 1, 7:21 AM EDT
Beyond reassuring its users, Ellipal urged them to verify, not just trust, as the device accepts a seed the user generates themselves. Additionally, the company shared an explanation on how to independently verify generation randomness. Two days later, it offered a giveaway of seed security tools. Subsequent posts focused on technical clarifications, and on August 5, offered a migration checklist for users who generated a seed phrase on Coldcard. Ellipal also actively warned its users about phishing attempts and even shared a post by its competitor, Ledger, about open-source hardware.
Safepal
August 1, 2:14 PM EDT
SafePal also focused on emphasizing its difference from Coldcard, stating that this wallet extracts entropy at the moment of wallet creation, not relying on a single chip or source. Like many other wallets, the company also warned about phishing attempts. Its post and blog entry on August 1 essentially comprised the entire response; only a later post about passphrases was published. However, on August 16, the company reported that nearly 40,000 of its customers were affected by a data breach.
Ngrave
August 1, 3:43 PM EDT
Ngrave emphasized its "Perfect Key" generation process, which combines multiple cryptographic methods, air-gap generation, and the user's own fingerprint. Later, the company continued to remind users that using a single source for key generation represents a single point of failure. The company also invited users to independently verify this development. Furthermore, the team stated it uses "various cybersecurity evaluations using Large Language Models (LLMs), applying cutting-edge world models to safeguard your funds," and announced a customer data deletion program.
KeepKey
August 1, 4:25 PM EDT
KeepKey shared a technical breakdown from its developer and posted a link to a KeepKey blog post explaining who was at risk, what steps to take for migration, and why a multisig setup solely based on Coldcard does not protect against this type of failure. This was KeepKey's only post since the Coldcard crisis began, as this team is not very active on X.
In conclusion, the Coldcard crisis not only taught hardware wallet manufacturers new security lessons, but hopefully, their communication will also improve further when/if the next crisis erupts.
Bitcoin.com News contacted all these teams for comment and will publish their responses if received.
end-content
