Sep 21, 2026 · 22 min · 10 segments
We explore the critical evolution of Bitcoin self-custody, from hardware vulnerabilities like the Coldcard bug to the necessity of multi-vendor multi-sig setups. We also examine software advancements…
So we're starting right at the foundation of self-custody today, which is hardware devices.
Because for a long time, the prevailing wisdom for you, the user, was just, you know, buy a hardware wallet, write down your 24 words, and lock them in a drawer.
Which is, I mean, that's better than leaving it on an exchange.
True.
But Kasa published a blog post this week titled, Is One Hardware Wallet Enough? And it forces a really hard conversation about single points of failure.
They break down the four major threats you have to account for.
Social engineering, fish devices, physical attacks, and lost seeds.
Exactly.
And people obsess over the physical attacks, right?
Oh, yeah.
They worry about a flood or a fire or a family member accidentally throwing away their metal backup plate.
Which are valid.
They are valid.
But CASA brings up that cold card bug as the ultimate counter-argument to the single-device setup.
I mean, what happens when the threat isn't external? What if it's baked into the silicon you're trusting?
Let's break down the mechanics of that, actually, because I know it still haunts people.
Basically, a firmware bug weakened the seed generation on those specific devices.
Right, because when you set up a hardware wallet, it essentially rolls digital dice to generate the entropy for your seed words.
But if the dice are loaded, if the random number generator is flawed due to bad firmware...
The resulting keys are predictable.
Exactly.
And when that vulnerability surfaced, attackers didn't need to break into anyone's house.
They just swept 1300 Bitcoin from wallets built on those mathematically compromised seeds.
It's like my safe analogy.
The padlock doesn't matter if the master key is out in the wild.
So we're starting right at the foundation of self-custody today, which is hardware devices.
Because for a long time, the prevailing wisdom for you, the user, was just, you know, buy a hardware wallet, write down your 24 words, and lock them in a drawer.
Which is, I mean, that's better than leaving it on an exchange.
True.
But Kasa published a blog post this week titled, Is One Hardware Wallet Enough? And it forces a really hard conversation about single points of failure.
They break down the four major threats you have to account for.
Social engineering, fish devices, physical attacks, and lost seeds.
Exactly.
And people obsess over the physical attacks, right?
Oh, yeah.
They worry about a flood or a fire or a family member accidentally throwing away their metal backup plate.
Which are valid.
They are valid.
But CASA brings up that cold card bug as the ultimate counter-argument to the single-device setup.
I mean, what happens when the threat isn't external? What if it's baked into the silicon you're trusting?
Let's break down the mechanics of that, actually, because I know it still haunts people.
Basically, a firmware bug weakened the seed generation on those specific devices.
Right, because when you set up a hardware wallet, it essentially rolls digital dice to generate the entropy for your seed words.
But if the dice are loaded, if the random number generator is flawed due to bad firmware...
The resulting keys are predictable.
Exactly.
And when that vulnerability surfaced, attackers didn't need to break into anyone's house.
They just swept 1300 Bitcoin from wallets built on those mathematically compromised seeds.
It's like my safe analogy.
The padlock doesn't matter if the master key is out in the wild.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
