Highlander

Lead at

[KeepKey @cryptokeepkey]

A passphrase is never stored on your KeepKey. That's the point: someone holding the device still can't open the hidden wallet.

It's also the cost. Lose the exact passphrase and your recovery words alone won't bring those funds back.

Who needs one, and how to test it first.

[KeepKey @cryptokeepkey]

Swap without opening an exchange account. KeepKey Desktop asks six providers for quotes (THORChain, Mayachain, Relay, 0x, ChainFlip, ShapeShift) and you sign from your own wallet.

The quote shows the rate, fees, route and time. Read it, then confirm the amount on your KeepKey.

[KeepKey @cryptokeepkey]

A hardware wallet does one job well: your keys stay on the device, and nothing is signed until you press its button.

It can't read a request for you. And it can't protect a recovery phrase once it leaves the paper.

Start here: the habits that matter, in 2 minutes.

[Highlander @KeepKeyDevs]

The amount of funds lost to software wallets is starting to go exponential. The diligence needed to maintain crypto in the space is accelerating faster then I fear we are ready for. People need to realize, its not only your funds that are lost, your funds are being used to attack others.

[Highlander @KeepKeyDevs]

Impressive find. 👀 the diligence needed to keep up in this space is seriously increasing fast. Will be releasing a hardened BEX update for KeepKey soon.

[V12 @v12sec]

Stick around on our web page for 10 minutes and all your funds are gone.

Just connect your wallet to the dApp and enjoy some Temple Run. Unlock your wallet again and it’s empty 😇.

A silent signature extraction in @Rabby_io, leading to a full wallet drain. 🧵

[Highlander @KeepKeyDevs]

@HodlSmaug @cryptokeepkey No—nothing in the Coldcard issue indicates OG KeepKeys are at risk.

But the answer shouldn’t be “trust us.” We’re staying diligent and bringing more validation to users. We believe simple, well-understood systems—not more complicated hardware—are the solution. More soon.

[Highlander @KeepKeyDevs]

@_I_D_W__ @TVJHTV Yes if you actually read the article I detailed the exact code that broke in coldcard, And how KeepKey differs and exactly and how you the end user can validate.

[Highlander @KeepKeyDevs]

Been getting a lot of questions about the coldcard seed bug,

so — short version. It wasn't a hack. Nobody broke a PIN, opened a device, or installed malicious firmware.

A build flag meant affected devices picked their secret from a far smaller set than they should have.

Those coins were guessable from the day the wallet was made. Some of them, five years ago. Here's my breakdown of what to know.

[Highlander @KeepKeyDevs]

@TVJHTV Yes the article talks about keepkeys hardware entropy generation and how its differnt. We internally audit this. and will be releasing tools to let users perform these entropy/birthday/collision tests as a end users.

[Highlander @KeepKeyDevs]

@BTCsessions @nunchuk_io @KanutoTakumi Yes @SparrowWallet is high quality and the best when it comes to multi vendor bitcoin only multisig.

[Highlander @KeepKeyDevs]

Entropy isn’t blind trust. Anyone can generate large seed sets and audit an RNG with NIST SP 800-90B entropy tests (including collision analysis). Dice still rely on hardware for BIP39’s SHA-256 checksum anyway. I’d rather build hardware people can understand and verify than regress to Stone Age workflows.

[Bitcoin Magazine @BitcoinMagazine]

JUST IN: A second Coldcard hack has been reported.

A total of 1,158.81 BTC has been stolen from 2,673 addresses so far, according to Galaxy Research.

Users are urged to review the company's official security guidance as soon as possible‼

[Charles Guillemet @P3b7_]

If you have a Bitcoin multisig that can be fully spent using compromised seeds (for example, a 2-of-3 multisig where two Coldcard seeds are vulnerable), you are in a critical situation.

The good news is that if the multisig uses P2WSH or P2SH-P2WSH, the spending script is not revealed on-chain until the first spend. This provides some protection because an attacker with only the compromised keys may still not have the script required to construct a valid transaction.

However, the script was never designed to be secret. From a cryptographic perspective, it is public information. In practice, copies may already exist in your wallet provider's database, backups, logs, or other systems. You should therefore migrate these funds to a new and secure setup as soon as possible.

The catch is that your migration transaction will reveal the spending script in the mempool. If an attacker already has enough compromised keys and the script, they can create a conflicting transaction spending the same UTXO to themselves and try to get it confirmed instead.

To reduce this risk, avoid broadcasting the migration transaction through the public mempool. Use a trusted private transaction relay that can submit the transaction directly to miners. MARA's Slipstream is one example.

[Casa Bitcoin 🇸🇻 @casab_sv]

Gracias Keepkey!!🚀🚀 @KeepKeyDevs https://t.co/PzxJKu7OtG

[KeepKey @cryptokeepkey]

KeepKey Vault v1.4.3 is live 🚀

Update to firmware 7.14.1 for full Solana, TRON, and TON support.

More chains. One Vault. Your keys stay yours.

Update today.

https://t.co/565MTYcM9B

#KeepKey #Solana #TRON #TON

[E-Zec #z2z @ezecZshield]

@Zcash on @cryptokeepkey — Developer Preview | KeepKey | KeepKey Hardware Wallet

https://t.co/CIuSLIR6VR

https://t.co/NjSXkI60TM

[Highlander @KeepKeyDevs]

@casab_sv @ElectrumWallet @bluewalletio @activos_mayores @JMayenTGU Hey guys, keep up the good work! Keep an eye on our in-house watch only mobile wallet as well KeepKey Mobile https://t.co/WxEAoOxX6n

[🇮🇪🛡 | Mac | 🛡🇸🇻 @MacOnChain]

Just got my first @cryptokeepkey with @Bymoonhunter, thanks to @casab_sv!

Really appreciate it man!

Let's grow the movement in El Salvador 🇸🇻

[KeepKey @cryptokeepkey]

What's inside a KeepKey?

A simple, purpose-built computer:

• An open MCU running verifiable firmware
• A screen you read before signing
• A button you press to approve
• No radios. No hidden chips.

Let's take a look 👇