Ledger’s guidance to CryptoBilis buyers on Friday was precise: don’t initialize, and if you already did, move to a new signer with a new seed.
New seed, not just new hardware. The working assumption is that someone else already knows the seed, so restoring it onto a clean device changes nothing.
That is the single-sig problem in one sentence. The device that generates your entropy is the whole security model, and you can’t audit it from the outside.
The Coldcard entropy flaw in August had the same shape. The coins that got swept sat in single-signature addresses.
If your seed was known the day it was made, single-sig has nothing left to stop anyone. On multisig, how many of your keys were generated on hardware from the same vendor, bought through the same channel?
I do custody and inheritance work at The Bitcoin Adviser, so weigh that accordingly.
https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163
bsa / Bitcoin Sovereign Academy
npub1dk…3dx7f
2026-10-12 13:46:20 UTC
Author Public Key
npub1dk45gaza4ph05vefxmx7x8e9yw6qe4x9y4nj5hlflsql6ns0amnqj3dx7fPublished at
2026-10-12 13:46:20 UTCEvent JSON
{
"id": "f4ac9e8cc99add32aa774b2645df1cbc59539d80a0be88a076e3a2ea30cb94eb",
"pubkey": "6dab44745da86efa332936cde31f2523b40cd4c525672a5fe9fc01fd4e0feee6",
"created_at": 1791812780,
"kind": 1,
"tags": [
[
"client",
"Primal iOS"
]
],
"content": "Ledger’s guidance to CryptoBilis buyers on Friday was precise: don’t initialize, and if you already did, move to a new signer with a new seed.\nNew seed, not just new hardware. The working assumption is that someone else already knows the seed, so restoring it onto a clean device changes nothing.\nThat is the single-sig problem in one sentence. The device that generates your entropy is the whole security model, and you can’t audit it from the outside.\nThe Coldcard entropy flaw in August had the same shape. The coins that got swept sat in single-signature addresses.\nIf your seed was known the day it was made, single-sig has nothing left to stop anyone. On multisig, how many of your keys were generated on hardware from the same vendor, bought through the same channel?\nI do custody and inheritance work at The Bitcoin Adviser, so weigh that accordingly.\nhttps://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163",
"sig": "5d101316866f2bb0b65e4435436d97f2a17d22add333dcc1d76de12b20b18a991be4c2679d3fe629e104196fbf0a8578a629b2f9d6c3b26112bc7ca8e01b3ea0"
}