Discover everything
Blockrise has to offer.

People lost bitcoin that they held offline on hardware wallets with a strong reputation in the Bitcoin community. They had moved their bitcoin away from exchanges and protected their seed phrases, yet a flaw in affected COLDCARD firmware made some wallet seeds more predictable than intended.

This does not mean that self-custody has failed, nor does it prove that professional custody is always safer. It shows that the security of a Bitcoin wallet depends on the full process around a key: how it is generated, where it is stored, what must happen before it can be used and how access can be recovered.

What went wrong

A Bitcoin private key is a very large number. In wallets that use a 12- or 24-word seed phrase, those words encode the entropy from which the wallet’s keys are derived. Security depends on an attacker being unable to predict or reproduce that entropy.

During a software change in 2021, affected COLDCARD firmware began using a deterministic software fallback instead of the intended hardware random-number generator. Later devices added entropy from a secure element, but Block’s analysis found that the implementation retained only a limited amount of it. The devices continued to produce valid seed words, normal addresses and working transactions, so the weakness was not visible to the owner.

Coinkite has since released fixed firmware and advises affected users to migrate to a newly generated seed. Installing the update prevents the same generation path from being used again, but it does not repair a seed that was created before the update.

Bitcoin’s cryptography remained intact. The fault lay in one implementation of the process that supplied randomness when a wallet secret was created.

Why a hardware wallet is only one part of security

A hardware wallet can isolate keys from an internet-connected computer and protect transaction signing. Those controls matter, but the owner still depends on the device firmware, its build process, the implementation of key generation and the quality of testing around it.

Using several devices does not automatically remove that dependency. If multiple keys were generated by the same device family, firmware or random-number implementation, they may still share one failure mode. The same principle applies to multisignature: distributing keys helps only when the components and procedures are genuinely independent.

Security therefore has to be assessed as a system rather than as a product label. Key generation, storage, authorisation, monitoring and recovery each address a different risk.

How Blockrise limits key access

Blockrise is publishing this article to help Bitcoin holders understand the vulnerability and protect their funds. The incident should not be used to present one custody model as universally superior. Our responsibility is to explain the risk clearly and support clients who may be affected.

Blockrise uses a semi-custodial model in which every client has a segregated Bitcoin wallet that can be verified on-chain. Client bitcoin are not pooled into a general wallet.

Blockrise protects its Bitcoin keys using self-owned and self-hosted Securosys Primus CyberVault X2 Hardware Security Modules, or HSMs, with geographic redundancy. The private keys are configured as non-exportable, which prevents them from leaving the HSM in plaintext and prevents Blockrise application software or operators from extracting or copying them.

Each client creates two distinct access components when setting up a Blockrise wallet:

1. The mobile key. On supported devices, the phone generates and holds this key inside its secure hardware. The key cannot be exported or transferred to another device. It signs each transaction request from the client.
2. The Blockrise Seed. The phone generates this recovery secret using its cryptographically secure random-number generator. The client can write it down or use the Blockrise Cloud Recovery service, which encrypts the seed before storing it in the client’s own cloud environment. The Blockrise Seed is required to recover access because the mobile key cannot be exported or transferred.

When a client authorises a transaction, the phone signs the request with the mobile key. The corresponding HSM-held Bitcoin key requires that client authorisation before it can produce a Bitcoin signature. Blockrise can apply controls that stop a transaction, but it cannot move client bitcoin without the required client authorisation.

Securosys has previously achieved FIPS 140-2 Level 3 validation for earlier Primus HSM hardware and firmware. The CyberVault X2 is the newer generation and is currently undergoing FIPS 140-3 Level 3 certification. Certification is one source of assurance within a broader security framework, alongside the controls Blockrise applies to key access, authorisation and recovery.

Technology is only one part of that framework. Blockrise Capital B.V. provides custody services under MiCAR and is supervised by the Dutch Authority for the Financial Markets. Blockrise combines HSM key protection with segregated client wallets, cryptographic confirmation of transactions, multi-factor authentication, operational controls and regular audits. Securosys attestation tooling provides an additional way to verify relevant device and key attributes. The Blockrise Custody Policy Summary explains the main custody, segregation, access and accountability measures.

What affected COLDCARD owners should do

If you have ever generated a seed phrase using a COLDCARD and cannot confirm that the firmware was unaffected, treat the seed as potentially vulnerable and migrate the bitcoin as a precaution. Blockrise can help clients assess their situation and plan a safe migration.

Keep the following points in mind:

• Updating the COLDCARD firmware does not repair an existing seed phrase.
• Restoring or importing the same seed phrase into another hardware wallet does not make it safe.
• Create a completely new seed using an unaffected device or a COLDCARD running the latest fixed firmware.
• Verify the new wallet and receiving address on the device itself.
• Never share your seed phrase with Blockrise, COLDCARD support or anyone else. Be alert to phishing emails, websites and unsolicited messages.

The warning concerns the origin of the seed phrase, not where it is currently stored. A seed generated on affected COLDCARD firmware may remain vulnerable after it has been imported into another device.

From 1 July 2026, Blockrise will remove the performance fee on Fundamentals, following last month’s move to cut custody fees to zero and further aligning its asset management offering with long-term Bitcoin ownership.

Rotterdam, 24 June 2026 - Blockrise today announced that it will remove the performance fee from its Fundamentals strategy. The new fee schedule takes effect on 1 July 2026 and brings the proposition further in line with the Bitcoin ethos of long-term value retention.

The change matters for clients and investors with a long time horizon. A performance fee takes a share of returns when a strategy performs well, which is also when compounding matters most. Under the new model, Blockrise earns from managing assets and providing services, not from participating in the upside.

The decision follows Blockrise's recent move to set custody fees to zero, making secure Bitcoin custody available without an ongoing custody charge. Together, both changes reflect the same principle: long-term Bitcoin exposure works best when friction stays low and incentives stay clear.

"We want our proposition to reflect what Bitcoin investors value: clarity, alignment, and long-term exposure," said Jos Lazet, CEO of Blockrise. "Removing the performance fee is the logical next step after reducing the custody fee to zero. Both decisions come from the same conviction.”

Fundamentals is a systematic, rule-based strategy that adjusts exposure between Bitcoin and euro using a quantitative model. It is built for people who want long-term exposure to Bitcoin with managed downside and lower volatility, while maintaining control over their own bitcoin. The strategy creates value through the model and risk management, not through frequent trading.

The latest fee schedule is available on the Blockrise website.

About Blockrise

Blockrise is a Bitcoin-only platform based in Rotterdam, with a mission to make bitcoin accessible without compromising what makes it valuable. Founded in 2017, it offers trading and asset management. Clients use a hybrid custody model designed to preserve control and verifiability over their bitcoin.

Blockrise serves individuals and businesses across Europe. Visit www.blockrise.com

For interview requests and more information:

Jos Lazet, Founder and CEO Blockrise j.lazet@blockrise.com +31 10 848 1741

‍

‍

Amsterdam, 23 June 2026 -bunq, Europe’s second-largest neobank, today announced “bunq-as-a-Service” is open to businesses across the EU. Its comprehensive Banking-as-a-Service (BaaS) offering enables companies to use bunq’s powerful technology to solve real-world problems and make their users' lives easier.

Having launched in April 2026 with its anchor partner, Dutch Bitcoin platform Blockrise, bunq-as-a-Service allows businesses to build upon bunq’s developer-ready open API, leveraging its security and speed while reducing their time-to-market, as well as issuing virtual cards and processing instant SEPA transactions. Now extended to mid-size and enterprise companies looking to embed financial services quickly, simply, and efficiently, bunq-as-a-service can help handle complex compliance and security requirements, enhancing user experience and unlocking new revenue streams.

In the first month alone, 40% of eligible Blockrise users chose to migrate to their own personal bunq IBAN.

“For years, we've been obsessed with building technology that simplifies life for our users. With bunq-as-a-Service, we're taking that mission a step further by empowering the most innovative companies in Europe to do the same," said Joe Wilson, Chief Evangelist at bunq. "It's our license, our compliance, our infrastructure but the partners own the user journey and focus on what they do best: creating exceptional experiences for their users.”

‍Businesses interested in integrating bunq-as-a-Service can find out more: https://www.bunq.com/en-es/business-account/banking-use-cases/baas

Read the full press release of bunq

‍