Hong Kong, China, August 6th, 2026, Chainwire
Mixin Safe, a multisignature self-custody product developed by Mixin, enables users to manage their Owner Key with a hardware wallet and combines MPC and timelock mechanisms in a layered security architecture.
Mixin highlighted how the recently disclosed COLDCARD random number generation issue has renewed industry attention on the security of hardware wallet key generation.
According to a technical report published by COLDCARD manufacturer Coinkite, certain affected firmware versions did not use the intended hardware random number generation path when creating wallet seeds, resulting in an effective search space below the original security target.
Because the issue occurred during seed generation, upgrading the firmware can only correct seeds generated afterward and cannot change previously generated affected keys. Coinkite has advised users to assess their exposure based on device model, firmware version, and seed-generation method and, where applicable, generate a new seed and migrate their assets.
The issue entered the COLDCARD seed-generation process as early as 2021. Although the code had long been publicly available and subject to ongoing industry review, the problem remained undiscovered for several years.
The incident does not diminish the value of hardware wallets or open-source review. However, it demonstrates that any individual device, firmware version, or security implementation may encounter problems. In crypto asset self-custody, users should consider not only the security of each component but also whether multiple critical components share a common source of failure.
Multisignature Security Depends on More Than the Number of Keys
Multisignature can reduce the impact of a single key being lost or compromised. However, if multiple keys required to meet the signing threshold are generated using the same device, firmware, or random number implementation, a shared vulnerability could affect several keys simultaneously.
For example, in a 2-of-3 multisignature wallet, if two keys depend on the same key-generation implementation, a common vulnerability could weaken the security isolation that multisignature is intended to provide.
This is known as correlated risk in self-custody. When evaluating a multisignature architecture, users should consider not only how many keys it uses but also who generates and controls them, which devices and entropy sources they use, and whether they depend on the same code or infrastructure.
Mixin Safe’s Three Key Roles
Mixin Safe defines three key roles—Owner Key, Members Key, and Recovery Key—and uses multisignature and relative timelocks to determine how they can be combined for routine spending and recovery.
- Owner Key: Generated and managed by the user through a compatible software or hardware wallet.
- Members Key: An MPC/TSS-based signing key whose use is authorized through the co-manager approval process.
- Recovery Key: Used for recovery and permitted to participate in spending with one of the other key roles only after the relative timelock has been satisfied.
Routine Spending and Delayed Recovery
Before the relative timelock has been satisfied, Mixin Safe’s routine spending path is:
Owner Key + Members Key
Once the relative timelock reaches its predefined condition, the Recovery Key becomes eligible to participate in recovery, enabling two additional recovery spending paths:
Owner Key + Recovery Key
or:
Members Key + Recovery Key
A relative timelock does not unlock all assets on a fixed calendar date. Instead, it begins counting after the relevant UTXO receives block confirmation. Each newly created UTXO has its own waiting period.
The condition is validated by Bitcoin nodes under consensus rules and is not determined or modified by Mixin Safe. Regardless of whether the timelock has been satisfied, no single key role can move assets independently.
Reducing the Impact of a Single Point of Failure
Through separate key roles, co-management approvals, the MPC network, and on-chain time conditions, Mixin Safe provides security isolation and recovery paths for situations involving device damage, lost keys, unavailable co-managers, or individual MPC node failures.
If the hardware wallet holding the Owner Key is compromised, an attacker would still lack the Members signature. If a single MPC node fails, it cannot independently generate a complete signature. If the Recovery Key is compromised, it cannot participate in spending before the timelock has been satisfied and must still be combined with another valid key role afterward.
If a user loses the Owner Key, the Members Key and Recovery Key can be used together to complete recovery under the predefined on-chain conditions once the timelock has been satisfied.
This design reduces the dependence of asset control on any single device, key, co-manager, or network node.
Self-custody security is not about assuming that every component will remain infallible. It is about ensuring that the failure of any one component is insufficient to compromise the entire asset-control system.
Mixin will continue to monitor security practices and technical research across the crypto asset industry while improving Mixin Safe to provide users with more resilient self-custody options.
About Mixin
Founded in 2017, Mixin is a privacy wallet focused on security and ease of use. Its technology architecture combines MPC, CryptoNote privacy features, and Signal Protocol encrypted communication. Mixin supports more than 40 blockchains and over 10,000 assets, serves more than 10 million users globally, and enables users to securely manage more than $1 billion in self-custodied digital assets across multiple blockchain networks.
For more information, visit Mixin.
Contact
Sonny Liu
Mixin Ltd
sonnyliu@mixin.one
Be the first to comment