Today, we're taking another big step forward with transparency at @Bitkey. Introducing Bitkey Security Updates. Going forward we'll keep a persistent, public log of every relevant security-related bug we fix in the Bitkey system. For each update, we'll describe the bug, its impact, its fix and any required customer actions. We'll also include information about who found the bug, whether it be our own security teams at Bitkey/Block or by external researchers. We believe this type of visibility is in line with the Bitcoin ethos. It's what customers deserve, particularly with the advancements in the ability of LLMs to find critical security vulnerabilities. We hope this gives our customers clarity and peace of mind. We'll work hard to keep you in the loop as we continue to build.

1/ During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps. That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps.

1/ Block’s engineering and security team found another set of transactions that could be a part of the Coldcard drain. We’re still working to vet these completely, but given the situation, we feel it’s important to share early.