Why We Chose Blockstream Jade for Swan Vault

A five-year-old bug in Coldcard firmware has drained more than a hundred million dollars from roughly 7,300 addresses in a matter of days. The people who lost that money did everything they were supposed to do. Our team, like so many other Bitcoiners, has been busy helping those affected get their coins to safety. But the messages I’m getting aren’t only from Coldcard owners. Everyone is asking the same question: is my setup safe?

If you hold a Swan Vault, the short answer is that your setup is sound, and we are not recommending that anyone migrate in response to the Coldcard incident. However, a few clients have asked us about adding a second hardware vendor. That decision comes with its own set of tradeoffs. It’s the right question, and I’m answering it the way I’d want it answered for my own family’s savings. First, let’s understand how the Swan Vault is secured today.

Why the Hardware Wallet Matters

Every Bitcoin private key is a very large random number, picked from a set of numbers roughly the size of the number of atoms in the universe. You usually see it represented as seed words, a 12 or 24-word phrase. Your bitcoin lives on the blockchain, while the key gives you the ability to spend it. The device doesn’t actually hold your bitcoin, only the key, which is why engineers often call it a signing device instead of a hardware wallet. As long as that number is genuinely random, the list of possible keys is so large that no one, using all the computing power on Earth, could ever guess it. A hardware wallet exists to store and manage that key securely, and to permit you to spend your Bitcoin by generating signatures for every transaction.

One of the most important moments of your self-custody journey, therefore, is the few milliseconds when your device generates that number. If the randomness, what engineers call entropy, is weak, the setup is compromised before you’ve received a single transaction. This class of failure is not new, but it has almost always been software: mobile operating systems, browser code, developer tools. Purpose-built signing hardware has a considerably better record, which is exactly why the Coldcard vulnerability is so painful.

When we evaluate any hardware wallet, we break the risk into primarily three categories:

1. Key Generation Risk. The device produces keys an attacker can guess or reproduce, because the entropy was weak or manipulated.

2. Key Extraction Risk. An attacker with your device in hand, or with compromised firmware on it, extracts or leaks the keys.

3. Vendor Risk. The company behind the device disappears, ships low-quality firmware, stops delivering security updates, or was never trustworthy to begin with.

Key Generation Risk: Where Blockstream Jade’s Entropy Comes From

Blockstream Jade / Jade Plus takes an approach modeled on Bitcoin Core’s randomness architecture, which is as battle-tested as any system on the Internet. Rather than trusting any single source of randomness, Jade maintains an entropy accumulator: think of a bucket that is continuously stirred, hashing (SHA-512) the previous state together with fresh input from up to nine independent sources, including:

• Raw radio noise sampled at boot, even on radio-disabled firmware

• Noise from the camera taking images at boot time

• CPU timing counters

• Battery state

• Ambient temperature sensors

• User input on the device

• Additional optional entropy contributed by a companion app

Or instead of relying on all these, you can input your own.

Why does mixing sources matter? Because a cryptographic hash of many independent sources is at least as strong as the strongest input. Weak sources cannot poison strong ones. To rig the outcome, an attacker would need to predict or control several independent physical noise sources at the same time.

The Coldcard bug is a lesson in why none of this counts until you check the path the seed actually takes. That device had good entropy sources too. However, the developers shipped a bug that disabled the random generator in the device, and caused it to fall back to a software based one that wasn’t really random at all. This allowed attackers to search through all the possible private keys without having their hands on the device. 

After any industry incident, our standard practice is to review any impacts to our systems. We have begun an independent review of the Jade firmware, focused on how it calls the hardware entropy generator and our preliminary findings are consistent with Blockstream’s own statement. We will publish full results once complete.

Key Extraction Risk: The Blind Oracle

Many hardware wallets store your secrets inside a proprietary closed-source secure element, a chip whose design is confidential and which no outside researcher can fully inspect. This is a reasonable design, but it does require some trust in the manufacturer and their certification bodies. Secure elements are routinely used in bank-grade and military-grade systems, so they should not be dismissed as insecure. However, Jade made a different trade-off by not using a traditional secure element. Instead, your seed is stored on the device only in encrypted form, and the decryption key is split between the device and a remote server, Blockstream calls a blind oracle. The split makes a stolen Jade worthless to whoever took it, and it removes the reliance on a closed-source chip you would otherwise have to trust.

Here’s what happens when you set up a Jade:

1. You choose a PIN. Your Jade and the oracle then agree on a shared secret, without either one ever transmitting it. 

2. That shared secret becomes the key that encrypts your seed on the device. Neither the device nor the oracle can decrypt it alone.

3. The oracle keeps only a scrambled version of your PIN. It never learns the PIN itself, your keys, your addresses, or anything else about your wallet. That is what makes it blind.

4. To unlock, you enter your PIN and the oracle supplies its half. Enter it wrong too many times and the oracle stops answering, and the encrypted seed on the device can never be recovered.

A stolen, locked Jade is effectively a paperweight. An attacker with physical possession cannot access your seed, because the seed is not recoverable from the device alone. Extracting keys requires compromising both the physical device in your possession and a hardened server running at Blockstream, two entirely different attack surfaces. Blockstream calls this a virtual secure element.

Because there is no closed-source chip, the entire device, firmware, and hardware are fully open source and independently auditable. You can even run your own oracle rather than Blockstream’s, or build a Jade from off-the-shelf parts if you are so inclined. Combined with encrypted flash, secure boot that refuses unsigned firmware, and Bitcoin-only firmware with a deliberately small attack surface (no altcoins, no DeFi integrations, no external browser extensions), the device presents very little for an attacker to work with.

Vendor Risk: The Company Behind the Device

A hardware wallet may require updates after initial purchase. All things being equal, you want a mature, well-funded company with a long operating history, and a deeply security-minded team.

Blockstream was founded in 2014 by Dr. Adam Back, inventor of Hashcash, the proof-of-work scheme cited directly in the Bitcoin whitepaper, alongside longtime Bitcoin Core contributors including Pieter Wuille and Greg Maxwell. The company has funded core protocol development and foundational research for over a decade, through multiple brutal bear markets. Its business appears durable with hundreds of millions of dollars raised, multiple business lines besides the Jade, and Bitcoin on its balance sheet since the beginning. 

That said, avoiding vendor dependence is best. We looked for a partner whose work we could recreate if they were gone. Blockstream Jade’s stack is fully open source, so the hardware and firmware can outlive the company. Even if Blockstream goes away and the oracle is gone, your Jade can be restored with your seed backup. Your seed words follow a standard called BIP39, which is compatible with any other wallet. Along with the descriptor on your backup sheet, you can rebuild the wallet in other software or hardware. If Blockstream disappeared tomorrow, you would have some work to do, but you would not have a loss.

How Swan Vault Puts It Together

Swan Vault is a 2-of-3 multisig. You hold two keys on two Jade devices, kept in separate physical locations. You manage the third key, your Swan Vault cloud key, through your Swan account. Any two keys can move your bitcoin, but no single key can. Here’s what this structure eliminates:

Swan as a point of failure. Swan has access to one key, and one key cannot move anything. The Swan Vault cloud key resides at BitGo, one of the industry’s longest-standing custodians. BitGo launched the industry’s first multisig wallet in 2013 and recently obtained an OCC banking charter. If Swan or BitGo became unavailable, you would sign with your two Jades and sweep your funds. We maintain the open-source Swan Vault Recovery Assistant, which you can download and save for later, or you can use community-maintained open source tools such as Specter Desktop. Swan acquired Specter, one of the first and most popular multi-sig coordinators in the industry, in 2022, and the Specter team of cryptography and Bitcoin specialists helped build what Swan Vault is today. In 2025, Swan donated the Specter project back to the community, and it is now maintained by the Specter Association, a Switzerland-based nonprofit. The Swan-side key is managed by you, in your account, and is secured by multiple login factors, a waiting period, and risk and security checks by human and machine agents.

You as a point of failure. Lose a Jade to fire or theft, lose your seed, or lock yourself out with failed PIN attempts, and you still have your second device plus the Swan Vault cloud key. A 2-of-3 quorum ensures that you always retain access to your funds, even if one of your devices or seeds is lost.

Blockstream as a point of failure. Your two Jade keys share a vendor and a firmware codebase, so the quorum deliberately includes a third key generated and secured on entirely separate infrastructure at BitGo, on custom hardware security modules. Different hardware, different software, different organization. This protects from certain classes of attacks because it requires the attacker not only to obtain both of your seeds, but also the descriptor of the setup by monitoring your on-chain spending activity.

Seeds, Descriptors, and Self-Recovery

A multisig wallet is defined not by just its private keys, but by its descriptor: a small piece of text specifying the extended public keys of all three participants, the derivation paths (this instructs the wallet on how to generate addresses), and the 2-of-3 spending policy. It contains no private keys and cannot spend anything, but it is the map that tells wallet software how to reconstruct your addresses. Two sets of seed words without the descriptor is like holding two vault keys without knowing which building the vault is in. 

Your descriptor is available from your Swan account, and our self-recovery process walks you through restoring your wallet in open-source software with no participation from Swan whatsoever. We recommend storing a copy of the descriptor on your backup sheet alongside each set of seed words.

Swan Vault defaults to 12-word seed backups rather than 24. Some assume 24 words are twice as secure, but a 12-word phrase represents 128 bits of entropy, unguessable by all the computing power on Earth over the lifetime of the universe. The smaller backup reduces the chance for a transcription error, which is a common way that users lose access to seed materials.

How We Think about Adding a Second Vendor

There is one more layer of redundancy available: hardware wallets from more than one manufacturer inside the same quorum. If your two keys live on devices from different vendors, running independently developed firmware, then no single vendor’s mistake, however catastrophic, can reach a spending threshold. Plans are already in motion to add support for a second hardware vendor.

However, a second vendor is not necessarily a panacea, and if the wrong vendor is chosen, it could make the setup more insecure, as the recent Coldcard hack reveals. A second vendor adds a second supply chain, a second setup flow, and a second recovery procedure. We have an exceptionally high bar for vendor selection in the Vault, which is why Swan Vault launched with two Jades rather than two vendors. 

Since our initial launch, a handful of clients asked us to add Coldcard as the second vendor. We decided against it. Our vendor selection criteria weighs device design, security, user experience, engineering team depth, and company longevity, among other factors. A combination of these factors led us to our decision at the time. We didn’t necessarily believe the Coldcard was insecure, but we did believe that going with anything but the most reputable vendor with the deepest cryptography experience in the space could introduce additional risk we were not prepared to take.

The July 2026 vulnerability was that concern realized: a single insufficiently reviewed line of firmware silently weakened five years of seeds, and because the flaw was in seed generation itself, no update could repair an affected wallet. This was a sad day for many Bitcoiners, and we have been working around the clock with clients and non-clients alike to get them to safety. Real people lost real Bitcoin, and they did nothing wrong except trust a device the community broadly endorsed. But the wallets drained at scale were single-signature. The same compromised key inside a multi-vendor 2-of-3 would have been one key in a quorum requiring two: an urgent migration, not a loss.

However, in light of the Coldcard vulnerability, client requests, and the significant advancements that have been made in the hardware market, we are once again engaging in a vendor selection process to decide whether another vendor meets our bar to participate in the Swan Vault quorum.

What If Jade Had a Catastrophic Entropy Bug?

Let’s do what any good engineer does to their own work: try to break it. Suppose Jade shipped a seed-generation flaw of the same class as the Coldcard bug, and every Jade seed became brute-forceable. What happens to Swan Vault clients?

Consider how the Coldcard attack actually worked. Attackers discovered that the Coldcard wasn’t actually generating properly random keys, but rather predictable ones in a much smaller search space. Notably, it wasn’t that Coldcard’s hardware entropy source was broken or badly designed, it was that the bug led them to stop using it entirely, falling back to a software generator that was not truly random. Attackers looped through the space, found matching single-signature addresses, scanned the blockchain for funded ones, and swept them.

That type of attack fails against Swan Vault. Every Vault address is a 2-of-3 script built from three extended public keys: your two Jades and the Swan Vault cloud key, which is generated on entirely independent infrastructure hosted by BitGo. Each client gets a separate Swan cloud key — not a single key for the attacker to obtain. 

Even if an attacker was able to get every Jade seed in existence, they could only derive those seeds' single-signature addresses and would find them empty, because your bitcoin has never lived on one. Without the third public key, which never came from a Jade, the attacker cannot even locate your coins on-chain, let alone reconstruct the spending script.

However, an attacker who separately obtained your descriptor and could brute-force both of your Jade seeds could still assemble a spending quorum. That is why the descriptor should not be disclosed casually, and why a second hardware vendor is a valid concern. There is one edge case here, which occurs exactly at the moment of your on-chain withdrawal from the vault, at which point a part of the vault design, known as the witness script, is revealed on chain, and may give the attacker the third piece of information they need, provided they have already cracked the private keys of the other two seeds (which we believe is impossible today, to be clear).

Swan Vault offers additional protections such as a 72-hour spending delay, and risk and security checks that allow Swan’s intelligent systems and personnel to hold transactions. If a Jade bug, however unlikely, became known in the wild, such checks could act as a deterrent to prevent our clients from spending funds immediately, which would prevent the attacker from receiving the on-chain information they need about the third key, and would allow us to communicate with our clients and help them with an orderly migration.

Our Independent Audit of Jade Firmware

Blockstream recently put out a statement that the Jade is not affected by an entropy bug here:  https://blog.blockstream.com/jade-unaffected-coldcard-vulnerability/. Following the Coldcard incident, as with any industry incident, Swan has undertaken a thorough audit of our entire multi-sig stack including the Jade firmware. We also have received statements from our partners at BitGo that they are undergoing the same and are not affected by the incident.

Our preliminary findings, which include human analysis of deep AI scans by Kimi K3, a frontier open weight AI model, are consistent with the statements that Blockstream put out regarding the Jade and its robust entropy design with a diverse set of sources is extremely robust against failure. We plan to publish the full results of our audit in the coming week.

The Bottom Line

Swan Vault clients do not need to migrate, rotate keys, or change anything in response to the Coldcard incident. As always, we encourage you to periodically review your security setup. Two Blockstream Jades in a 2-of-3 with an independent Swan Vault cloud key is a secure setup, and it’s the setup I use and recommend to friends and family.

When we add support for a second hardware vendor, it will be a choice available to you along with clear education about the issue, so that you can weigh the trade-offs yourself. We will not be forcing a migration. We expect to support one additional device rather than a multitude. We believe supporting too many devices leads to poor user experience, and increases the likelihood that the setup suffers a security issue or user error. This would make Vault worse, not better. We take vendor selection seriously and plan to publish our selection process once we have identified the second partner, so that you can make an informed decision. 

If you want a setup we do not offer, a particular device, or a different quorum or your own coordinator, that is what Swan Sovereign is for. Swan Sovereign is guided self-custody, where you choose the architecture and we guide as you build it.

If anything about your setup still nags at you, whether it’s a Swan Vault or not, ask us. Walking through it together is why we’re here.