Nostr notes by

A few words given the recent exploits on hardware signing ...

2026-10-12T13:08:05Z

A few words given the recent exploits on hardware signing devices:

• The Ledger supply chain attack represents one of the most sophisticated attacks thus far on the wallet ecosystem. In many ways it’s a lot more sophisticated than the Coldcard RNG exploit, because that one was software only. This one took a cross-border company buyout, tampering with the devices (implanting an eSIM, an LTE module and a CPU) and manufacturing the implants at scale.

• These sorts of attacks have been predicted by early Bitcoiners, but in Bitcoin they remained theoretical or crude until this year. It shows that the level of sophistication of attacks has risen quickly, and what was previously “good enough” advice on wallets and self-custody is no longer sufficient.

• When we started Nunchuk a few years ago, our premise was that multisig, and multi-vendor multisig, needs to become the standard for self-custody in the future. But even we didn’t expect how fast it would materialize. This is likely due to 2 factors: Bitcoin getting more mainstream, and the rise of AI-assisted attacks. This is a Sputnik moment for Bitcoin self-custody. The defenses need to level up.

• Passphrases wouldn’t have helped in the Ledger case, since you are required to enter the passphrase into the device for it to sign any transactions. A compromised device that phones home the seed phrase can also easily phone home the passphrase the moment you enter it.

• Similarly, generating the private key somewhere else (even by rolling dice) and subsequently importing it onto a tampered device wouldn’t save you here. The device can phone home the seed phrase the moment it’s imported.

• Anti-tampering techniques might help, such as transparent casing or bricking the device if it’s tampered with. Or forever displaying a message once the seal is broken. Or using on-device encryption between the internal hardware components. But a dedicated and resourceful enough attacker can still find ways to get around these layers. Tampering and anti-tampering have long been a cat-and-mouse game. In 2008, card readers doctored right off a Chinese production line sent card data and PINs over mobile networks to Pakistan. The Ledger attack is the same playbook, 18 years later. The bigger the target, the more attackers spend on overcoming the defenses.

• You should order directly from the vendors as much as possible, using a PO box for privacy.

• Any setup that relies on a single hardware/software stack or a single vendor should be considered at risk.

• Building your own hardware signers from generic parts is a good option for technical users.

• Multi-vendor multisig should become the standard. Each signer should have a completely independent hardware/software stack from the other signers. The point is that there shouldn’t be any single-point-of-failure anywhere in your setup.

• Many advanced protocols rely on timelocks and the recovery path being a simple singlesig. The recent attacks and exploits should highlight how dangerous this could be. Timelocks simply delay a risk. If a seed is compromised and there’s a timelock involved, the attacker just needs to wait out the timelock. (For Miniscript wallets, there’s the wallet descriptor too, but presumably it also gets sent to the device at some point.) Vault-like protocols face a similar problem: any withdrawal or recovery path that relies on a single key is a potential single point of failure.

• For our on-chain timelock assisted wallets, in a few weeks we are adding the option to customize the recovery path to be an M-of-N, so that, if you want, spending would require multiple keys at all points during the wallet’s lifetime. (Our off-chain timelock assisted wallets have always been M-of-N).

To those who recommend exchanges or centralized custodians over self-custody: that is a lose-lose situation.

Number 1, enterprises face the same problem as end users. They also rely on multisig to secure funds, or on proprietary and largely unproven protocols built on newer cryptography like MPC, which might make them more susceptible to AI-assisted attacks. They also rely on particular combinations of hardware/software stacks. Bybit lost $1.5B from its multisig cold wallet in 2025, because all of its signers used the same compromised web interface. Bitfinex lost ~120k BTC in 2016, despite a multisig setup with BitGo. It’s true that enterprises and huge custodians likely spend orders of magnitude more than the average user to custody funds, but the reward (of breaching security) is also orders of magnitude higher for the attackers. It might simply delay and MAGNIFY the tail risks once user funds concentrate in a few hands. The exchanges and centralized custodians also become huge honeypots, easily succumbing to 6102-style attacks, which will arrive as fiat monies inflate in the coming years.

Number 2, this sort of future inevitably ruins Bitcoin, whose purpose was to be censorship-resistant money. Encouraging people to move funds to exchanges benefits exchanges but is similar to sawing off the branch you’re sitting on. If Bitcoin loses the battle for self-custody, it will have completely lost its soul.

Bitcoin self-custody tools will get better. They have to. Bitcoin is too important to the future to lose.

What makes Nunchuk different from other Bitcoin collaborative ...

2026-08-16T01:12:17Z

What makes Nunchuk different from other Bitcoin collaborative custody providers?

Our service rests on four pillars:
✅ KYC-free
✅ No single point of failure
✅ Open standards
✅ Bitcoin-focused

We committed to these pillars because of a unique experience that shaped us: our part in the Freedom Convoy incident of February 2022. When the Canadian government moved against the protesting truckers and their supporters, we were served a Mareva injunction demanding that we disclose information about our users and freeze their funds. Many services voiced support for self-custody in principle but watched from a distance, unwilling to take on the protesters as users for fear of the government’s response.

That was the moment our vision of what Nunchuk should be became clear. The question we now ask of ourselves is simple: if an entity is powerful enough to compel us to disclose information about our users and freeze their funds — could we even do it?

Can we and our clients withstand a state-level attack? And crucially, it’s not enough to be willing to say no. Our architecture has to make it so that we cannot comply in the first place.

That’s why we’re KYC-free. Your privacy is paramount. Anyone targeting you learns nothing about you even if they compromise Nunchuk, because we don’t hold that information. The one exception is that subscribers provide an email at signup (an anonymous address like Proton works fine), because we need a way to reach you during exactly the kind of security incident we just lived through. Last weekend made the case that this trade-off was the right one.

That’s why we insist on no single point of failure. In practice this means multi-vendor multisig as the foundation. For our assisted wallets, it also means the keys you hold are dedicated hardware signers (no hot key on the phone). In collaborative custody, the provider already holds one key. If the client’s other keys included a hot key running in an app the same provider maintains, a forced or malicious software update could seize a majority of keys (in a 2-of-N setup) and sweep or freeze funds. A hot key on the user’s phone would make life easier for us and our users, but it would fail the standard we set for ourselves in 2022. So we made the harder choice and disabled it entirely in our assisted wallets.

That’s why we build on open standards. In the worst case, you can always migrate your Nunchuk setup to other software that follows the same Bitcoin standards, such as Sparrow. The exit door stays permanently open, even if Nunchuk were to disappear tomorrow.

That’s why we’re Bitcoin-focused. Bitcoin is what we build for, and what we build on, including its Layer 2 system. The wider “blockchain” industry, with many centralizing points of failure, whether explicit or implicit, has proven throughout the years that it cracks under real pressure. We chose depth over breadth, and quality over quantity.

These are the reasons Nunchuk stands apart from other services.

Hi StackSats.IO, Sorry we received a lot of emails, might have ...

2026-07-10T08:24:34Z

In reply to nevent1q…e05f
_________________________

Hi StackSats.IO,
Sorry we received a lot of emails, might have missed it. What’s your question?

Introducing Phased Rollout. Until now, a Nunchuk inheritance plan ...

2026-06-17T15:26:53Z

Introducing Phased Rollout.

Until now, a Nunchuk inheritance plan sent everything to a single heir the moment it triggered. That still works if it’s what you want. But real families are rarely that simple. Maybe you’re splitting your estate between a spouse and kids. Maybe one heir is ready for a lump sum and another isn’t. Maybe you want to stagger distributions for tax or planning reasons.

Now you can divide the estate however you like. Say your spouse gets 50% and your kids split the rest. Each beneficiary has their own share, and their own release schedule.

And you can phase each share over time. One heir receives a lump sum in year 5. Another gets 2% a year for a decade, then 4% a year after that. You build it stage by stage, setting a percentage and a date for each, until the stages add up to 100%. The plan handles the rest.

What if an heir never claims? You decide in advance. Unclaimed shares can stay put, or redistribute to the other beneficiaries after a period of inactivity or on a date you set. No share ever gets stranded.

Everything else works exactly as before. The multisig, your Backup Password, the inheritance key are all unchanged. You don’t migrate anything or move any funds. You hold your own keys throughout. Phased Rollout changes how your bitcoin is distributed, not who controls it.

It runs on our off-chain protocol, the flexible one, which you can update as often as life requires: change beneficiaries, adjust the timing, or reshape the whole plan, all without a new wallet or on-chain fees. If you’d rather have Bitcoin itself enforce your plan, with no dependence on us, that’s what our on-chain protocol is for. Different tradeoffs, both fully supported, and you’re never locked into either. Start with one and switch to the other whenever your needs change.

Live today for Honey Badger and Byzantine subscribers. Update to app version 2.6 or later, and try it free on testnet or an unused wallet first.

Full details on our blog: https://nunchuk.io/blog/phased-rollout

🖥️ ☕️ #nevent1q…ypye

2026-06-12T00:10:54Z

🖥️ ☕️

quoting
nevent1q…ypye
I gave an AI agent its own Bitcoin wallet today.

It bought its own coffee. No human in the loop. Then it tried to spend above its limit, and my Passport Prime froze the payment until I physically tapped to approve.

Autonomous agents that spend. Hardware that can say no.

Foundation (nprofile…85t8) Passport Prime <> nprofile1qy2hwumn8ghj7etyv4hzumn0wd68ytnvv9hxgqgkwaehxw309ahx7um5wgh8xmr0w358jtnhd9hqqgxrq8cnxukg7rvmeqvxmp605306xwhduylxdaqc0gaaythyrj2m9gaf4lkm (nprofile…4lkm) tooling 🤝

New HSM skill: ...

2026-04-22T14:16:36Z

In reply to nevent1q…myyd
_________________________

New HSM skill: https://github.com/nunchuk-io/agent-skills/blob/main/skills/nunchuk-coldcard-hsm/SKILL.md

The Bitcoin agent key can now live in a Coldcard Mk4/Mk5 in HSM ...

2026-04-22T14:15:44Z

The Bitcoin agent key can now live in a Coldcard Mk4/Mk5 in HSM mode.

Even if the host machine running your agent is fully compromised, the signing key stays isolated in hardware. The attacker gets nothing useful.

Bitcoin agents with bounded authority. Now with HSM-grade key security.

quoting
nevent1q…gfts
AI agents shouldn't get the full key to your kingdom.

Today we're releasing Nunchuk CLI: create a shared Bitcoin wallet with your agent, give it a spending budget, and keep the final say.

Build Bitcoin agents with bounded authority.

Go for it! 😂 💪🏻💪🏻

2026-04-11T01:59:44Z

In reply to nevent1q…l5p2
_________________________

Go for it! 😂 💪🏻💪🏻

Looking great!! Btw, we are adding web hooks so you don’t have ...

2026-04-11T01:44:44Z

In reply to nevent1q…rkku
_________________________

Looking great!!

Btw, we are adding web hooks so you don’t have to poll for sandbox/transaction status.

thank you!

2026-04-08T15:27:54Z

In reply to nevent1q…l96p
_________________________

thank you!

Most agentic wallets give the agent a standalone wallet or ...

2026-04-08T14:32:03Z

In reply to nevent1q…gfts
_________________________

Most agentic wallets give the agent a standalone wallet or delegated signer.

Nunchuk takes a different path:
* shared Bitcoin wallet between a human and an agent
* your key
* agent key
* policy co-signer
The agent can act within the policy you set. Above the limit, your signature is required.

Funding a wallet and authorizing an agent are not the same decision.

The wallet can receive funds without automatically increasing what the agent can spend. Receiving is a normal wallet operation. Spending authority is configured separately through Platform key policies — limits, delays, approval flows.

What ships today:
* local key generation + encrypted key storage
* group wallets (m-of-n multisig); Miniscript support is WIP
* sandboxes, invites, joins, finalize
* fresh receive addresses
* create / sign / broadcast txs
* descriptor/BSMS export + recovery
* platform-key policies + dummy-tx approvals

We're publishing two MIT-licensed repos:
1. nunchuk-io/nunchuk-cli — the CLI
2. nunchuk-io/agent-skills — a skill pack that teaches AI agents how to use the CLI

Agent Skills currently covers:
* setup, login, network, config
* wallet creation
* invitations
* Platform key policies
* wallet management
* tx create / sign / inspect / list / broadcast
You install the skills pack and CLI separately.

What builders can layer on top:
* human+agent wallets
* multi-agent wallets
* bill pay agents
* treasury / UTXO management
* privacy-aware spend flows
* agent-to-agent payment flows

Both repos are MIT. You'll need a Nunchuk API key to use the CLI — get one at developer.nunchuk.io.

CLI: github.com/nunchuk-io/nunchuk-cli
Skills: github.com/nunchuk-io/agent-skills

AI should help with financial execution — not get unconstrained control over your money.

Automate what you want. Keep human approval where it matters. Build on Bitcoin.

For a deeper dive, read our full blog post: https://nunchuk.io/blog/bitcoin-agents

AI agents shouldn't get the full key to your kingdom. Today ...

2026-04-08T14:30:02Z

AI agents shouldn't get the full key to your kingdom.

Today we're releasing Nunchuk CLI: create a shared Bitcoin wallet with your agent, give it a spending budget, and keep the final say.

Build Bitcoin agents with bounded authority.

Thank you!

2026-03-27T14:01:54Z

In reply to nevent1q…gq2e
_________________________

Thank you!

🙌🏻

2026-03-27T14:01:18Z

In reply to nevent1q…07zg
_________________________

🙌🏻

Glad you found it useful, and agreed!

2025-12-09T16:52:40Z

In reply to nevent1q…v834
_________________________

Glad you found it useful, and agreed!

🫡

2025-12-09T16:23:43Z

In reply to nevent1q…stmd
_________________________

🫡

🫡

2025-12-09T16:08:45Z

In reply to nevent1q…luaq
_________________________

🫡

We just published "The Definitive Guide to Bitcoin ...

2025-12-09T15:01:10Z

We just published "The Definitive Guide to Bitcoin Inheritance."

We break down everything you need to know about securing your legacy: from Custodial and DIY solutions to the new standard of Autonomous Inheritance, leveraging on-chain timelocks.

Read the full guide: https://nunchuk.io/blog/bitcoin-inheritance-guide

You might be interested in our inheritance solution, using ...

2025-11-25T08:59:30Z

In reply to nevent1q…jcvk
_________________________

You might be interested in our inheritance solution, using on-chain timelocks: https://nunchuk.io/blog/autonomous-inheritance

🫡

2025-11-13T10:50:55Z

In reply to nevent1q…lkmm
_________________________

🫡

🙏🏻

2025-11-13T08:00:21Z

In reply to nevent1q…y3sg
_________________________

🙏🏻

🙏🏻

2025-11-13T07:59:46Z

In reply to nevent1q…prsw
_________________________

🙏🏻

"When the Canadian dollar becomes worthless, we will be here ...

2025-11-13T06:19:06Z

"When the Canadian dollar becomes worthless, we will be here to serve you, too."

That was our closing reply to the Ontario Superior Court of Justice in 2022, when they ordered us to freeze and disclose information about the bitcoin involved in the Freedom Convoy protest.

The story of how that email came about has never been told. Today, we’re sharing that story, and how that event forged our DNA & mission.

***

February 2022. The Freedom Convoy protest was paralyzing Ottawa. Two years of lockdowns and mandates had created incredible social tension.

On Feb 14, Justin Trudeau invoked the Emergencies Act for the first time in Canadian history. It was designed for wars or terrorism; it was now being used against protesters.

Protesters’ bank accounts were frozen without due process. GoFundMe seized $10M in donations at the government’s request. The RCMP demanded that financial firms blacklist Bitcoin addresses.

The Ontario Securities Commission flagged tweets by Coinbase CEO Brian Armstrong and Kraken CEO Jesse Powell criticizing the use of the Emergencies Act to law enforcement. Balaji Srinivasan questioned whether Canada was still a “democracy”. Police began mobilizing in Canada’s capital.

The authorities seemed willing to use everything, even extraordinary measures, to quash the protest.

Many Bitcoin companies backed away, despite having millions in funding.

Jesse Powell, having previously donated one bitcoin to the protest, warned users that Kraken “cannot protect you” from the Canadian government. Elon Musk, who voiced support for the protesters, tweeted “I wish I could help. At this point, it seems that voting at the next election is the remedy.” Even powerful CEOs seemed powerless in the situation.

Then, we received the Mareva injunction.

Nunchuk, a tiny startup still in its infancy, was ordered to freeze assets and disclose information. We are self-custodial and technically unable to comply. But the threat was serious.

The pressure was immense. We had no idea how far the Canadian government was willing to go. And judging by what they had done: very far.

Concerned about the risks to their families, two members of our team decided to quit.

It was an existential crisis.

To complicate the situation, my own personal life was in upheaval.

Around the time the Emergencies Act was invoked, I learned that I would soon become a father.

I went from pure joy to total distress within a week. I thought about the world my child was going to grow up in.

I thought about why I started a Bitcoin company in the first place.

If Bitcoin couldn’t matter in a situation where people needed it most, what good is it? How is it any different from the corrupt, permissioned financial system we grew up with? The one that brought the world to its knees in the Great Financial Crisis, along with many other social woes that we’ve only begun to understand since the shift in 1971? What’s the point of it all?

What will I tell my son about what happened in February 2022?

Then I sat down and wrote the reply.

That email became our North Star. It clarified our mission: to build tools that maximize individual financial freedom and privacy, minimizing reliance on any third party.

"Trusted third parties are security holes", as the great Nick Szabo once said.

This event taught us that true sovereignty requires technologies designed to withstand pressure. Not just from governments, but from time itself.

If we are to secure wealth for generations, our solutions must eliminate ALL single points of failure. They must be designed to outlive us.

Today we announce the next major step in that mission: the realization of our commitment to trust-minimized generational security.

Today we introduce the first assisted Bitcoin inheritance solution, designed to outlive the company that created it. It’s the culmination of all the work we’ve done since that fateful day in 2022. You can read about it here:

https://nunchuk.io/blog/autonomous-inheritance

Thank you! 🙏🏻

2025-11-13T03:26:33Z

In reply to nevent1q…45vz
_________________________

Thank you! 🙏🏻

🙏🏻

2025-11-01T11:17:23Z

In reply to nevent1q…prkz
_________________________

🙏🏻

We just published: How to recover your Nunchuk Miniscript wallet ...

2025-11-01T08:00:18Z

We just published: How to recover your Nunchuk Miniscript wallet with Bitcoin Core.

Happy Bitcoin Whitepaper Day! 📜

https://nunchuk.io/blog/miniscript-wallet-recovery

Guilty as charged 😂 Filed !

2025-11-01T06:24:11Z

In reply to nevent1q…t3dd
_________________________

Guilty as charged 😂 Filed !

New mobile and desktop release: Nunchuk now fully supports ...

2025-10-25T14:41:08Z

New mobile and desktop release:

Nunchuk now fully supports lianabitcoin (nprofile…z2sc) wallet descriptors, including Miniscript wallets that reuse keys across policies.

Next week, we’ll publish a Recovery guide on how to independently recover a Nunchuk Miniscript wallet in Bitcoin Core.

@nprofile…8gvj doesn’t support Miniscript yet, AFAIK.

2025-10-10T01:19:27Z

In reply to nevent1q…0pdx
_________________________

SeedSigner (nprofile…8gvj) doesn’t support Miniscript yet, AFAIK.

KYC is a disaster waiting to happen. If data leaks can happen to ...

2025-05-16T04:23:10Z

KYC is a disaster waiting to happen.

If data leaks can happen to Coinbase, it can happen to anyone.

Related: never use a Bitcoin inheritance service that requires KYC.

You’re not just endangering yourself — you’re putting your family at risk too.

They’re even less equipped than you to defend against attackers.

Nunchuk’s inheritance protocol is non-KYC. That’s by design.

2) Updated fee estimates Our app now shows fee estimates for both ...

2025-04-09T14:43:06Z

In reply to nevent1q…us2c
_________________________

2) Updated fee estimates

Our app now shows fee estimates for both key path and script path, so you’ll know exactly what each transaction costs—or how much to bump via RBF.

1) Disable key path spending https://m.primal.net/QJkW.png By ...

2025-04-09T14:42:16Z

In reply to nevent1q…vce9
_________________________

1) Disable key path spending

By default, key path spends reveal a public key on-chain—great for privacy and lower fees. Theoretically, future quantum computers could target these keys (though that’s still many years away). If you prefer extra caution, you can now stay quantum-resistant by disabling key path spends.

Taproot multisig wallets are a game-changer for superior privacy ...

2025-04-09T14:41:39Z

In reply to nevent1q…kk8y
_________________________

Taproot multisig wallets are a game-changer for superior privacy and lower fees.

If you’re new to Taproot or need a refresher, check out our previous announcement and blog post: https://nunchuk.io/blog/taproot-multisig

🎁 Our Christmas gift to you: Taproot multisig wallets are now ...

2024-12-24T19:23:31Z

🎁 Our Christmas gift to you: Taproot multisig wallets are now live on Nunchuk!

Enhanced privacy, lower fees, and full M-of-N support. Available now on App Store and Play Store.

Merry Christmas, Bitcoiners! 🎄

Read more: https://nunchuk.io/blog/taproot-multisig

Welcome Fran 🙌

2024-12-12T02:37:28Z

In reply to nevent1q…2aqf
_________________________

Welcome Fran 🙌

It’s still there actually. You just have to turn it on in ...

2024-12-10T11:12:13Z

In reply to nevent1q…r2m7
_________________________

It’s still there actually. You just have to turn it on in Settings (on all devices).

We’re working a revamped version of that feature which is 10x better.

❤️

2024-11-30T06:19:28Z

In reply to nevent1q…uw9q
_________________________

❤️

Makes sense! > But I’ve already seen this guy lose his phone ...

2024-11-28T23:39:07Z

In reply to nevent1q…k9nm
_________________________

Makes sense!

> But I’ve already seen this guy lose his phone twice since I met him

This is why it’s important to separate the wallet interface and the signing devices!

Yes!

2024-11-28T07:52:02Z

In reply to nevent1q…hpn4
_________________________

Yes!

You’re welcome !

2024-11-28T07:51:47Z

In reply to nevent1q…gvtg
_________________________

You’re welcome !

You don't need a paid plan to use TAPSIGNER with Nunchuk. ...

2024-11-28T06:41:39Z

In reply to nevent1q…t392
_________________________

You don't need a paid plan to use TAPSIGNER with Nunchuk. We've had a couple of user-reported issues in the last 2 years since adding support for TAPSIGNER, but the overall feedback has been overwhelmingly positive.

Here're a few good tutorials:
https://www.youtube.com/watch?v=xKHy1HMw5iU

https://www.youtube.com/watch?v=wTX-wZGGDsE

https://www.youtube.com/watch?v=sP2sTyHqXQU

Try using Tailscale instead of Orbot, which is more performant. ...

2024-11-28T06:35:32Z

In reply to nevent1q…gugu
_________________________

Try using Tailscale instead of Orbot, which is more performant.

https://x.com/nunchuk_io/status/1861761743384650101

It's false positives. Our wallet is open source and is built ...

2024-11-28T06:34:03Z

In reply to nevent1q…pmx7
_________________________

It's false positives.

Our wallet is open source and is built on Bitcoin Core. The Bitcoin Core code is packaged as a library, which virus scanners often mistakenly label as "mining software".

It means instead of creating a Decoy wallet (which is a real ...

2024-11-28T06:31:40Z

In reply to nevent1q…9j2p
_________________________

It means instead of creating a Decoy wallet (which is a real wallet that holds a small amount of bitcoin) from scratch, you can assign one of the existing wallets that you already have in Nunchuk, to be the decoy wallet. It's one of the feature requests from our users.

If you haven't watched the tutorial on our Honey Badger ...

2024-11-28T06:28:32Z

In reply to nevent1q…x0ft
_________________________

If you haven't watched the tutorial on our Honey Badger wallet, which includes non-KYC inheritance planning, check out this video: https://www.youtube.com/watch?v=kizqvBY4zPE&t=1668s

Genius. Which multisig setup do you use? 1-of-2? 2-of-3?

2024-11-28T06:27:14Z

In reply to nevent1q…vdq3
_________________________

Genius. Which multisig setup do you use? 1-of-2? 2-of-3?

It totally makes sense! Check out a tutorial on our Honey Badger ...

2024-11-28T06:24:50Z

In reply to nevent1q…s5ep
_________________________

It totally makes sense! Check out a tutorial on our Honey Badger wallet which includes inheritance planning, if you haven't: https://www.youtube.com/watch?v=kizqvBY4zPE

Correct . In the assisted multisig wallets, we hold one of the ...

2024-11-26T11:12:01Z

In reply to nevent1q…9eq6
_________________________

Correct . In the assisted multisig wallets, we hold one of the keys.

Tor has always been supported. Many of our users use it. Note ...

2024-11-13T17:12:06Z

In reply to nevent1q…50yl
_________________________

Tor has always been supported. Many of our users use it. Note that you need to run your own Tor proxy.

Guides: https://github.com/nunchuk-io/resources/tree/main/docs/connection-guide

Celebrating Bitcoin’s All-Time Highs with 2 Major Features! 1. ...

2024-11-13T15:59:37Z

Celebrating Bitcoin’s All-Time Highs with 2 Major Features!

1. 🔑 Support for COLDCARD as the inheritance key—generate your own easy-to-remember BIP39 backup passwords. Available now in the app stores/GitHub.
2. 🌑 Dark Mode—coming next week! 🤓

👉 Read more in our latest blog post: https://nunchuk.io/blog/coldcard-inheritance-key

Yes it’s a SeedSigner bug. The issue is here: ...

2024-11-09T02:05:39Z

In reply to nevent1q…wp07
_________________________

Yes it’s a SeedSigner bug. The issue is here: https://github.com/SeedSigner/seedsigner/issues/614

New release is here! • Revamped Home screen and a brand new ...

2024-10-24T15:33:20Z

New release is here!

• Revamped Home screen and a brand new Keys tab
• Improved onboarding for new users
• Option to create a Decoy wallet from existing wallets
• Initial support for testnet4
• Bug fixes and improvements

https://apps.apple.com/us/app/nunchuk-bitcoin-wallet/id1563190073
https://play.google.com/store/apps/details?id=io.nunchuk.android&hl=en
https://github.com/nunchuk-io/nunchuk-desktop/releases

💯

2024-10-18T16:07:49Z

In reply to nevent1q…ea2a
_________________________

💯

GM. A reminder that Decoy Wallets are now fully functional in the ...

2024-10-12T15:30:59Z

GM. A reminder that Decoy Wallets are now fully functional in the latest version of Nunchuk mobile app.

https://nunchuk.io/blog/decoy-wallet

Thank you for the support!

2024-10-12T10:07:30Z

In reply to nevent1q…r23x
_________________________

Thank you for the support!

Sorry to hear that happened to you. Agreed absolutely.

2024-10-11T18:13:31Z

In reply to nevent1q…qnjm
_________________________

Sorry to hear that happened to you. Agreed absolutely.

KYC creates huge honeypots that have endangered, and will ...

2024-10-11T12:29:47Z

KYC creates huge honeypots that have endangered, and will continue to endanger users.

This is why Nunchuk is non-KYC.

Learn about our Seamless Key Replacement protocol for multisig ...

2024-10-09T12:47:00Z

Learn about our Seamless Key Replacement protocol for multisig wallets:

https://nunchuk.io/blog/key-replacement

Collaborative custody is a great solution for those who are not ...

2024-10-07T01:32:33Z

In reply to nevent1q…d0y6
_________________________

Collaborative custody is a great solution for those who are not super technical or don't follow Bitcoin projects closely, or those who want a Bitcoin inheritance plan for peace of mind.

We provide similar collaborative custody solutions to Unchained, but without KYC, with more hardware support and advanced features such as coin control. If you're interested or have any questions, let us know!

(Website: https://nunchuk.io/individuals)

You can fall back to signing via files with Coldcard, if the ...

2024-10-05T01:07:01Z

In reply to nevent1q…z399
_________________________

You can fall back to signing via files with Coldcard, if the transaction is too big.

Introducing Decoy Wallet: Enhance your #Bitcoin security with ...

2024-10-04T02:08:24Z

Introducing Decoy Wallet: Enhance your #Bitcoin security with plausible deniability. 🔐

Learn how it works on our blog: https://nunchuk.io/blog/decoy-wallet

Introducing Decoy Wallet: Enhance your #Bitcoin security with ...

2024-10-03T13:28:47Z

Introducing Decoy Wallet: Enhance your #Bitcoin security with plausible deniability. 🔐

Learn how it works on our blog:

Sneak peek 🤓 Coming soon to a place near you. ...

2024-09-25T13:26:10Z

Sneak peek 🤓 Coming soon to a place near you.

Thank you Nick !

2024-09-22T02:08:03Z

In reply to nevent1q…7ttv
_________________________

Thank you Nick !

Any update here @npub17ty…3mgl @npub1rfd…7wrt ? To clarify, ...

2024-09-21T01:27:09Z

In reply to nevent1q…w5l8
_________________________

Any update here SeedSigner (npub17ty…3mgl) newtonick (npub1rfd…7wrt) ?

To clarify, Nunchuk still supports static QR for XPUB. It just needs to follow BC-UR standard.

Did you mean to tag @npub1rfd…7wrt ?

2024-09-19T06:25:22Z

In reply to nevent1q…u8mg
_________________________

Did you mean to tag newtonick (npub1rfd…7wrt) ?

So this seems to be plaintext, not BC-UR format. The animated QR ...

2024-09-19T04:54:22Z

In reply to nevent1q…f98k
_________________________

So this seems to be plaintext, not BC-UR format. The animated QR still follows BC-UR format, that’s why it still works.

Did something change on SeedSigner side?

Interesting. Might be a regression bug. Do you have a sample ...

2024-09-19T01:12:14Z

In reply to nevent1q…pttf
_________________________

Interesting. Might be a regression bug. Do you have a sample (singlesig) static QR for an XPUB? We can take a look and debug it.

No problem Mike!

2024-09-18T15:15:07Z

In reply to nevent1q…h9lg
_________________________

No problem Mike!

🚀 Big news!! We're excited to share that Nunchuk for ...

2024-09-18T15:04:36Z

🚀 Big news!!

We're excited to share that Nunchuk for Android now supports reproducible builds.

Read more on our blog: https://nunchuk.io/blog/reproducible-builds

You don't, you can use the wallet as Guest. No account ...

2024-09-18T15:04:05Z

In reply to nevent1q…tg6p
_________________________

You don't, you can use the wallet as Guest. No account needed.

Great summary! We also want to add that a decoy wallet and ...

2024-09-11T05:11:32Z

In reply to nevent1q…lj9y
_________________________

Great summary!

We also want to add that a decoy wallet and geographically distributed multisig are not mutually exclusive - one can have both 😃

🙏

2024-09-08T01:41:44Z

In reply to nevent1q…xmfj
_________________________

🙏

The instructions aren’t fully complete yet. We’ll announce it ...

2024-09-01T07:19:42Z

In reply to nevent1q…ydk2
_________________________

The instructions aren’t fully complete yet. We’ll announce it when it’s ready.

The fix is fairly simple: expose the seed export option within ...

2024-08-19T04:13:22Z

In reply to nevent1q…6kz6
_________________________

The fix is fairly simple: expose the seed export option within the Key Info of the hot key, even if the hot wallet has been deleted (and user hasn’t viewed the seed yet).

*Correction: delete the hot wallet

2024-08-19T04:10:03Z

In reply to nevent1q…6kz6
_________________________

*Correction: delete the hot wallet

Correct. There’s nothing Nunchuk does uniquely regarding ...

2024-08-19T04:09:00Z

In reply to nevent1q…udwn
_________________________

Correct. There’s nothing Nunchuk does uniquely regarding backups. You can use Nunchuk with other hardware signing devices (for which seed generation/backup should be handled separately on the hardware), or you can use a Software key, which Nunchuk generates and gives you the seed phrase for.

The scenario the OP mentioned specifically has to do with an edge case where user created a hot wallet (with a hot key that you can back up later), then CHANGED THEIR MIND and delete the hot key AND REUSE THE SAME HOT KEY (that user hasn’t backed up) in a multisig wallet. This might warrant a fix, but not how the majority of people use Nunchuk.

Nostr event nevent1qqsvm927a2ya9t7c5urn5xgpemj4cc0g85xs0nkmt4ahhzwwltmpv2czyrpsrufnwty0pkdusxrdsa86ghar8tk7z0nx7sv85w7j9mjpe9dj59g2fpl

2024-08-19T04:04:36Z

In reply to nevent1q…ff7h
_________________________

https://primal.net/e/note1tezxn782zztngfw86lnn2spac6x88tr6y9aqf9vg8zp2j7zx3dkqvry3k6

Just to be clear, this is an edge case scenario (that might ...

2024-08-19T04:03:16Z

In reply to nevent1q…4vsf
_________________________

Just to be clear, this is an edge case scenario (that might warrant a fix), but not how the majority of people use Nunchuk. When you create the key or hot wallet, best practice is to back up the key at the earliest.

This scenario you ran into is specifically about deleting the hot wallet (without having backed up the key) AND reuse the same key in a multisig.

We currently disable exporting the seed phrase more than once, for security reasons. After all, if one can view/export the seed phrase multiple times, it becomes a vulnerability, if someone gets a hold of your phone even for just 15 seconds.

💪

2024-08-08T00:58:08Z

In reply to nevent1q…ut9f
_________________________

💪

We just tested it again on the latest Nunchuk version and were ...

2024-08-08T00:54:03Z

In reply to nevent1q…7qsa
_________________________

We just tested it again on the latest Nunchuk version and were able to sign. Could not reproduce the issue. Are you using the Android or iOS app? And which app version?

Note that BBQr is a relatively new standard, so issues might be expected.

Thank you! Have you tried setting up a multisig wallet on ...

2024-08-08T00:04:48Z

In reply to nevent1q…4rmh
_________________________

Thank you! Have you tried setting up a multisig wallet on Nunchuk? Would love to hear your feedback / any pain points you run into.

Tip: you can have the Tapsigner as one of the keys in the multisig.

We have published our analysis on the “Dark Skippy” ...

2024-08-08T00:00:19Z

We have published our analysis on the “Dark Skippy” vulnerability and mitigation recommendation in our blog.

Read or share it here:

https://nunchuk.io/blog/dark-skippy

💯. We’re working to change that. Slowly but surely.

2024-08-07T16:43:23Z

In reply to nevent1q…8srp
_________________________

💯. We’re working to change that. Slowly but surely.

Great research and security disclosure by @npub1j8d…26k2 ...

2024-08-07T02:29:57Z

Great research and security disclosure by nick (npub1j8d…26k2) Zero-Knowledge Goof (npub1xh8…gst6) and Robin Linus. Here's what you need to know about the "Dark Skippy" vulnerability:

1. Hardware signing devices insert random values called 'nonces' every time they sign Bitcoin transactions.
2. Weak nonces (values that are not sufficiently random) can allow an attacker to mathematically brute-force the private key from the signatures alone, just by analyzing transactions on the public blockchain.

This is a well-known class of attack. "Dark Skippy" is a new technique which makes it easier to grind the private key from weak nonces.

What are the conditions required for the attack? The attack requires either:
1. Loading malicious firmware onto the device, which generates weak nonces.
2. A bug in the vendor's official firmware that produces weak nonces.

How do I protect myself from this type of attack?
1. Order hardware signing devices straight from the vendors, if possible. The more direct, the lower the likelihood of tampering.
2. Use hardware vendors that have tamper-resistant mechanisms in place, such as tamper-evident sealed bags, firmware attestation, etc.
3. Use hardware where you can easily verify the integrity of the source firmware and its updates.
4. Use hardware that follows security standards in generating nonces. One such standard is RFC6979 (deterministic nonces).
5. Verify the authenticity of the firmware every time you upgrade. (Tip: bookmark the vendor website to avoid phishing).
6. Avoid updating firmware unless you absolutely have to. Use another device if you want to experiment with firmware features that you don't actually need for your main stash.
7. Use multisig, preferably multi-vendor multisig. This alone significantly increases the difficulty of executing the attack.

Multisig versus Anti-exfil
You might have heard that "anti-exfil" is a way to prevent the above attack. In short, anti-exfil describes a security technique which combines entropy from the hardware signing device with entropy from a SECOND DEVICE (typically the host of the companion software wallet) to generate the nonces.

However, there are 2 downsides to this approach. First, there is currently no anti-exfil standard, so you'd have to trust that the vendors implement anti-exfil correctly. Secondly, since anti-exfil changes the way a signature is generated, i.e., asking for entropy from a second device for every single transaction, it is not compatible with the way most Bitcoin wallets work today, and therefore introduces a UI/UX challenge.

Until anti-exfil has a well-defined standard and wider wallet compatibility, we recommend multisig as the more practical approach. Fundamentally, multisig achieves the same goal as anti-exfil: it also requires entropy from a second device to authorize each Bitcoin transaction. Multisig can also add entropy from more than just 2 devices, if you so choose (3-of-5 multisig, for example). Last but not least, multisig has been used for 10+ years in Bitcoin, battle-tested (securing hundreds of billions worth of Bitcoin), and at this point has been very well standardized (PSBT, BSMS, Output Descriptors, to name a few standards).

Hence, use multisig if you are concerned about Dark Skippy.

In conclusion, while the "Dark Skippy" vulnerability highlights potential risks in hardware signing devices, users can significantly mitigate these risks by following best practices in device procurement and usage, and by implementing multisig setups. Stay informed, verify your devices and firmware, and consider multisig for enhanced security of your Bitcoin holdings.

P.S. A common question is: “Does adding a passphrase to my seed phrase protect me against Dark Skippy and similar types of attacks?” The answer is no. Since nonce-based key grinding works against the master private key, not the seed phrase, adding a passphrase will NOT protect you against this class of attack.

quoting
nevent1q…323c
Today we disclose Dark Skippy - a powerful new method for a malicious signing device to leak secret keys.

With a modified signing function, a device can efficiently and covertly exfiltrate a master secret seed by embedding it within transaction signatures

If an attacker manages to corrupt a signing device, Dark Skippy can deliberately use weak & low entropy secret nonces to embed chunks of the seed words into transaction signatures.

It takes just two input signatures to leak a 12 word seedphrase onto the Bitcoin blockchain.

The attacker can watch on-chain until they spot an affected transaction, unblind and invert the low entropy nonces using an algorithm like Pollard's Kangaroo algorithm to learn the master secret seed.

Then the attacker can wait and steal the funds whenever they decide best.

Despite this attack vector not being new, we believe that Dark Skippy is now the best-in-class attack for malicious signing devices.

- The attack is impractical to detect
- Requires no additional communication channels
- Effective on stateless devices
- Exfils master secret

Beyond ensuring your device firmware is genuine and honest (opensource), mitigations include anti-exfil signing protocols and we present some new ideas for additions to PSBT specifications to disrupt this attack.

We encourage mitigation discussion and implementation exploration.

This attack highlights the importance of verifying and securing your device's firmware, and the danger of sharing stateless signing devices with other people.

We will be publicly releasing our code later this year.

Authors: Zero-Knowledge Goof (npub1xh8…gst6) (follow him so he gets onto nostr), Robin Linus, and myself.

If you have any concerns or questions we recommend checking out the FAQ page on our website:
https://darkskippy.com

👋🏻

2024-08-06T09:21:23Z

In reply to nevent1q…qxpr
_________________________

👋🏻

Great research and security disclosure by @npub1j8d…26k2 ...

2024-08-06T08:29:41Z

Great research and security disclosure by nick (npub1j8d…26k2) Zero-Knowledge Goof (npub1xh8…gst6) and Robin Linus. Here's what you need to know about the "Dark Skippy" vulnerability:

1. Hardware signing devices insert random values called 'nonces' every time they sign Bitcoin transactions.
2. Weak nonces (values that are not sufficiently random) can allow an attacker to mathematically brute-force the private key from the signatures alone, just by analyzing transactions on the public blockchain.

This is a well-known class of attack. "Dark Skippy" is a new technique which makes it easier to grind the private key from weak nonces.

What are the conditions required for the attack? The attack requires either:
1. Loading malicious firmware onto the device, which generates weak nonces.
2. A bug in the vendor's official firmware that produces weak nonces.

How do I protect myself from this type of attack?
1. Order hardware signing devices straight from the vendors, if possible. The more direct, the lower the likelihood of tampering.
2. Use hardware vendors that have tamper-resistant mechanisms in place, such as tamper-evident sealed bags, firmware attestation, etc.
3. Use hardware where you can easily verify the integrity of the source firmware and its updates.
4. Use hardware that follows security standards in generating nonces. One such standard is RFC6979 (deterministic nonces).
5. Verify the authenticity of the firmware every time you upgrade. (Tip: bookmark the vendor website to avoid phishing).
6. Avoid updating firmware unless you absolutely have to. Use another device if you want to experiment with firmware features that you don't actually need for your main stash.
7. Use multisig, preferably multi-vendor multisig. This alone significantly increases the difficulty of executing the attack.

Multisig versus Anti-exfil
You might have heard that "anti-exfil" is a way to prevent the above attack. In short, anti-exfil describes a security technique which combines entropy from the hardware signing device with entropy from a SECOND DEVICE (typically the host of the companion software wallet) to generate the nonces.

However, there are 2 downsides to this approach. First, there is currently no anti-exfil standard, so you'd have to trust that the vendors implement anti-exfil correctly. Secondly, since anti-exfil changes the way a signature is generated, i.e., asking for a nonce from a second device for every single transaction, it is not compatible with the way most Bitcoin wallets work today, and therefore introduces a UI/UX challenge.

Until anti-exfil has a well-defined standard and wider wallet compatibility, we recommend multisig as the more practical approach. Fundamentally, multisig achieves the same goal as anti-exfil: it also requires entropy from a second device to authorize each Bitcoin transaction. Multisig can also add entropy from more than just 2 devices, if you so choose (3-of-5 multisig, for example). Last but not least, multisig has been used for 10+ years in Bitcoin, battle-tested (securing hundreds of billions worth of Bitcoin), and at this point has been very well standardized (PSBT, BSMS, Output Descriptors, to name a few standards).

Hence, use multisig if you are concerned about Dark Skippy.

In conclusion, while the "Dark Skippy" vulnerability highlights potential risks in hardware signing devices, users can significantly mitigate these risks by following best practices in device procurement and usage, and by implementing multisig setups. Stay informed, verify your devices and firmware, and consider multisig for enhanced security of your Bitcoin holdings.

P.S. A common question is: “Does adding a passphrase to my seed phrase protect me against Dark Skippy and similar types of attacks?” The answer is no. Since nonce-based key grinding works against the master private key, not the seed phrase, adding a passphrase will NOT protect you against this class of attack.

quoting
note1ra4…k7md
Today we disclose Dark Skippy - a powerful new method for a malicious signing device to leak secret keys.

With a modified signing function, a device can efficiently and covertly exfiltrate a master secret seed by embedding it within transaction signatures

If an attacker manages to corrupt a signing device, Dark Skippy can deliberately use weak & low entropy secret nonces to embed chunks of the seed words into transaction signatures.

It takes just two input signatures to leak a 12 word seedphrase onto the Bitcoin blockchain.

The attacker can watch on-chain until they spot an affected transaction, unblind and invert the low entropy nonces using an algorithm like Pollard's Kangaroo algorithm to learn the master secret seed.

Then the attacker can wait and steal the funds whenever they decide best.

Despite this attack vector not being new, we believe that Dark Skippy is now the best-in-class attack for malicious signing devices.

- The attack is impractical to detect
- Requires no additional communication channels
- Effective on stateless devices
- Exfils master secret

Beyond ensuring your device firmware is genuine and honest (opensource), mitigations include anti-exfil signing protocols and we present some new ideas for additions to PSBT specifications to disrupt this attack.

We encourage mitigation discussion and implementation exploration.

This attack highlights the importance of verifying and securing your device's firmware, and the danger of sharing stateless signing devices with other people.

We will be publicly releasing our code later this year.

Authors: Zero-Knowledge Goof (npub1xh8…gst6) (follow him so he gets onto nostr), Robin Linus, and myself.

If you have any concerns or questions we recommend checking out the FAQ page on our website:
https://darkskippy.com

Nostr amplifies builders X amplifies haters and grifters (and ...

2024-07-29T04:15:15Z

Nostr amplifies builders
X amplifies haters and grifters (and some builders)

quoting
note16uc…w4up
Holy shit, I think I just realized a direct and concrete way that I’ve personally experienced to how #Nostr completely changes the social incentives:

• Rage and hateful posts on Twitter get the most attention.
• Positive and happy posts on Nostr get the most zaps.

It really was just monetization all the time.

When attention is the currency, negativity and hate rise to the top because the platforms need people arguing.

When sats directly from peers are the currency, value rises to the top.

(Anyone else feel they’ve had this same experience?)

Thank you!

2024-07-28T05:16:36Z

In reply to nevent1q…xt4g
_________________________

Thank you!

Blue Eye Samurai is dope!

2024-07-28T03:00:21Z

In reply to nevent1q…arn9
_________________________

Blue Eye Samurai is dope!

👀 #note1x6g…sz69

2024-07-27T18:27:02Z

👀

quoting
note1x6g…sz69
npub1cvqlzvmjercdn0ypsmv8f7j9lge6ahsnueh5rparh53wuswftv4q49yjt3 (npub1cvq…yjt3)

Finally set up Nunchuk multisig on my phone. 2 of 3 using hot key and 2 tap signers.
Very slick. Perfect for having smaller amounts of corn on your phone.

Awesome job team

Never be without corn on the go again.

💪🧡💜

💪🏻🙌🏻

2024-07-27T18:26:44Z

In reply to nevent1q…xarh
_________________________

💪🏻🙌🏻

Contrary to popular belief, we deeply believe that the future of ...

2024-07-27T13:58:32Z

Contrary to popular belief, we deeply believe that the future of Bitcoin self-custody will be on mobile. The modern phone is a lot more secure and more accessible than desktop, and going forward it will be the preferred computing platform for billions of people around the world.

With that in mind, we are excited to share that Nunchuk has entered a partnership with TwentyTwo, headed by Alekos who built BDK, to bring more self-custody solutions to mobile devices!

Read more about our partnership here: https://nunchuk.io/blog/nunchuk-twentytwo

thank you!

2024-07-26T01:03:33Z

In reply to nevent1q…ex9u
_________________________

thank you!

Yes! Both Sparrow and Nunchuk support BIP329 (common Bitcoin ...

2024-07-25T15:29:29Z

In reply to nevent1q…uuuk
_________________________

Yes! Both Sparrow and Nunchuk support BIP329 (common Bitcoin standard for labels).

Introducing Automated Wallet Rollover with Advanced Coin Control ...

2024-07-25T14:53:17Z

Introducing Automated Wallet Rollover with Advanced Coin Control

We are excited to introduce a significant update to Nunchuk: the new Wallet Rollover feature. This powerful tool provides a comprehensive solution for migrating from an old wallet to a new wallet while maintaining your preferred coin management strategy.

A Leap Forward in Wallet Management
Until now, migrating from an old wallet to a new wallet has been a largely manual process, requiring users to carefully manage transactions and coin control themselves. Nunchuk’s Wallet Rollover feature automates much of this process, dramatically reducing the potential for errors and saving time. Moreover, our advanced coin control management is unparalleled in the Bitcoin wallet space, offering a level of granularity and privacy preservation techniques previously unavailable to users.

Independent Rollover Feature
The Wallet Rollover feature operates independently and can be utilized in various scenarios that require fund transfers between wallets, including key replacement processes.

Key Capabilities:
1. Transfer between any wallet types (single-sig to multi-sig, vice versa, or between different multi-sig configurations).
2. Preserve coin segregation strategy during transfers.
3. Enhance privacy further through randomized broadcast of the rollover transactions.
Nunchuk is the first Bitcoin wallet to offer this level of automation and granular control in wallet transitions.

Advanced Coin Control During Rollover
This feature enables users to preserve their coin segregation strategy when migrating to a new wallet. Whether you segregate your coins for privacy, accounting, or any other purpose, you can now maintain this organization during a wallet transition.
Key Benefits Include:
* Preservation of existing tags and collections, maintaining the separation of coins based on origin, purpose, or other criteria.
* Enhanced privacy by preserving your original coin management strategy.

Important Details:
* To maintain your coin segregation strategy, the rollover feature may create multiple transactions.
* For enhanced privacy, we recommend broadcasting these transactions at random intervals rather than all at once. This practice obscures the connection between the newly created coins and the old and new wallets.
* Subscribers benefit from an automatic randomized broadcasting feature, further enhancing transaction privacy.

Why This Matters
1. Seamless Key Replacement: In case of a lost or compromised key, you can quickly transition to a new wallet setup while maintaining your preferred coin organization, minimizing disruption and stress.
2. Evolving Security Needs: As your Bitcoin holdings grow or your security requirements change, you can easily transition between different wallet types (e.g., from single-sig to multi-sig) without the hassle of manual transfers.
3. Privacy Enhancement: By preserving your coin segregation strategy and using randomized broadcasting, you can significantly improve onchain privacy during wallet transitions.
4. Flexibility for Various Use Cases: Whether you’re setting up an inheritance plan, adjusting business wallet structures, or simply reorganizing your funds, this feature adapts to your specific needs.
5. User Control: You retain full control over your bitcoin throughout the entire process, adhering to the principles of self-custody while benefiting from advanced automation.

It’s important to note that while preserving coin segregation strategy offers privacy benefits, it may result in multiple transactions, potentially increasing on-chain fees. Users can weigh this trade-off based on their specific privacy needs and cost considerations.

How to Use Wallet Rollover
To initiate a wallet rollover, navigate to: The wallet you want to migrate from > View wallet config > More menu > Roll funds over to another wallet.

Looking Ahead
At Nunchuk, we are committed to pushing the boundaries of Bitcoin self-custody. This update represents a significant leap forward in wallet management flexibility and user control. We’re excited to see how our users leverage these new capabilities to enhance their Bitcoin security and wallet management strategies.

Stay tuned for more innovations as we continue to evolve the Nunchuk ecosystem. Your financial sovereignty is our top priority, and we’re dedicated to providing you with the tools you need to maintain complete control over your bitcoin.

Advancing Bitcoin Security: Seamless Key Replacement for Multisig ...

2024-07-02T14:07:59Z

Advancing Bitcoin Security: Seamless Key Replacement for Multisig Wallets

Read our blog post here:
https://nunchuk.io/blog/key-replacement

And for our valued subscribers: 🔐 Set up health check ...

2024-06-25T15:35:18Z

In reply to nevent1q…298d
_________________________

And for our valued subscribers:
🔐 Set up health check reminders for your keys
📊 View health check history for your keys

These features ensure you're always on top of your wallet security!

✅ Generate and save transactions as PDF invoices ...

2024-06-25T15:33:33Z

In reply to nevent1q…298d
_________________________

✅ Generate and save transactions as PDF invoices

In addition to Seamless Key Replacement, the new app release ...

2024-06-25T15:32:20Z

In reply to nevent1q…298d
_________________________

In addition to Seamless Key Replacement, the new app release brings several other powerful features:

✅ New shortcuts for sending to existing Nunchuk wallets or frequently used addresses