When we get a fact wrong, we fix it and record it here with the date, the page affected, and how we verified the correction. Spotted an error? Tell us. See also the changelog.
Casa was labelled "Self-Custody Multisig" while Unchained, which has a structurally equivalent arrangement, was labelled "Collaborative Multisig". Casa holds one key in its vaults: in the flagship 3-of-5 the member holds four keys and Casa holds a fifth recovery key, and because three signatures move funds Casa cannot transact alone and the member can transact without Casa. That is the same shape as Unchained's 2-of-3. Casa markets the service as self-custody, and that framing is defensible on the narrow point that Casa cannot move funds unilaterally, but it is the vendor's framing and we were applying it to one provider and not the other. Both now read Collaborative Multisig. No score changed; this is a classification fix rather than a reassessment.
Verified: Casa Help Center, Casa Recovery Key (support.casa.io/knowledge/casa-recovery-key); Casa docs, 3-Key Vault and 2-of-3 Basic Multisig
Our July 31 status page recorded an open disagreement about current models, quoting Coinkite's preliminary advisory that Mk4, Q and Mk5 were not affected alongside Block's contrary analysis. Coinkite updated its advisory on August 1 to state that seeds generated on Mk4, Q and Mk5 before the fixed releases are also affected, at about 72 bits of entropy against an intended 128. The disagreement on scope has resolved and our page has been rewritten. A reader who acted on our earlier page may have concluded that a Mk4, Q or Mk5 seed was safe. It is not. We also corrected the dice-roll guidance from 99 rolls to the 50 independent private rolls stated in the current advisory, and revised reported losses from about 594 BTC to the roughly 1,367 BTC across three waves identified by Galaxy Research.
Verified: Coinkite security advisory, updated 2026-08-01 14:35 EDT; Coinkite technical backgrounder; Block engineering analysis 2026-07-30; Galaxy Research via CoinDesk and Decrypt.
Earlier copy described Onramp's Multi-Institution Custody as distributed across BitGo, Coinbase, and Anchor Watch. The correct roster is Onramp, BitGo Trust, and CoinCover in a 2-of-3 arrangement. Onramp does not work with Anchor Watch, and Coinbase is not one of its custodians.
Verified: Verified against Onramp's published custody documentation.