Happy Sunday, Reader,
Wow... this email has taken me all day to put together.
I wanted to share how the Coldcard situation has been unfolding, tie it into the deeper spiritual dilemma of self-custody, and still follow through on what I promised you last week, all while remaining compassionate, helpful, and sensitive to those who may have been affected or who recommended Coldcard to someone else.
We are all human, and part of the human experience is learning as we go. I also believe part of the Bitcoin journey is learning some of the deepest and most profound lessons life has to offer.
And that's exactly why I write to you on Sundays.
As you likely know, over the past few days, the Bitcoin community has been grappling with one of the largest hardware wallet security incidents we have seen.
A software bug introduced into Coldcard firmware in 2021 affected the randomness used to generate some seed phrases. The first wallets being drained appeared to be older Mk3 setups that relied entirely on the device-generated seed, without additional protection such as a strong BIP39 passphrase or significant user-generated entropy from dice rolls.
As reports continued to come in, many Bitcoiners chose to move their funds off any Coldcard that had generated its seed on the device, out of an abundance of caution, especially if they had relied solely on the device's internal random number generator. At the time of writing, more than 4,312 Bitcoin addresses have reportedly been drained.
Wondering if anyone has been caught or held responsible?
Block engineer Clay Garrett said their team identified an unusual pattern in the sweeps and confirmed that the attacker had used a paid account with a major blockchain-services provider, whose internal logs matched the timing and sequence of the activity and were then shared with authorities.
So, here's hoping the main hacker is that dumb and KYC'd himself!
Not saying it will mean that everyone gets their Bitcoin back or dismissing the fact that other black hats have joined in once the vulnerability was exposed, but a little justice would be good for the soul!
***A quick and important note: If you own a Coldcard and this is the first you are hearing about this, please stop reading and determine whether your setup may be affected.
Find someone you trust who understands Bitcoin security and can help you assess your specific setup. Do not enter your seed phrase into any website, app, online computer, message, or tool because someone offers to help. If your setup is affected, move your funds to a newly generated secure wallet as soon as you can do so safely.
You can come back and finish this email afterward.
Yes, the technical details matter.
There are lessons to be learned, firmware to verify, and security practices to improve.
I have learned so much over the last few days...
But what I have found myself thinking the most about is not only the technical security of Bitcoin...
But what it revealed about us.
One person wrote:
“I don’t even use Coldcard. Yet somehow they still took a little of my peace of mind.”
Another replied:
“Even people who weren’t affected will spend the next few days wondering if they missed something.”
Others shared that they were checking wallets that were not even involved. Some questioned their own setups. Some became so overwhelmed they froze or they could not even type their own seed phrase because of the stress.
What I saw was more than fear about a particular device. It was uncertainty spreading through people’s entire relationship with self-custody.
Some began questioning their setups. Others questioned whether they were capable of doing this at all. Even people who did not use Coldcard found themselves checking wallets and exchanges, wondering what else they might have missed.
In moments like this, the instinct is often to look for an external authority to relieve the burden of responsibility and tell us what is safe. That response is understandable. But it is also exactly when we need to be careful not to make permanent decisions from a temporary state of fear.
This is not the time to abandon self-custody simply because uncertainty has entered the room. It is the time to slow down, regulate the nervous system, gather reliable information, ask better questions, and make decisions from coherence rather than panic.
Because self-custody is not only a technical practice. It is also psychological, philosophical, and spiritual. Security events reveal weaknesses in software, but they also reveal our relationship with uncertainty, authority, responsibility, trust, and our own capacity to remain grounded when confidence is shaken.
This event has also revealed our relationships with one another.
And one of the most powerful parts of the past few days has been watching the Bitcoin community come together.
Warnings & support spread quickly through our local, national, and international Telegram groups. People shared what they knew, helped others determine whether they might be affected, and supported one another through the uncertainty process of getting their coins to safety.
Wicked, GenX, and many others hosted X Spaces day and night (and are still going!) Across Bitcoin X, people helped others move their stacks, verify information, make decisions, process what they were feeling, grieve what had been lost, and navigate this unfolding crisis together in real time.
It was hell for many.
But it was also a reminder that self-custody does not mean facing everything alone.
Especially in Bitcoin. The social layer is a massive part of what makes Bitcoin so amazing.
The more I listened, watches, and reflected, the more I found myself asking a different question...
What if the greatest challenge of self-custody is not technical?
What if it is spiritual?
Spiritual in the sense that it brings us face to face with some of life’s deepest questions.
- How much responsibility am I willing to carry?
- How much uncertainty can I tolerate?
- Can I remain grounded when my sense of certainty is shaken?
- What am I really trusting?
- What am I willing to risk for something I believe is right?
- Who do I want to become through the pursuit of sovereignty?
Bitcoin gives us the opportunity to become our own bank.
But becoming your own bank is not simply a technical exercise.
It is an invitation to carry a level of responsibility that, for most of human history, we have delegated to someone else.
Freedom and responsibility arrive together.
After having my ColdcardQ for over a year - a few weeks ago, I finally sat down to set it up. I wanted to do it, but once I started, it seemed complicated and something about it felt uncertain, so I stopped and decided to wait until I could get help from someone I trusted.
I also learned that two other women from our Calgary Women’s Bitcoin Meetup had done almost the same thing.
Was that intuition? Divine timing? Simple caution? I cannot know for certain.
But it reminded me that one of the spiritual dilemmas of self-custody is not only learning to trust yourself.
It is learning to discern which part of yourself you are trusting.
Was it grounded intuition?
Fear?
Hesitation?
Wisdom?
Impulse?
That kind of discernment does not happen automatically. It comes from cultivating a relationship with yourself. It comes from slowing down enough to recognize the difference between a reactive mind and a coherent one, between fear and genuine inner knowing.
It is one of the reasons I have devoted my life’s work to helping people cultivate coherence and learn to truly tune into their innate intelligence.
Whether through hypnosis, somatic practices, journalling, or contemplative work, the aim has never been to help people avoid uncertainty. It is to help them meet uncertainty with greater clarity, discernment, and trust in themselves.
Self-custody asks us to secure our Bitcoin.
Inner work asks us to cultivate the state of mind from which we make those decisions.
Because perhaps the deepest form of self-custody is not only holding your own keys.
It is learning to hold your own mind with enough awareness that you can respond from wisdom instead of reaction.
Over the past few days, I have come to believe that the greatest attack surface is not only our hardware.
It is our peace of mind.
And maybe that is one of Bitcoin’s greatest invitations.
Not only to become sovereign over our money.
But to become sovereign over ourselves.
One more thing...
Last week, I promised I would be opening something new called Experience the Work.
After everything that happened over the past few days, I thought about pressing pause.
But then I realized this work may be needed now more than ever.
After something like this, there is so much to process: fear, regret, self-doubt, responsibility, trust, and how quickly our peace of mind can disappear. The work is finding our way back to clarity, coherence, and ourselves.
A lot of you originally found me through Bitcoin, but Bitcoin is really only one doorway into the work I have been doing for the past 15+ years.
Hypnosis. Coaching. Evolutionary Astrology. Relationships. Business. Purpose. Health. The Sacred In-Between.
And ultimately, helping people see what is underneath whatever is not working, reconnect with their own wisdom, and bring the life, love, career, and future they know is possible out of their minds and into their reality.
Over the next several weeks, I’ll take you behind the scenes of how I think, how I work with clients and groups, and the methods that inform that work. Along the way, I’ll share reflections, practical ways to engage with the ideas yourself, and several opportunities to experience the work more directly.
We will explore things like:
- The Sacred In-Between
- Evolutionary Astrology, your North Node, and your Life's Purpose
- Breaking patterns that keep repeating
- Creating the life, love, business, and future you know is possible
- A few other surprises along the way
If today’s email resonated with you, not only because of Bitcoin but because of what it stirred within you, you can join me here by simply clicking and you will be tagged. :)
Join Experience the Work
This will be a separate email series, so The Sunday Bitcoiner will remain focused on Bitcoin.
And if you decide it is not for you, you can unsubscribe from that series at any time while continuing to receive The Sunday Bitcoiner each week.
Thank you for being here and growing alongside me. 🧡🙏🏼
Everyone will leave this experience with different lessons.
This one is mine.
I don't think the greatest lesson from this week is about Coldcard.
I think it's about sovereignty.
Not only the sovereignty of our money, but the sovereignty of our minds.
Because when certainty disappears, we discover what we've really been relying on.
And perhaps that's the deepest spiritual dilemma of self-custody.
Not whether we can hold our own keys.
But whether we can remain grounded enough to hold ourselves - with awareness, courage, humility, and coherence - when life inevitably reminds us that certainty was never the promise.
Maybe that's what Bitcoin has been inviting us to practice all along.
Yes, freedom.
And yes, to freedom of the mind.
Until next Sunday,
Happy stacking! ⚡️
~Heather Keys
X: @UnHypnotizedBTC
P.S. If you found this on Club Orange or X and want The Sunday Bitcoiner to come straight to your inbox, you can sign up here. Use that link to share with other souls who may enjoy :)