NUNCHUK ANSWERS ON THE RECORD — PLATFORM-KEY EXPOSURE DISCLOSED. CUSTOM-DERIVATION LOGIC SURFACED.

Nunchuk, the multisig service, went on the record about its own exposure to the ColdCard vulnerability. The statement is precise: yes, some of the platform keys used inside Nunchuk’s Honey Badger and inheritance products were generated on ColdCard Mk4 hardware. No, those raw keys are not what the platform actually signs with — they run through a custom independent-derivation layer that keeps the exposed seeds out of the immediate lookup-table blast radius. And no, the derivation layer is not a permanent shield: with enough time, attackers can incorporate the derived keys into their attack space too.

The refined multisig guidance from Nunchuk follows the same logic as the Wizard Sardine post-mortem — one compromised key in a multisig quorum still can’t move funds alone, but a quorum built entirely of affected ColdCard seeds loses the safety margin the multi-key structure is supposed to provide. The whole point of a multisig setup is that no single hardware failure collapses the position. If every seed in the quorum shares the same generation flaw, the multi-key math no longer applies.

The Maximalist read: this is what operational honesty looks like from a sovereignty-class service. Nunchuk didn’t wait for the criticism to peak — and the criticism did come, from within the maximalist community, arguing they should have disclosed sooner. Fair. But the response has been clear-eyed rather than defensive: the platform-key exposure is on the record, the mitigation is documented, the honest limit on that mitigation is stated in the same breath. Sovereignty tooling is only credible when the service running it can name its own failure modes out loud. That’s the transparency the operator class is entitled to. It’s the transparency the operator class should hold every sovereignty vendor to.