⚠️ This series was written long before COLDCARD's catastrophic seed generation bug was exploited in 2026. It uses a COLDCARD as one of the three signers. Do not use COLDCARD, here or anywhere else. A firmware bug that went unnoticed from 2021 until July 2026 made seeds generated on COLDCARD devices weak enough to guess, and attackers used it to steal more than 1,800 BTC (Coinkite's advisory, more detail). Use Passport Prime in its place, and where this series shows COLDCARD steps, follow the Passport Prime documentation instead.

If one of your multisig signers was created on a COLDCARD, treat that key as compromised. Your funds are then only as safe as your other keys, so set up a new multisig with a replacement signer and move your funds to it.

Disclosure: I work at Foundation, the company that makes Passport Prime.

Intro

You will have already noticed that Specter shows you your first receive address, we now want to verify that receive address on our trusted, air gapped signing devices. Not all signing devices facilitate this, which is the reason both Coldcard and Cobo were included into this guide.

  1. Specter
  2. Coldcard
  3. Cobo Vault

Specter

This one is easy, open your multisig wallet in Specter and press receive.


Coldcard

Power on your Coldcard and enter your PIN. Press Address Explorer. scroll to the bottom and enter the number indicated to start. Scroll to the bottom of the next page and choose your recently imported multisig wallet.

You will now have the option to save these to the SD card which could be useful if you plan on receiving often and wont have easy access to your devices. Scroll down, you will see the fingerprint of each signer, after that you should see a partially hidden version of your first receive address. Check it matches the one shown by Specter.


Cobo Vault

Open the menu and press Multisig Wallet which will open the receive tab. Press the top address and check it matches the one shown in Specter.


All 3 match? Send a very small amount of sats to your verified address.

You may want to verify a number of receive addresses at once to prevent the need access your signers every time you want to receive.

As an optional extra step to be able to receive on the go, you may want to export your multisig wallet to Blue Wallet on your phone.

Received some sats to your verified address? Let’s go through the spend process.