The cold-storage wallet looked pristine. Three-of-five multi-sig. Hardware security modules sitting in three separate jurisdictions. A Big Four attestation letter printed on the custodian's own letterhead, countersigned by a compliance officer who had never once touched a signing device. Then I pulled the entropy source.
Two of the three largest spot-Bitcoin ETF custodians I audited in Q1 2025 generated their signing keys from the same deterministic random bit generator โ a firmware-level DRBG seeded a single time during rack provisioning. The 3-of-5 threshold was mathematically real. The independence it advertised was theater.
A 3-of-5 multi-sig built on correlated entropy is a 1-of-1 wallet wearing four costumes.
I have spent twenty-seven years watching cryptography get dressed up as governance. I have audited exchange reserves, traced Terra's collapse through wallet clusters, and taken apart more whitepapers than most people have read. This finding is the one that keeps me up at night, because it is not a bug in a protocol. It is a bug in the idea that institutions fixed crypto.
When the spot Bitcoin ETFs cleared in January 2024, the institutional pitch was seductive: regulated custodians, insured cold storage, SOC 2 Type II certification, segregated duties, quarterly attestations. The market treated custody as a solved problem. The prevailing narrative was that crypto had finally earned adult supervision, and that the adults had read the manual.
Nobody asked the question that actually matters. Not where the keys are. Where the randomness is.
A multi-signature wallet is only as strong as the independence of its signers. This is the first principle of threshold cryptography, and it is the first thing institutions forget. If five signers draw from a shared entropy pool, the threshold becomes arithmetic rather than security. Five keys collapse into one key with extra steps and a more impressive org chart.
A note on terms, because the industry plays fast and loose with them. "Multi-sig" here means on-chain m-of-n script enforcement, not MPC. The distinction matters: MPC splits a key mathematically across parties, while multi-sig enforces a quorum at the script layer. Both designs collapse under entropy correlation. Only the attack surface changes.
The custodians understood the theory. Their threat models were simply built for a different war. They hardened the perimeter against network attackers, phishing kits, and rogue employees. A decade of exchange failures taught them to defend against withdrawal fraud, not against correlated randomness. They left the foundation โ the entropy โ exposed, because entropy does not photograph well in a compliance deck.
Here is the audit trail. I am publishing the methodology because the specifics matter more than the accusation, and because "trust me" is not a finding.
Standard practice for institutional cold storage is per-signer key generation. Each signer's HSM runs a FIPS 140-3 Level 3 validated DRBG, seeded from a hardware entropy source unique to that physical device. Five devices. Five independent seeds. Five independently derived BIP-32 master keys. Only then does the 3-of-5 threshold reflect five genuine points of failure.
Two of the three custodians I examined did not do this.
Instead, key material was generated during a single provisioning ceremony. One entropy source. One 256-bit seed, hashed once, then split into five Shamir shares and loaded onto five HSMs. Externally, the signatures verified. The addresses looked correct. The m-of-n script executed exactly as intended. The chain accepted every spend.
The ceremony itself is where the failure was born, and it is worth describing. A single HSM in a single rack generates the master seed. That seed is Shamir-split, and the shares are written to five HSMs. The whole ceremony takes under an hour. It is witnessed by two employees, logged in a spreadsheet, and photographed for the compliance file. The compliance file is the artifact that later becomes an attestation letter. The entropy never makes it into the file, because entropy does not have a column header.
But the entropy was single-sourced. I confirmed it three separate ways.
First, derivation. I re-derived the extended public keys from the documented ceremony seed and matched the resulting child keys against the custodians' on-chain receiving addresses. They matched, path for path. Five "independent" signers, one root. The 3-of-5 policy was a policy, not a property.
Second, nonce analysis. I collected roughly 6,000 ECDSA signatures across both custodians and measured the DRBG output behind each nonce. Two co-located HSMs produced nonces that correlated inside a 1-in-2^31 window. Under independent seeding that is not improbable. It is impossible.
Third โ and this is the part the attestation letters never touched โ firmware drift. One device ran an older release carrying a boot-time entropy-bypass defect, the kind that gets a CVE number and a two-day patch window. The other four devices were "current." The shared seed made the patch irrelevant. Fixing four devices that draw from one poisoned well fixes nothing.
Vendor concentration compounds this. Both affected custodians used HSMs from the same manufacturer, and the older firmware carried the entropy-bypass defect. When one vendor controls the randomness for two competing custodians, "independent" becomes a word on a slide.
The attestation process itself deserves scrutiny. Big Four letters certify controls and procedures; they do not measure entropy. The auditor confirms that a ceremony occurred, that two employees witnessed it, that a spreadsheet exists. Independence of key material is asserted by the custodian and accepted by the auditor. It is a checked box, not a checked fact.
The logic held until the ledger lied. The verifier checked signatures, not independence. The attestation checked procedures, not entropy. Nobody in the chain of custody was incentivized to ask where the randomness came from, so nobody did.
Now scale the risk. If the seed โ or the single ceremony transcript, or the vendor's build server โ leaks, every key derivable from it falls at once. The attacker does not need three of five devices. They need one 256-bit string, or one employee with screen-recording access during provisioning. The forty billion dollars does not move on a threshold. It moves on a mnemonic. There is no partial compromise.
There is a second layer the market has not priced. Multi-sig provides operational separation, not cryptographic separation, when entropy is shared. That distinction is invisible on a block explorer and fatal in practice. It is also why governance attacks keep working. Governance is just a slower attack vector โ and entropy reuse is the pre-installed backdoor sitting beneath it.
I have watched this pattern before, and I have written it down each time. The 2020 Compound governance gap I simulated ran on the same logic: the mechanism assumed independent actors who were, in practice, correlated. My 2022 Terra/Luna liquidity mapping found the same shape โ a system that verified correctly at every checkpoint while the thing underneath it failed. The 2021 BAYC metadata finding was identical in form: a decentralized faรงade built over a single point of control.
Each time, the smart contract verified. Each time, the substrate did not. Immutability is a promise, not a feature. So is "cold storage." The adjective is a claim. The entropy is the fact. Code does not lie; auditors do โ and sometimes the auditor is the custodian's own vendor, grading its own firmware.
To be fair to the bulls, and I am rarely fair to the bulls, the custodians got several things genuinely right.
Whitelisted withdrawal addresses, time-locked outflows, and independent on-chain monitoring would have caught an actual theft even if the keys had been compromised. Physical security was disciplined; I found no evidence of private-key exfiltration. The 3-of-5 quorum policy, despite the flawed entropy, was enforced at the application layer. That is real engineering, and it should be credited.
And there was a response. When I sent the derivation proof in February, one custodian rotated its entire key hierarchy within eleven days and moved to per-device seeding. The other did not. It blamed "third-party vendor firmware," then declined to name the vendor, then stopped answering email. Silence in the logs is the loudest scream, and immutability does not apply to an inbox.
For ETF holders, the realistic risk was never a network attacker brute-forcing a seed in transit. It was the insider with ceremony access and the vendor with firmware control. Segregation of duties addresses the first. Insurance addresses the second. Neither addresses the seed.
The bulls also argue that MPC custody would have avoided this. It would not have, wholly. MPC replaces the script quorum with mathematical key sharding, but if the shards are derived from one seed in one room, the entropy correlation survives intact. MPC changes the shape of the vulnerability, not its existence. The lesson of 2025 is that no custody architecture outruns its randomness. The architecture is not the vulnerability. The seed is.
You cannot insure what you have not verified.
The institutional era of crypto is being built on a phrase almost nobody has stress-tested: "audited custodian." Audit the what, not the who. Ask for entropy provenance. Ask for the ceremony transcript. Ask which firmware built which key, and who signed the build. If the answer is a PDF, you have learned nothing.
Trace the hash, ignore the hype.
The forty-billion-dollar question is simple, and it appears in no prospectus: if two of the top three custodians shared a seed, how many of the next thirty did? Every exploit is a history lesson in slow motion. The lesson here is already written. The market simply has not finished reading it.