My vault uses Coldcards. Should I use Slipstream to submit my transaction?

Coinkite, the makers of Coldcard, disclosed a vulnerability affecting private key generation on some of its devices. Unchained clients with vaults where 2 of 3 private keys were generated on a Coldcard are vulnerable.

Any bitcoin in reused addresses (addresses that were previously spent from) is at immediate risk of loss. If you are in this situation, consult the emails you received from Unchained for immediate next steps.

If you do not have bitcoin in addresses that were reused, then your bitcoin is less likely to be at immediate risk of loss. We still recommend moving this bitcoin to a new vault by performing a sweep transaction using new keys generated on secure hardware wallets.

The risk of “RBF sniping”

Unfortunately, because the underlying private keys are vulnerable, broadcasting the sweep transaction to the public bitcoin mempool could temporarily expose that bitcoin to an "RBF sniping" attack. This applies to clients with 2 Coldcard-generated keys, but not clients with only 1 Coldcard-generated key.

To mitigate this risk, you can instead submit the sweep transaction directly to a bitcoin mining pool, bypassing the public mempool entirely. This approach requires you to trust the chosen mining pool.

When initiating a transaction from your Unchained vault, Coldcard users will now see the option to perform either a Slipstream transaction or a normal transaction.

What is Slipstream?

Slipstream is a specialized direct-to-miner solution operated by MARA Holdings, a mining company publicly traded on Nasdaq. Instead of sending your transaction to the public bitcoin mempool, Slipstream transmits it to a mining partner, allowing it to be included in a block without entering the public mempool.

A Slipstream transaction will:

1. Generate a bitcoin transaction that moves all bitcoin from the source vault to an address of your choosing (for example, an address in a new Unchained vault with newly generated keys).
2. Require you to sign the transaction with your existing keys.
3. Be sent directly to a bitcoin miner through Slipstream instead of being broadcast to the public bitcoin network.
   
4. Be monitored on the Slipstream website rather than in the Unchained app or a public block explorer. Unchained will provide a link to the Slipstream transaction.
   
5. Be mined in an upcoming block without entering the public mempool. Unchained will detect the confirmation and update your wallet balances automatically.

How to use Slipstream for an Unchained vault withdrawal:

1. Initiate a withdrawal from a vault. If we have identified you as a Coldcard user, you will see Are you attempting a Coldcard recovery? Choose the option Yes, I am sweeping coins from a vault with multiple keys generated on a Coldcard. If you don't see these options, contact our team.
2. Proceed with the withdrawal as normal.
3. After the transaction is fully signed, you will be prompted to choose either Slipstream or the standard broadcast option.
4. Select your preferred broadcast method. Choose Submit to MARA Slipstream if you want to use Slipstream. 

How to use Slipstream for an Unchained vault sale transaction:

1. Initiate a sale transaction from a vault.
2. After the Enter details step, If we have identified you as a Coldcard user, you will see a Broadcast options step prior to the Review transaction step. When you get to that step, you will see Are you using a Coldcard? You may choose the option Proceed with MARA Slipstream. If you don't see these options, contact our team.
3. Proceed with the sale transaction as normal.
4. On the Finalize and broadcast step, if you had previously selected "Proceed with MARA Slipstream," then when you click Execute sale and broadcast transaction, the Slipstream method will be used.