Multi vendor multi sig appears to be our best bet.
A PSA I think we should also be loud about:
if you are using multi sig, but have multiple coldcards in your setup, you are also still vulnerable. You need to be working on moving funds to a wallet without vulnerable keys.
Let’s say you have 2-of-3 multisig and 2 of those devices are cc, this means you.
Options are
-to create a new wallet (new keys) using dice/complex passphrase and move funds there
- create a new wallet (keys) using an unaffected device and move funds there
- move funds to a trusted custody provider.
I would trust River and Unchained personally, but do what you need to do.
I know this may mean moving to where devices are located, but that is where we are right now. You need to do this.
If you have multi sig set up with devices different manufacturers, good! This vulnerability should not affect you.
-