MDforBitcoin @MDforBitcoin

thank you red team 🚩 for securing public bitcoin infrastructure it’s been almost an entire week of non-stop hunting for vulnerabilities and disclosures we’ve seen shit together some of the most insane shit i’ve ever seen in my life you’re incredible beings keep going

The @BlockstreamJade is one of the best hardware wallets on the market, bar none. I wonder how many people dismissed it due to the FUD that it lacked a secure element? Secure elements aren't a panacea but are often sold as such. A physical SE in the device means everything needed to extract the seed is sitting right there, and potentially in the hands of someone that steals it. It's a stationary target. An attacker can wreck a dozen units learning the technique before touching yours. Ledger's Donjon has done exactly this to Coldcard silicon twice, the Mk2 ATECC508A and later the SE2 on Mk4, and voltage-glitched the Trezor Safe 3's MCU. Jade moves the target instead. Your seed is encrypted with an AES-256 key that the device and a blind oracle build between them, and the oracle never holds more than a piece of it. The ESP32 only has ciphertext. You can't extract something that was never in there. The attack turns interactive, against a party who rate-limits you and wipes its half after three bad PINs. Coldcard split your secret across three chips from different SEs. That genuinely helps against one vendor's silicon getting broken. But the pitch lands as arithmetic, and security doesn't really work that way. As we've seen, bad entropy at setup meant none of the silicon even mattered. You could have 10 SEs in the CC and that wouldn't have saved you. But people ate that security theater up. My mind keeps circling back to what we could have done differently. I keep landing on the same conclusion: we should have pushed back on the SE FUD much harder, and promoted Jade far more aggressively. We'd never have attacked CC, but we should never have taken the unwarranted flak for Jade's security model. The FUD steered people away from Jade. If we'd fought it, maybe more of them would have avoided the CC tragedy. When we first launched the Jade, it sold for just $39.99. For that price you got such an incredible amount of value (at launch and later with subsequent updates). ➡️ Virtual secure element via blind oracle (@Blockstream's or self-hosted) ➡️ Can function as a stateless signing device (like SeedSigner) ➡️ Anti-Exfil protocol to protect against your seed being exfiltrated (Jade is one of only two HWWs that do this) ➡️ Genuine Check verification to prove the device is authentic and untampered with ➡️ Secure Boot ensuring only properly signed firmware runs ➡️ BIP39 passphrase and duress PIN ➡️ Air-gapped operations ➡️ Store Liquid assets like @tether USDT ➡️ Multisig support AND the ability to back up the multisig config (descriptors) for a setup involving ANY devices (or mixed hardware/software), as long as at least one Jade is part of the multisig - this makes multisig far less brittle since losing the config is catastrophic The best part of all of this? You don't even need to BUY a Jade. You can build your own with almost any ESP32 board. Pair it with your own self-hosted blind oracle and you have a completely sovereign stack with no HWW vendor supply chain risk. If you're looking for a new hardware wallet, take a serious look at @BlockstreamJade. It's built by a world-class team of engineers and cryptographers assembled by @adam3us. But don't take my word for it. The firmware is fully open source, so read it yourself. Don't Trust. Verify. blockstream.com/jade

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds. Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer. If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.

Not a drill. Tell everyone you know that is running BTCPay to turn it off right now.

BTCPay Server @BtcpayServer

4 days ago

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds. Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer. If you

217 1K 3K 1.5M 286

I will just say, I am very impressed with how bitcoin twitter responded to the Coldcard hack. So many good samaritans pitched in and provided value in whatever unique way that they could. Whether it was rapidly diagnosing the hack, providing unique specialized domain expertise, using frontier AI tools to scan code, tracking the stolen funds, running marathons of twitter spaces educating people on best practices, or just people getting the message out to as many people as they could. Even the paid Coldcard shills produced videos to alert their audiences, offered apologies, and explained what affected users should do. You don’t see this kind of collective response in the broader crypto space during a typical DeFi rug pull. It was something rare and meaningful, the first time in several years I’ve felt truly proud to be part of bitcoin’s social layer.

bugs being fixed left and right Bitcoin Red Team is an actual thing it's a team of people but it's not the only team far from it there are dozens and probably hundreds of Bitcoin Red Teams Bitcoin Red Team is a mindset NO SURRENDER STRONGER THAN EVER THIS OUR LAND

🇹🇭 Thailand confirms 0% capital gains tax on Bitcoin & crypto. 👏

🚩 Bitcoin Red Team update 55 hours into the campaign We're now 24 people working around the clock. We've scanned 425 projects so far and have produced 1029 high+critical (H+C) findings.

I am quite sure large holders like @saylor will be targeted, because hey, sounds good to do +10% on your BTC right? But you might be a victim too, so be extremely careful what you sign. People have bad intentions out there, when it's about stealing your coins. Take care, anon.

@albertahodl So sorry for your loss. I’d love to order some jerky. Do you have a website? I can’t seem to DM you.

@AtlasPhoenixBTC Onwards 👊

Re: Cold Card Hack Hello fellow Bitcoiners, It’s been nearly one week since my wallet was drained. I lost my entire bitcoin stack, presumably the most in the entire attack - an amount I’m more than embarrassed and ashamed to even admit publicly. This was not only my life savings but my time, energy, hardcore conviction and identity after 13 years in this space. I am posting pseudonymously as I’ve always preferred to stay out of the spotlight - and privacy (inspired by Satoshi) is something I value. I debated whether or not I should say anything at all, but after much deliberation I decided it may be beneficial for other victims who are struggling. While this incident certainly forced upon me the darkest days of my life so far - I have now accepted it and will slowly put together my life again. I came from nothing and did everything right (except rolling the damn dice apparently 😅). I stayed away from trading, exchanges, shitcoins, ICOs, NFTs, false prophets, etc and quietly and consistently built up over the years through all the ups and downs - never spending frivolously on material goods but instead using bitcoin as my sense of freedom and security - with the hopes to pass it on to my future children. Even though that peace, freedom and security is now gone - I am beyond grateful for the journey and life that bitcoin enabled me to have. To all the other victims, as cliche as it is to say “it’s only money” - true wealth, as I’ve learned over and over again is in health, family, and friendships. I’d be lying if I told you I’m not afraid of the uncertainty ahead, but I know by taking one step at a time it will be possible to rebuild. Trust me if I can come to these realizations, you can too! The hardest challenges in life make us stronger and turn us into the best versions of ourselves - don’t give in to the hopelessness. By being in this community you are apart of something special that the majority of the world still hasn’t realized yet. It’s still early! Thanks to all the wonderful people in the community I’ve been DMing over the past week - your kind words of support mean the world to me and helped me start to believe in myself again. To the hacker: you still can do the right thing here and come clean - you have prompted a serious wake-up call that has brought the community together which will bring more resilience for the future. Doing the noble thing now will prevent a lifelong hunt. To all the amazing bitcoiners who have jumped to action from the very beginning to support each other and mitigate further damage - it’s been a beautiful thing to watch. To the @blocks team and especially @intangiblecoins, your efforts are inspiring and provide me with hope. Believe me when I say that IF I ever get my coins back you will all be taken care of very well, along with massive donations to the open source community. For now I will withhold any judgement towards @nvk and the @Coinkite team - while I’m still processing this loss and dealing with the gravity of building my life up from the ruins - I have 0 anger or resentment. Bitcoin security is a tough job, mistakes are made, and lessons are learned by all. I made mistakes by trusting and not verifying as well as not having a more robust security solution so the responsibility must be shared, hindsight is 20/20 and even though it’s tough: I’m okay admitting that. Bitcoin humbles all. Having said all that… I’M NOT FUCKING LEAVING!!! I will start building a new stack from the ground up like all the other plebs as my conviction in Bitcoin is even stronger today then when I got my first coins in 2013. This was never about the money - it was always about the revolution, and that can’t be stopped. We will win. Let’s keep our heads high. The march continues. It’s time to rebuild. PS: Thanks for everything Satoshi ❤️ -M

We are now mapping the ongoing Coldcard attack with a live dashboard - link below I am deploying tripwire UTXOs that have varying levels of added entropy on top of the broken default seeds. We have different levels for 5, 10, 15, ... dice rolls, and 1, 2, 3, ... passphrase words. This is so we can approximate the frontier of the confiscations that are actively happening. The control UTXO with no added entropy was swept in an hour. I took real measurements on an MK3 to calibrate a "good bad entropy" emulator in software. The control confiscation has proven it to work. I am going to continue to deploy tripwire UTXOs along the bit curve. Huge thanks to @Rob1Ham @otaliptus @PortlandHODL and other redteamers for the help.

keyboard_arrow_left Previous keyboard_arrow_right Next

Red Team Update In the final hours before @callebtc resumes his role as chief clank officer and wartime general of red team, I wanted to give some kind of update about today. We are accelerating. Not only in the expanse of repositories covered (over 300) and our spend (almost $40k), but in the efficiency to quickly identify where parts of the codebases will break. Seeing dozens vulnerability reports in an hour will do that to you. Another fascinating thing is how different members of the team are able to get entirely different outcomes based on our own applied knowledge. An example was when I scanned a repo and found some middling concerns. I showed the results to another member of the team, and with 1-2 sentences and maybe a block of code, they were able to upgrade to high or even critical vulnerabilities. That happened twice. Its almost like the agent can smell out something is wrong, but hasn't been trained enough yet to clearly verbalize it, so the slightest nudge of good knowledge/context will send it all on another recursive flurry deeper. I think there is some deeper lesson there about AI's productivity gains further accelerates the division of labor, but I'm too tired to get so abstract. The Red Team harness I mentioned yesterday was quickly thrown together over 20-30 minutes laying out conceptually, who I someone who has no security research, would think this would work. I now have multiple responses to disclosures telling me it was very well written, but I'm wondering if the bar is so low because they think it'll be llm slop. Maybe because its written in a way an LLM can pick right up and give exact feedback. Upon receiving a disclosure, one developer critically read through the whole report and gave a lot of very strong constructive feedback (you know who you are, thank you). I asked if they could give it as a lesson to my clanker, to which they returned to me a 50 kb markdown file. After which, I interviewed it for 30 minutes, integrating behaviors I wanted to focus on into the harness behaviors into the model, and quickly found even stronger success as a result. Seeing how impactful that feedback session was, I'm making a point tomorrow to NOT be scanning repos (as much). My focus primarily will be working on the harness and systems itself. I have a lot of ideas, maybe I'll come back tomorrow with lessons learned. Outside the harness, I want to focus more on operations. Every step of the process is chaotic right now. I accidentally nuked the repo this morning by not paying attention to Calle's new style guide and frantically had to unwind it. Another delay was at one point I walked away from my computer at the wrong time and the balance on @opencode spiked down to -$1000. It killed dozens of ongoing agents/subagents, and got frantic pings about scans going down. 20 minutes later, I noticed that none of my credit cards worked anymore. I then got the error "try debit card", and that failed too! I watched the balance tick to under $100, knowing I was close to stalling everyones jobs again when suddenly it worked (thx @jayair for quick support it worked out). I also want to focus on triaging all of our disclosures. We should be able to turn these around a lot faster now, and cleanly sort what has and has not been shared yet. In other news... To be blunt, I'm still numb over the death of the cold card. I have not heard of many stories about the lives ruined, and that is probably on purpose because I've made @AnchorWatch and the Red Teaming my sole focus. I have blocked out the thought of even starting to process the catastrophic harm that has been caused to my friends and their families. There is a tragic irony that is not lost on me that good people wanting to store their wealth, their time, their future dreams in a more honest and fair system were exploited by the thing they took refuge in. I truly believe these events have been a spiritual attack on bitcoin, and I mean that in the literal senses of the words. While things are not easy right now. I have the highest conviction ever in my life that the idea and technology of Bitcoin is worth fighting for. To that end. There is no Bitcoin without self custody. This is non negotiable. That does not mean everyone must self custody, but the option to is necessary for a free and prosperous society which respects property rights. I think one of the biggest lessons from all of this is one of risk management. There was a latent Risk of Ruin in how many people held their bitcoin, and unfortunately what many thought to be impossible, came to pass. I will find time to grieve, but today isn't the day.

keyboard_arrow_left Previous keyboard_arrow_right Next

This is one of the more interesting reveals of the ColdCard saga. Pretty much every Bitcoin maximalist in Korea were not affected because they all used dice rolls. How can this be? The culture of the Korean Bitcoin community is very much about doing things the right way. To give you an idea, I've visited many times, seen the same people many times and I still don't know most of their names because they almost all use pseudonyms, which is considered a best practice in that community. I think there's something to learn here because the US Bitcoin Maximalist community was a little too trusting and not enough cypherpunk. Be like the Koreans, do things the right way, all the way.

Koji Higashi @Coin_and_Peace

7 days ago

x.com/i/article/2084…

30 163 595 395K 403

Initial reflections on the Coldcard catastrophe, the bitcoin-only approach, and financial freedom: 1) Many people, me included, trusted and recommended Coldcard more than we should have. Especially after it became only source-viewable, and especially given the attitude of the Coldcard creator towards other similar projects. These were obviously red flags in retrospect. This was a huge lapse on my part and I pledge to learn from it 2) Coldcard operated for many years with shocking, betraying negligence that was hidden from the public by a) security theater driven by marketing (i.e. cypherpunks should use this sophisticated tool) and b) an “in circle” reputation and that people like me perpetuated. Another mistake that will stick with me, and guide my future actions 3) We will not be lectured by scammers and ETF promoters and former FTX cheerleaders. There are other Bitcoin-only products like Bitkey, Bitbox, Passport, and Seedsigner. Just because one Bitcoin hardware wallet company failed, doesn't mean the Bitcoin-only approach is bad. Far from it. It just means we need to learn and improve. It DOES NOT MEAN we need to "diversify" into random shitcoins, endorse or tolerate premines, give all our Bitcoin to corporations, or other such nonsense 4) FOSS should be the gold standard in general. And multi-vendor multi-sig or collaborative custody should be a goal for large amounts 5) Exchange hacks have been ~1,000x worse than even this disaster. The answer to challenges in self-custody is *not* to trust someone else with your money. It’s to learn and improve or upgrade your self-custody 6) Fiat currency must be defeated. Entire nations have lost 50% of their money overnight, 75% or even 99% in a matter of months or years. Accounts are regularly frozen and stolen every day. The global monetary system is immensely unjust and predatory and must be resisted. The mission must go on 7) AI makes bugs more exploitable, but it also can be used to secure codebases to an extraordinary degree. This is already happening (see Spiral's Loupe) and really shows the power of open weights. The lesson here is not that frontier AI should be gatekept by the elite, but that it should be open to all, so that we all have more eyes on everything 8) Financial freedom is not easy. And maybe never will be. The price of freedom is eternal vigilance. Self-custody is the pinnacle. Maybe not everyone reaches it, but we should strive to make it an option for anyone 9) I am sorry that HRF handed out Coldcards at two of our events over the past decade, and sorry that I mentioned Coldcards occasionally over the years as a good option. I am NOT sorry that HRF has a laser focus on self-custody and privacy. This approach is *the only option* for people under authoritarian societies. Maybe you want to choose to rely on the good graces of an American financial institution, but this option doesn't exist for billions of people worldwide 10) I am also proud that HRF over the past decade has handed out *many more units* of other devices such as Bitkeys and Seedsigners and Passports, and that we work to teach topics like privacy and multi-sig in our work. I am also proud that we have given out 100+ grants, invested more than $5M, and paid out more than a dozen bounties towards multi-sig, better self-custody, and privacy 11) I can’t say enough about how awesome Casa is and collaborative custody in general. I have heard good things about AnchorWatch and Unchained as well. I highly recommended the collaborative approach for non-profits. Liana is fully open source and superb for managing multi-sig. Casa and Liana have helped HRF sleep easy through the FTX crash, Silicon Valley banking system collapse, Coldcard catastrophe, and other crises 12) It is incredibly inspiring to see the Bitcoin community rally around helping people at a time of need. Many people have barely slept over the past four days as they have helped race to secure funds. It is truly awesome to see this 13) We are in a new age of "back to the basics" in thinking hard about self-custody. Bitcoin doesn't work as freedom money unless people can control it themselves. There is much work to do, but perhaps in 10 years we will look back at this crisis and see that the industry instead of giving up, evolved significantly as a result. Now is the time to make that dream a reality. Thankfully I am seeing a variety of Bitcoin companies and entrepreneurs ranging from Block to Bull iterate rapidly in that direction 🙏

Unpopular opinion: In the long run, the cold card bug will be bullish for Bitcoin. In 6-8 months everyone will have forgotten it because we live in a bubble. The halving will come and the price will pump. If CoinKite survives they’ll be stronger. If they don’t, they’ll be another in a long line of bitcoin companies that have come and gone. Bitcoiners will have learned valuable lessons and the space will strengthen. Last cycle it was exchanges. This cycle it’s hardware wallets. Next will be something else. Each a lesson to be learned. The beatings will continue until Cypherpunk ideals return. Tick tock next block.

The wildest thing about all this is that hardly anyone called out Coldcard’s sea of red flags, which are so obvious in hindsight: no FOSS license, no published independent audits, messy code, chaotic commit histories, and past criticism from security researchers over how the company handled vulnerability disclosures. Somehow, most of the community was blinded by the halo effect. This was a security bug in the social layer.

@zherbert @FoundationHQ Someone in telegram group literally pointed about coldcard random function back in 2021. Of course it gets ignore.

The great hardware wallet hardening process is underway. These events have hurt real people who lost their life savings, but it is not in vain. They are also forcing every self-custody wallet company to tighten systems, run deeper reviews and audits, and ask harder questions internally. More AI systems are being reinforced and put to work on code checks and threat modelling in ways they never were before. Not only inside the companies, but also by independent researchers and the wider community as well. You might not feel it right now, but self-custody is currently accelerating faster than any other part of this space. There is a light at the end of the tunnel.