The future won’t wait for you.

@TFTC21

Galaxy Research is tracking the Coldcard hack in real time. They've identified three waves of sweeps so far: 1,367 BTC (~$88.6M) drained from 4,585 addresses. The first wave hit 1,196 addresses in a 41-minute window, all paying an identical 30 sat/vB fee. Automated key scanning, not owners moving funds. Galaxy notes "the loss profile is dominated by sub-1 BTC addresses in count, but by larger addresses in value. This appears to be the shape of individual self-custody, not institutional holdings." Not one coin taken was created before the vulnerable firmware shipped in March 2021.

@TFTC21

.@KLoaec from Wizard Sardine just published a full technical breakdown of a critical Coldcard vulnerability. Every seed generated on the device since 2021 is compromised. Wallets are being drained right now. The chip has a perfectly working hardware random number generator. Nobody was calling it. "The Coldcard replaces MicroPython's randomness module with its own, deemed more conservative. To do so, it disables the original one... The catch is that MicroPython does not remove rng_get() when that flag is 0. It replaces it with a software imitation." The result: "a Coldcard seed no longer held a single bit of physical randomness." A compile-time safety check should have caught this but used `ifndef` instead of `if`. "One character stood between that safeguard and its purpose." It passed on every build for 5+ years. Seeds from 50+ dice rolls or pre-2021 are safe. Everyone else: move funds now. wizardsardine.com/blog/coldcard-…

@TFTC21

TFTC 778 w/ @hot_town: "The playing field is being leveled. It's no longer limited by technical ability. This opens up whole new economies." We discuss: ⚡ Building with AI agents ⚡ Bitcoin & the agent economy ⚡ Why open source wins

@TFTC21

Gold has closed below its 200-day moving average for 39 straight trading days. The longest streak since 2022.

@TFTC21

Block engineers trace COLDCARD attacker to blockchain services provider. Clay Garrett, engineering lead for @blocks Bitkey, shared that during their investigation of the COLDCARD drain, Block's team identified an unusual pattern in the sweeps that led them to a breakthrough. The attacker used a paid account at a well-known blockchain services provider to query the targeted addresses and perform related activity during the theft. Block contacted the provider directly and their internal logs "matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests." Garrett noted there is no evidence the provider knowingly participated in or facilitated the theft, stating it "was supplying its standard services in response to requests that did not reveal their broader purpose." The team is now sharing the information with authorities and will provide further updates when doing so won't interfere with the investigation. This is a significant development as it means the attacker left an identifiable trail through a service that maintains account records, potentially giving law enforcement a direct lead.

@TFTC21

Conner Brown of @bitcoinpolicy urges Coldcard victims not to destroy compromised devices after the firmware flaw that drained tens of millions in BTC. “If you have a Coldcard that was compromised, do not throw away or destroy the device.”

@TFTC21

Hyperscale Data sells 100 Bitcoin, establishes BTC-backed credit facility to accelerate Michigan AI campus.

@TFTC21

"Even the smart guys screwed up self-custody. How can we expect anybody will comfortably self-custody after this?" @jamesob on the second-order effects of the COLDCARD vulnerability, why every hardware wallet maker has had a fatal misstep, and why the only categorical fix may be covenants.

@TFTC21

"Security by obscurity is going to zero rapidly." @jamesob and other researchers independently reproduced the COLDCARD vulnerability by pointing an AI model at the firmware history. This is the new reality for open-source security.

@TFTC21

"You screw up one thing, the wrong one thing, and it's toast." @MartyBent and @jamesob on the COLDCARD vulnerability, what it means for self-custody, and why you should be reaching out to anyone you've ever recommended a COLDCARD to.

@TFTC21

Coinbase Chief Policy Officer on CLARITY Act progress: "We've got ethics nailed down, we've got nominations nailed down, we've got a bipartisan bill on the substance, we should be good to go."

@TFTC21

.@BTCsessions walks through how to safely migrate your COLDCARD seed using dice rolls if you don't have other hardware available. Don't wait.

@TFTC21

Galaxy Research is tracking the Coldcard hack in real time. They've identified three waves of sweeps so far: 1,367 BTC (~$88.6M) drained from 4,585 addresses. The first wave hit 1,196 addresses in a 41-minute window, all paying an identical 30 sat/vB fee. Automated key scanning, not owners moving funds. Galaxy notes "the loss profile is dominated by sub-1 BTC addresses in count, but by larger addresses in value. This appears to be the shape of individual self-custody, not institutional holdings." Not one coin taken was created before the vulnerable firmware shipped in March 2021.

@TFTC21

.@KLoaec from Wizard Sardine just published a full technical breakdown of a critical Coldcard vulnerability. Every seed generated on the device since 2021 is compromised. Wallets are being drained right now. The chip has a perfectly working hardware random number generator. Nobody was calling it. "The Coldcard replaces MicroPython's randomness module with its own, deemed more conservative. To do so, it disables the original one... The catch is that MicroPython does not remove rng_get() when that flag is 0. It replaces it with a software imitation." The result: "a Coldcard seed no longer held a single bit of physical randomness." A compile-time safety check should have caught this but used `ifndef` instead of `if`. "One character stood between that safeguard and its purpose." It passed on every build for 5+ years. Seeds from 50+ dice rolls or pre-2021 are safe. Everyone else: move funds now. wizardsardine.com/blog/coldcard-…

@TFTC21

TFTC 778 w/ @hot_town: "The playing field is being leveled. It's no longer limited by technical ability. This opens up whole new economies." We discuss: ⚡ Building with AI agents ⚡ Bitcoin & the agent economy ⚡ Why open source wins

@TFTC21

Gold has closed below its 200-day moving average for 39 straight trading days. The longest streak since 2022.

@TFTC21

Block engineers trace COLDCARD attacker to blockchain services provider. Clay Garrett, engineering lead for @blocks Bitkey, shared that during their investigation of the COLDCARD drain, Block's team identified an unusual pattern in the sweeps that led them to a breakthrough. The attacker used a paid account at a well-known blockchain services provider to query the targeted addresses and perform related activity during the theft. Block contacted the provider directly and their internal logs "matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests." Garrett noted there is no evidence the provider knowingly participated in or facilitated the theft, stating it "was supplying its standard services in response to requests that did not reveal their broader purpose." The team is now sharing the information with authorities and will provide further updates when doing so won't interfere with the investigation. This is a significant development as it means the attacker left an identifiable trail through a service that maintains account records, potentially giving law enforcement a direct lead.

@TFTC21

Conner Brown of @bitcoinpolicy urges Coldcard victims not to destroy compromised devices after the firmware flaw that drained tens of millions in BTC. “If you have a Coldcard that was compromised, do not throw away or destroy the device.”

@TFTC21

Hyperscale Data sells 100 Bitcoin, establishes BTC-backed credit facility to accelerate Michigan AI campus.

@TFTC21

"Even the smart guys screwed up self-custody. How can we expect anybody will comfortably self-custody after this?" @jamesob on the second-order effects of the COLDCARD vulnerability, why every hardware wallet maker has had a fatal misstep, and why the only categorical fix may be covenants.

@TFTC21

"Security by obscurity is going to zero rapidly." @jamesob and other researchers independently reproduced the COLDCARD vulnerability by pointing an AI model at the firmware history. This is the new reality for open-source security.

@TFTC21

"You screw up one thing, the wrong one thing, and it's toast." @MartyBent and @jamesob on the COLDCARD vulnerability, what it means for self-custody, and why you should be reaching out to anyone you've ever recommended a COLDCARD to.

@TFTC21

Coinbase Chief Policy Officer on CLARITY Act progress: "We've got ethics nailed down, we've got nominations nailed down, we've got a bipartisan bill on the substance, we should be good to go."

@TFTC21

.@BTCsessions walks through how to safely migrate your COLDCARD seed using dice rolls if you don't have other hardware available. Don't wait.