The future won’t wait for you.

@TFTC21

.@BTCsessions walks through how to safely migrate your COLDCARD seed using dice rolls if you don't have other hardware available. Don't wait.

@TFTC21

TFTC 777 w/ @jamesob: "If you're single-sig with no passphrase or dice rolls, you need to drive home and migrate your funds. These wallets are dangling in the wind." We discuss: ⚡ The flaw exposed overnight ⚡ How to check your risk ⚡ Why self-custody still wins

@TFTC21

NVK responds to COLDCARD community. Coinkite CEO NVK published a statement addressing the COLDCARD entropy vulnerability. "I'm sorry and I'm devastated," he wrote. "As a team that has dedicated our lives to securing the Bitcoin held by millions of individuals, businesses, and families, this is our core responsibility, and we fell short." NVK said the company has shipped a firmware hotfix that removes the software fallback path entirely, but stressed it does not fix seeds already generated on vulnerable firmware. "If your seed was generated before the fix, it needs to be individually migrated to a new seed. A firmware update alone cannot do that for you." He urged anyone who knows a COLDCARD owner to help spread the word, noting the company does not store customer information. "We know an apology doesn't return anyone's funds. We know we'll have to earn back our users' trust. That starts with being open and telling the truth about how this happened." NVK closed with a warning to the broader developer community: "AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike."

@TFTC21

COLDCARD Security Update: Coinkite Explains the Entropy Bug Coinkite has published a detailed technical breakdown of the COLDCARD seed generation vulnerability disclosed yesterday. During a 2021 migration to Bitcoin Core's libsecp256k1 library, seed generation accidentally started pulling from MicroPython's software random number generator instead of COLDCARD's dedicated hardware RNG. The bug slipped through because both functions shared the same name, allowing the wrong one to be silently selected during the build process without triggering an error. The Mk3 is the most affected device. Seeds generated on firmware 4.0.1 and later have an estimated effective search space of roughly 40 bits, far below the intended 128-bit security target, and those users should migrate immediately. The Mk4, Q, and Mk5 models mixed in additional entropy from their SE1 and SE2 secure elements, bringing the effective search space to approximately 72 bits, better but still well below the 128-bit target. Users need to update their firmware (Mk3 to 4.2.0, Mk4/Mk5 to 5.6.0+, Q to 1.5.0Q+), generate a completely new seed, and migrate their funds to the new wallet. Updating firmware alone does not fix a seed that was already generated by the affected versions. Even users who added dice rolls or a BIP-39 passphrase during original seed creation should strongly consider migrating unless they are certain they used at least 100 fair, independent rolls. Coinkite acknowledged that AI likely helped the attacker discover the bug, noting they had recently used AI to review their own code and it missed the issue entirely. Full technical backgrounder: blog.coinkite.com/entropy-techni…

@TFTC21

Former Barclays CEO Bob Diamond tells CNBC the Clarity Act “is really good for the banks.” “The largest, most successful banks are going to benefit from this.” “No one is investing more in innovation right now” than the big banks.

@TFTC21

Coinkite has issued a security advisory for Coldcard Mk3 users. If you generated a seed on a Mk3 running firmware 4.0.1 (March 2021) or later, your funds may be at risk. The issue appears to be related to the device's random number generator during seed creation. Mk4, Q, and Mk5 are not affected. If you used a BIP-39 passphrase on top of your Mk3 seed, Coinkite says the risk is minimal. If you didn't, you should migrate your funds to a new seed generated on an unaffected device. Don't rush. Send a test transaction first, verify the new wallet, then move the rest. More details from Coinkite's investigation are coming. Full advisory: blog.coinkite.com/coldcard-mk3-s…

@TFTC21

Reports are coming in that some Coldcard hardware wallet users are having their bitcoin drained. Multiple known Bitcoiners are confirmed affected. @KLoaec’s working hypothesis is a low-entropy RNG issue, possibly in the secure element, with an attacker using AI to bruteforce and sweep only bip84 (segwit) paths, which would explain the partial thefts. Root cause is still unconfirmed. Could be RNG, nonce reuse, or something else entirely. If you use a Coldcard single-sig setup, check your balances now. If affected, email Coinkite with proof you control the keys.

@TFTC21

Sen. Cynthia Lummis says the CLARITY Act remains on track for a Senate vote before the August recess: “Sen. Thune has kept a place for the CLARITY ACT on the agenda...and I believe he does intend to go through with it...We will be moving forward.”

@TFTC21

Martin Shkreli on AI infra unwind amid model advances: “None of that stuff matters. The only thing that matters is the propensity of the buyer and seller to buy or sell.”

@TFTC21

"Millennials are already the first generation who will end up worse off than their parents. Gen Z is going to be even worse." @crossbordercap and @MartyBent on the rising populism that follows when a generation has nothing left to lose. x.com/TFTC21/status/…

@TFTC21

Sen. Cynthia Lummis: “This doesn’t come back next year… The realistic next chance at market structure legislation is likely 2030.” She urged passage of the CLARITY Act, adding the window to lead “is wide open.”

@TFTC21

IRS warns digital asset investors of fake letters with QR codes directing to a nonexistent “Digital Asset Compliance Portal.” Coinbase also alerts clients. Do not scan the codes or enter any info.

@TFTC21

.@BTCsessions walks through how to safely migrate your COLDCARD seed using dice rolls if you don't have other hardware available. Don't wait.

@TFTC21

TFTC 777 w/ @jamesob: "If you're single-sig with no passphrase or dice rolls, you need to drive home and migrate your funds. These wallets are dangling in the wind." We discuss: ⚡ The flaw exposed overnight ⚡ How to check your risk ⚡ Why self-custody still wins

@TFTC21

NVK responds to COLDCARD community. Coinkite CEO NVK published a statement addressing the COLDCARD entropy vulnerability. "I'm sorry and I'm devastated," he wrote. "As a team that has dedicated our lives to securing the Bitcoin held by millions of individuals, businesses, and families, this is our core responsibility, and we fell short." NVK said the company has shipped a firmware hotfix that removes the software fallback path entirely, but stressed it does not fix seeds already generated on vulnerable firmware. "If your seed was generated before the fix, it needs to be individually migrated to a new seed. A firmware update alone cannot do that for you." He urged anyone who knows a COLDCARD owner to help spread the word, noting the company does not store customer information. "We know an apology doesn't return anyone's funds. We know we'll have to earn back our users' trust. That starts with being open and telling the truth about how this happened." NVK closed with a warning to the broader developer community: "AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike."

@TFTC21

COLDCARD Security Update: Coinkite Explains the Entropy Bug Coinkite has published a detailed technical breakdown of the COLDCARD seed generation vulnerability disclosed yesterday. During a 2021 migration to Bitcoin Core's libsecp256k1 library, seed generation accidentally started pulling from MicroPython's software random number generator instead of COLDCARD's dedicated hardware RNG. The bug slipped through because both functions shared the same name, allowing the wrong one to be silently selected during the build process without triggering an error. The Mk3 is the most affected device. Seeds generated on firmware 4.0.1 and later have an estimated effective search space of roughly 40 bits, far below the intended 128-bit security target, and those users should migrate immediately. The Mk4, Q, and Mk5 models mixed in additional entropy from their SE1 and SE2 secure elements, bringing the effective search space to approximately 72 bits, better but still well below the 128-bit target. Users need to update their firmware (Mk3 to 4.2.0, Mk4/Mk5 to 5.6.0+, Q to 1.5.0Q+), generate a completely new seed, and migrate their funds to the new wallet. Updating firmware alone does not fix a seed that was already generated by the affected versions. Even users who added dice rolls or a BIP-39 passphrase during original seed creation should strongly consider migrating unless they are certain they used at least 100 fair, independent rolls. Coinkite acknowledged that AI likely helped the attacker discover the bug, noting they had recently used AI to review their own code and it missed the issue entirely. Full technical backgrounder: blog.coinkite.com/entropy-techni…

@TFTC21

Former Barclays CEO Bob Diamond tells CNBC the Clarity Act “is really good for the banks.” “The largest, most successful banks are going to benefit from this.” “No one is investing more in innovation right now” than the big banks.

@TFTC21

Coinkite has issued a security advisory for Coldcard Mk3 users. If you generated a seed on a Mk3 running firmware 4.0.1 (March 2021) or later, your funds may be at risk. The issue appears to be related to the device's random number generator during seed creation. Mk4, Q, and Mk5 are not affected. If you used a BIP-39 passphrase on top of your Mk3 seed, Coinkite says the risk is minimal. If you didn't, you should migrate your funds to a new seed generated on an unaffected device. Don't rush. Send a test transaction first, verify the new wallet, then move the rest. More details from Coinkite's investigation are coming. Full advisory: blog.coinkite.com/coldcard-mk3-s…

@TFTC21

Reports are coming in that some Coldcard hardware wallet users are having their bitcoin drained. Multiple known Bitcoiners are confirmed affected. @KLoaec’s working hypothesis is a low-entropy RNG issue, possibly in the secure element, with an attacker using AI to bruteforce and sweep only bip84 (segwit) paths, which would explain the partial thefts. Root cause is still unconfirmed. Could be RNG, nonce reuse, or something else entirely. If you use a Coldcard single-sig setup, check your balances now. If affected, email Coinkite with proof you control the keys.

@TFTC21

Sen. Cynthia Lummis says the CLARITY Act remains on track for a Senate vote before the August recess: “Sen. Thune has kept a place for the CLARITY ACT on the agenda...and I believe he does intend to go through with it...We will be moving forward.”

@TFTC21

Martin Shkreli on AI infra unwind amid model advances: “None of that stuff matters. The only thing that matters is the propensity of the buyer and seller to buy or sell.”

@TFTC21

"Millennials are already the first generation who will end up worse off than their parents. Gen Z is going to be even worse." @crossbordercap and @MartyBent on the rising populism that follows when a generation has nothing left to lose. x.com/TFTC21/status/…

@TFTC21

Sen. Cynthia Lummis: “This doesn’t come back next year… The realistic next chance at market structure legislation is likely 2030.” She urged passage of the CLARITY Act, adding the window to lead “is wide open.”

@TFTC21

IRS warns digital asset investors of fake letters with QR codes directing to a nonexistent “Digital Asset Compliance Portal.” Coinbase also alerts clients. Do not scan the codes or enter any info.