Café Bitcoin | The Coldcard Timeline, Joe Nakamoto on the Fallout, and Open Source Must Win | Day 10 of 50

A full forensic timeline. Brady traced it end to end: a 2018 MicroPython software fallback sat harmless for three years until March 2021, when Coinkite moved to Bitcoin Core's math library and silently bound seed generation to that fallback. Lopp notes the bug lived in the build system, not the main code.
Firmware 4.0.0 is the dividing line. Shipped March 17, 2021. Seeds generated before roughly March 1 are fine, and MK3 releases 3.2.1 and 3.2.2 were the last safe ones. Every default seed after that was weak.
It was flagged in 2021 and dismissed. Four months after the bad firmware shipped, someone publicly raised Coldcard entropy concerns. NVK's reply called it FUD and demanded a line in the code. That post is deleted; an archived screenshot survives.
The scope widened over the weekend. Coinkite added MK2 alongside MK3 and MK4, and confirmed Q and MK5 at roughly 72 bits rather than the expected 128. Independent analysis put the MK4 class nearer 50 to 60 bits in practice.
Dice rolls and passphrases do not cover everything. Nine other Coldcard features draw from the same broken generator, including message signing and deriving keys for other purposes. BTC Sessions confirmed an MK4 with a one-word passphrase was drained.
Scale, and Cory's proportion. Roughly 1,300 Bitcoin total, 594 in the first wave, with Chainalysis showing the highest-balance wallets targeted first. Cory noted centralized exchanges and lenders have lost about a thousand times more.
The chip-ID recovery hope is gone. Holders were told earlier in the week to keep their devices because a chip signature might prove ownership. Brady reported that has since been shown not to work as hoped, narrowing recovery further.
Vendor indictment or self-custody indictment? An audience question that framed the hour. Brady argued it is a challenge to upgrade toward multi-vendor multisig rather than a verdict on self-custody. One listener pushed back that the indictment already landed.
Joe Nakamoto from Europe. He found almost nobody in his circle affected, since Coldcard's loudest advocates were largely American and circular economies mostly run on Lightning. Bloomberg was the only genuinely mainstream outlet, and its coverage was fair.
Open source, and the AI asymmetry. Researchers keep reaching for Moonshot's open-weight Kimi K3 because US frontier models refuse legitimate security work. Rob Hamilton's decentralized effort to pentest Bitcoin repos received grant funding during the show.

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(661)

Café Bitcoin | Slay Your Heroes, the Fourth Turning, and Certainty Lowers Your Guard | Day 17 of 50

Suze's Forbes piece, and the question under it. Her Telegram reporting found a persistent identifier that survives restarts, network changes and borders, with the credible risk being targeted surveill...

6 Aug 1h 25min

Café Bitcoin | Guy Swann and Yan Pritzker on Coldcard, the Asymmetry of Defense, and Privacy | Day 16 of 50

Guy Swan on learning the wrong lessons. The takeaway circulating is "go with the biggest company," which forgets Mt. Gox and FTX and everything else proving size is not safety. His analogy: when a lib...

5 Aug 1h 12min

Café Bitcoin | Self-Custody Is Not Dead, the Custody Spectrum, and Owning Is Not Operating | Day 15 of 50

Dice rolls are now confirmed safe. Portland HODL published a full verification, independently cross-checked by James O'Beirne, Block's engineering team and Rob Hamilton: the Coldcard did use dice entr...

4 Aug 1h 17min

Café Bitcoin | Coldcard Emergency: What Happened, Who's Affected, and What To Do Now

The event. A firmware flaw in Coldcard seed generation, disclosed the night before, let an attacker recompute private keys outright. By airtime, 594 Bitcoin, put at roughly $38 million on the show, ha...

31 Juli 5h 10min

Café Bitcoin | Day 8 of 50: Telegram's Device Fingerprint, Getting Debanked Over Three Letters, and Where Retail Went

Swan's Phillip Alexander and Brandon Quittem host Day 8 of 50 Days for Freedom: Telegram's auth key ID and the Russian server question; getting debanked for the word Bitcoin, from Wise to Bitcoin Pol...

30 Juli 1h 15min

Café Bitcoin | Day 7 of 50: Daniel Batten on Bitcoin and Energy, Britain's Curtailment Bill, and Wealth Is Energy

Cory was out for a family wedding, so Brady and Philip hosted from his handle. Also new: a weekly recap song in a different genre each week, covering everything from the previous weeks of the show. D...

29 Juli 1h 23min

Café Bitcoin | Day 6 of 50: Lawrence Lepard on the Big Print, the AI Credit Crack, and The Math Ain't Mathing

Lawrence Lepard on bear market psychology. Everyone is short-term, negative, and attacking each other over BIP110 and Saylor. His read: we are winning, this is the moment to get friends buying, and he...

28 Juli 1h 25min