Founder & Lead Researcher, immersible | RWA Tokenization · Stablecoins | Publisher, Signal Before Narrative
Joined March 2011
- Tweets515
- Following1.5K
- Followers264
- Likes454
$70M in BTC left 1,196 wallets in 41 minutes on 30 July.
Nothing was hacked.
The keys were guessable the day they were made. A build flag set to zero, shipped March 2021, live for ~1,900 days.
Thread on what this actually means. 🧵
Custody assurance tests perimeter, operations, ceremony documentation and signing policy.
It does not test whether keys were random when they were made.
That gap is about to sit underneath tokenized treasuries, funds and stablecoin reserves.
If you hold on an affected device, go to the vendor advisory, not to threads. Fixed firmware is out, updating does not repair an existing seed, and 50+ private dice rolls at generation time means you were never exposed to this. blog.coinkite.com/coldcard-m…
The blast radius is wider than seeds.
The same stream fed paper-wallet private keys, random seed-XOR masks, device cloning and USB session keys, key transfer material, 2FA secrets and generated passwords.
One weak source, many consumers.
