Tomas Susanka retweeted
Exploring Trezor Safe 7 with @tsusanka 👉 youtube.com/watch?v=pPUHiu5o…
Two secure elements with unique properties: one NDA-free EAL6+ and, the other, the world’s first open source secure element.
How does the Trezor Safe 7 compare to the older models? @joegrand comments.
Tomas Susanka retweeted
Trezor stands firmly behind responsible disclosure. By working together, we can keep raising the bar for security, protect users, and share what we learn to make the whole ecosystem stronger.
📌 AI made finding bugs cheap, but it didn’t make responsible disclosure optional.
Finding and exploiting vulnerabilities has never been easier. A few hours of prompting now does what used to take a skilled researcher weeks. Unfortunately, defenders no longer enjoy the asymmetry they relied on. Security is still a cat-and-mouse game, but with many more cats, the user suffers.
Which is exactly why the process around disclosure matters more than ever.
How it works, and it is not complicated:
➤ A researcher finds a bug and contacts the vendor privately.
➤ The vendor reproduces, acknowledges, and both sides agree on a timeline. 90 days is the common default, more or less depending on severity, capacity to fix...
➤ During that window both sides keep it secret while the vendor fixes and ships.
➤ Once users are protected, both sides publish. The ecosystem learns. The researcher usually gets paid.
The issue now is the barrier is so low that anyone can surface a finding with no security background, and some skip straight to the audience:
❗Presenting a reproduction of an already-fixed bug as a live compromise.
❗Full disclosure of a bug that is not fixed yet.
❗"Critical vulnerability found" teasers, dripping details for engagement.
Call it what it is: attention farming with someone else's risk. When the bug sits between a user and their funds, this is reckless. Especially in crypto, where there is no chargeback. But the damage doesn't require live funds to be at stake. Manufactured panic causes harm of its own, because it drives people away from self-custody, and that damages the whole ecosystem.
So I have three asks:
1️⃣ For users: software and hardware have bugs, always. The single most effective thing you can do is stay updated and follow basic security hygiene. That has never mattered more than today. The time between releases and malicious actors exploiting the vulnerabilities have shrunk dramatically due to LLMs and that one can't afford to be passive and postpone security updates any more
2️⃣ For new researchers with a fresh model and a real, validated finding: welcome, we need you. Use the vendor's disclosure process. That is not bureaucracy. It is the difference between making the ecosystem safer and putting users in the crosshairs for a few likes. Remember that security communication must be accurate and proportionate. State the severity, affected versions, and fix status in the first sentence, not the tenth.
3️⃣ And to everyone building in this industry, vendors and researchers alike: let's make coordinated disclosure the norm we defend out loud, not the fine print. Reward the researchers who do it right. Refuse to amplify the ones who trade user safety for reach. This is how we win, together.
Some of the actors already support the initiative. @Ledger @Trezor @FoundationHQ @AnchorWatch @_SEAL_Org and others
Spread the message.
Tomas Susanka retweeted
It's been a rough couple weeks for self custody.
Thank you to everyone for joining and taking my question.
@zherbert of @FoundationHQ
@tsusanka of @Trezor
@Drewfischer of @BlockstreamJade
@sesi_the_man of @SeedSigner
Plus @theBTCmentor for hosting.
youtu.be/zolz8EI6eYc?si=NVHR…
Tomas Susanka retweeted
Trezor's CTO on the Cold Card Hack: Randomness, Trust, and What Comes Next
Ep. 153 with @tsusanka
Tomáš Sušánka is the CTO of @Trezor, where he has worked since 2017. Tomáš joins Efrat for an urgent, unscripted conversation days after the Cold Card hardware wallet hack, in which a flawed random number generator left seed phrases vulnerable and resulted in more than 1,500 bitcoin stolen from affected users. Drawing on questions submitted directly by the Bitcoin community, Tomáš walks through what entropy actually is, how Trezor's own four-source random number generation works, why open-source visibility alone does not guarantee security, and what practical steps everyday self-custody users can take to reduce how much they have to trust any single piece of hardware.
→ Please like, comment, share & subscribe, to help me beat the suppressing algo's. Thank you!
00:00 - Introduction: Tomáš Sušánka, Trezor CTO
02:39 - What Happened with Cold Card: How Trezor Received the News
09:17 - Origins of Cold Card: Forks, Licensing, and the Bitcoin-Only Split
13:40 - Open Source vs. Source-Available: How the Bug Went Undetected for Five Years
20:20 - Trezor's Response: Security Reviews and R&D Changes Since the Incident
22:24 - How Trezor Generates Randomness: The Four Entropy Sources
23:29 - Dice Rolling for Seed Generation: Necessary?
28:30 - Reducing Trust: Practical Verification Steps
31:09 - Single Device vs. Multisig
32:45 - @BTCsessions Clip: Ben and @theBTCmentor on Air-Gapped Wallets
34:29 - Tomáš's Take: Why Air-Gapping Isn't What People Think
39:49 - How Trezor's Design Differs from Cold Card's
42:32 - 2026 Secure Element Laser Fault Injection Finding
47:46 - Responsible Disclosure: Trezor's Protocol for Reporting Vulnerabilities
49:29 - The Biggest Risks Facing Bitcoin Right Now
51:01 - Short-Term Damage vs. Long-Term Lessons for the Community
55:27 - Trezor Model One's 12th Anniversary and the Evolution of Hardware Wallets
57:57 - Closing Thoughts and a Call for Continued Security Research
Multiple entropy sources are only worth something if the code actually uses them. You can have four different sources of randomness in the device, but if it is using a test generator instead (code bug), none of those sources actually matter. Rolling dices doesn’t imply the device will actually use it. The entropy is not the problem here, the problem is the device not using it.
We already explained that Trezor does not use the affected code. Here are some examples of what we are already doing to make sure we do not accidentally bundle in testing RNG (random number generator):
👉 We do not use MicroPython's random module at all. It is disabled outright in our firmware config [1].
👉 rng_fill_buffer() reads the STM32 TRNG peripheral registers directly. No macro dispatch, no software path to fall through to [2].
👉 The software PRNG lives in a file literally named "crypto/rand_insecure.c", and compiling it emits "NOT SUITABLE FOR PRODUCTION USE!" warning [3].
👉 random.reseed() exists only under ifdef TREZOR_EMULATOR, and the C function behind it only under USE_INSECURE_PRNG. Two independent guards, and no reseed API in production firmware at all [4].
👉 rng_fill_buffer_strong() fills from the MCU TRNG, then XORs every byte with Optiga output (Safe 3, Safe 5) and, on Safe 7, Tropic output on top. If a secure element fails it returns false and the caller raises RuntimeError. Fail-closed, not fail-quiet on models with a secure element [5].
👉 Our Entropy check makes sure that the host’s (computer/phone) RNG is mixed in as an extra failsafe [6].
These are just some examples of how we protect from this kind of failure. That being said we never stop building and we always humbly learn from situations like these. So we are carefully studying what lessons can be learned from this incident and we are already drafting more safeguards on top [7].
You don’t have to trust me on this, our code is open-source and you can see for yourself or use your favorite AI model. See the links below. And don’t forget to ask your wallet if they can do the same…
[1] github.com/trezor/trezor-fir…
[2] github.com/trezor/trezor-fir…
[3] github.com/trezor/trezor-fir…
[4] github.com/trezor/trezor-fir…
[5] github.com/trezor/trezor-fir…
[6] trezor.io/learn/security-pri…
[7] github.com/trezor/trezor-fir…
Randomness is the foundation everything else in a hardware wallet stands on. Get it wrong and nothing else matters. Not the secure element, not the air-gap, not the metal backup.
Weak entropy during initialization = funds drained "remotely." No device access needed, attacker just recomputes your keys. It's the single most critical path in a hardware wallet, and we treated it that way from the very first Trezor Model One (just turned 12 years old!) by mixing device entropy with entropy from the host (computer or phone). Never trust one source. We deliberately designed it this way from the very beginning.
The nightmare scenario is that test mode with weak randomness is shipped by accident. People think their wallet generated something truly random but it didn't. Anyone who knows the pattern can work backward and recreate their private keys and AI is definitely speeding this up. We run dedicated safeguards to make sure that can never happen in our builds.
Trezor Model One and Model T mixed two entropy sources together (from MCU and from the host). With Trezor Safe 3 we took this further and added Optiga as an independent entropy source. Safe 7 mixes four: MCU, host, Optiga, TROPIC01. On all models this results to 128-bit entropy in default settings. On top of that, we also introduced Entropy Check back in February 2025.
From a different angle: Let's finally retire the myth about air-gap. Air-gap doesn’t necessarily imply stronger security. With air-gapped wallets you miss this entropy from the host. If the randomness is not sufficient and keys are predictable, the attacker never needs to touch your hardware.
Tomas Susanka retweeted
Trezor users: your funds are safe.
The recent Coldcard issue is limited to their own custom firmware and how some of their devices generated randomness. Trezor does not share that code.
We have always mixed multiple independent sources of randomness together (device hardware + host + secure elements on newer models).
We are truly sorry for everyone who has lost bitcoin.
Stay safe.
Read more on how Trezor generates entropy here: trezor.io/guides/trezor-devi…
Tomas Susanka retweeted
I've been using Kimi K3 for ~16 hours now.
The model is clearly good at a lot of different things (especially frontend), but non obvious reason why people are enjoying it so much is that it clearly does not follow the same rules in terms of safeguards and copyright.
Kimi will happily clone MacOSX. If you ask it to help you improve another AI model, it will do it with a smile on its virtual face.
Ask Fable to do the same thing? It literally starts to perceive you as a criminal committing a war crime (like no bro, all I want to do is fine tune an open source model).
After using all three recent releases, Fable, GPT 5.6, and now Kimi, it's clear that the full power of the models has been significantly held back by the safeguard restrictions caused by last months debacle with the USG -- leading to the top models being quite literally lobotomized in some areas, which leads to subpar results as the safeguards pollute its entire thinking and problem solving abilities.
The funny part? Is that you could have predicted this outcome 2-3 years ago when you started to see the rise of Chinese EVs and smartphones compared to western alternatives.
They quite literally tried to copy the Tesla Model S and iPhone as hard as possible and then eventually it started to diverge to the point where their EVs and phones are just genuinely better (which is why we have export controls banning their EVs, because they would literally drive all US manufacturers to ZERO)
There is a very clear behavior difference in Chinese capitalism and American capitalism.
American capitalism tries to protects copyright, patents, etc (oh no, you can't download a book through LibGen, that's ILLEGAL!).
Versus Chinese capitalism actually just does not give a fuck.
"Hey you want a video gen model (Seeddance 2.5) trained on every single anime ever? And you want the main character to look exactly like Messi? Sure, here you go!"
You see what I mean? When one half of the competition is being held up by regulators and restrictions on people who don't understand the technology and the other half has a leader who quite literally today said they are going to set up AI centers around the world to help other countries onboard to their open-source AIs, this is the sort of results that you will start to get.
These models were not smart enough to have this difference in philosophy matter -- but the newest class of models is where this difference makes a big deal. If these models are finally at the point where they are smarter than 99% of humans, why would you want to use the American one who tries to impose its world view onto you versus the Chinese one who will just do what you say without asking any questions?
And this isn't a full on bullpost on Kimi, the model is clearly not as smart as Fable / GPT 5.6 on things like math and science, but it's lack of handcuffs means that it can show the world what the frontier labs are gatekeeping from you and that starts to build customer resentment and loyalty towards the East, which is probably not what the USG wants.
Interesting times. Interesting times, indeed.
It finally finished, here's the final output. Used 60% of my monthly Kimi usage on it
macos27.kimi.page
Tomas Susanka retweeted
Why 0.01 Bitcoin Is The New $1,000,000?
Quantum computers can't crack Bitcoin today, so why is @Trezor 's CTO telling the industry to prepare anyway? 👇
Speaking at BTC Prague 2026, Tomáš Sušánka @tsusanka makes the case for quantum-resistant Bitcoin without the fear mongering. Qubit counts have climbed from 5 to over 1,100 since 2016, multiple hardware approaches are now in serious development, and two new papers suggest breaking Bitcoin's cryptography may take far fewer qubits than the 8 to 10 million once assumed, with one estimate as low as 10,000. He works through the strongest counterarguments one by one, then lands on the real issue: this is an asymmetric risk, the same logic that makes you wear a seatbelt. Sušánka doesn't expect a relevant quantum computer within 10 years, but with roughly 6 to 7 million BTC already exposed, he argues Bitcoin should adopt post-quantum addresses now, out of precaution rather than fear.
Silent Swap is a clipboard hijacker. It sits quietly in the background, spots when you copy a crypto address, and swaps in the hacker's address before you paste. So you think you're sending to a known contact but you're actually paying a hacker. It hides sneakily inside a fake 'Google Notes' browser extension and the attack itself is simple. It corrupts what your screen shows you at the moment you send.
This is why you can't fully trust a device that connects to the internet. Your computer can be compromised without you knowing, and the malware doesn't even need your keys, it just needs to control what you see. A hardware wallet is never connected to the internet. The real destination address appears on the hardware wallet's own screen, so if it's been swapped, you can see the mismatch and catch it before you confirm.
But it only works if you check. The hardware wallet gives you the chance to catch this, it doesn't remove your part in catching it. Read the full address on the hardware wallet's screen before you approve, don't just glance and click. And the basics still apply to everyone. Never install cracked software, and treat unfamiliar browser extensions with suspicion.
🚨 WARNING: A highly sophisticated new crypto malware dubbed "Silent Swap" is targeting holders of $BTC, $ETH, and $XRP! dlvr.it/TTJdDx
That's a wrap on BTC Prague 2026 🇨🇿⚡
Three days here in Prague, full of great talks and great people. See you next year everyone!
Tomas Susanka retweeted
One of the things I am most proud of, but least talked about is the great work @JosefTetek is doing with @TrezorAcademy.
This documentary is exemplary for the hard work done on the ground to educate around bitcoin in the places where it is needed most.
Coming soon!
Seeding Bitcoin: Trezor Academy and Africa's bitcoin revolution
A documentary by @TrezorAcademy, powered by @Trezor
Public launch of the documentary at the end of June, conf screenings at @BTCPrague & @btcnairobi_conf!
Claude Fable was released few hours ago and there is already a new top result at ecdsa.fail 🤯
How close is the quantum threat to crypto, and what do we need to do to prepare?
We shot a quick FAQ answering users' top questions. Perfect background listening if you're doing some chores today!
youtube.com/watch?v=AVE63PdY…
Tomas Susanka retweeted
I'm fascinated with Durov's technique of multi-layered deception. It reminds me of the techniques used by scammers, politicians, and flim-flam artists of all kinds. If you pack half a dozen lies into every message, it becomes impractical for truth-seekers to untangle it. ⤵️
I do agree with this but at the same time I just wouldn't underestimate how long it can take to agree on something and execute in a decentralize network such as Bitcoin.
"anyone who is worried that quantum is affecting the security of blockchains is wrong" ~@danboneh
Blind signing is becoming a thing of the past. What you see is what you sign. Great to be working with @ethereumfndn and the coalition making it happen.
