Moving completely from Apple and Google to Proton was a bit of work but so worth it!
Anyone got a fix for Google Pay in GrapheneOS on a Pixel?
It might not be inflation and debasement that will cause a bitcoin mega cycle…. It will probably be AI and cybersecurity concerns
SB retweeted
Jack, Bitcoin Core shipped a wallet deletion bug last year. Versions 30.0 and 30.1 had a migration failure that could delete your entire wallet directory. The binaries were pulled from bitcoincore(dot)org. After that, Core 31.0 shipped a private broadcast feature that leaked your IP address to any malicious peer who forced a v1 retry. The stated privacy guarantee was that recipients would never know your IP. It was broken on release.
This is not a new pattern. CVE-2018-17144 was an inflation bug that sat in production for 18 months. A miner could have created Bitcoin out of thin air, in violation of the 21 million cap. It was never exploited, but not because the process caught it. A high-severity consensus bug, CVE-2024-52911, was fixed in Core 29.0 and publicly disclosed in May of this year.
The governance structure that produces these bugs is not incidental. Our quantitative analysis of 25,122 Core PRs shows that 25.5% of maintainer-merged PRs are self-merges. Three people control 81.1% of all merges in the repository's history. Since 2022, one maintainer accounts for roughly half. The "arsonist and fireman" pattern is documented: same contributor introduces a bug and authors the fix, independent verification bypassed.
When roughly 99% of Bitcoin nodes run one implementation lineage, that is the attack surface. Every bug in that codebase is a systemic Bitcoin risk, not a software bug with a narrow blast radius.
You said Strategy and Strike have incentives to keep Core safe. Here is the actual structure. Five people hold commit access to Bitcoin Core. They are employees and grantees of a small set of institutions whose founders and funders circulate among each other and have direct financial interests in specific protocol directions. Bitcoin was designed to eliminate trusted third parties. Its reference implementation is controlled by them. The people with the most to lose have every incentive to keep that quiet, because the narrative that Bitcoin infrastructure is sound is load-bearing for their business models.
Hardware wallet failures are real. But you told people to just buy a laptop and run Bitcoin Core on it. Windows and macOS both ship zero-days on a regular cadence, Microsoft has a decades-long pattern of bundling attack surface directly into the OS, and your browser runs in the same process space as your wallet. Whatever hardware security a laptop has is built for OS integrity and disk encryption, not for Bitcoin key isolation. A hardware wallet exists precisely to take your keys off that machine entirely, into a purpose-built environment with no network exposure and no shared process space. Telling people to abandon that for a laptop running Core is not a security upgrade. It is a step backward dressed up as one.
I am completely allocated to Bitcoin. I have spent 12 months and significant capital building the quantitative and governance case for implementation diversity as Bitcoin's ideal security posture. No one has engaged with the risks and incentives of this space more rigorously than this work has. I am not bragging. I am begging. The data is there. The argument is there. If you actually care about Bitcoin, prove it. Engage with it.
SB retweeted
Simon Gerovich, Dylan LeClair, David Bailey and Eric Trump all got paid in Metaplanet stock to sell you Metaplanet stock. The company minted 273M executive shares while 250k shareholders lost 90%.
SB retweeted
Weil viele gerade fragen:
Auf den ersten Blick scheint es so, als könnte der Mailanbieter @brevo_official , den viele Services nutzen, gehackt worden sein.
Dadurch konnten die gefälschten Mails offenbar von den echten Absenderadressen verschickt werden. Das bedeutet nach aktuellem Stand aber nicht, dass Trezor oder BitBox selbst gehackt wurden.
Vereinfacht gesagt konnten die Angreifer über den kompromittierten Newsletter-Dienstleister gefälschte Newsletter an echte Newsletter-Abonnenten verschicken. Die eigentlichen Systeme und Kundendaten der jeweiligen Anbieter dürften davon sehr wahrscheinlich nicht betroffen sein.
Wie gesagt, die Teams arbeiten bereits mit Hochdruck an der Prüfung und sobald es genauere Ergebnisse gibt, teilen wir euch diese natürlich umgehend mit. Aktuell gibt es aber erst mal keinen Grund zur Sorge.
ACHTUNG, WARNUNG 🚨
Gerade kursieren EXTREM GUT GEFÄLSCHTE Mails von @Trezor und @BitBoxSwiss die auf eine angebliche Schwachstelle hinweisen.
Seid sehr vorsichtig und gebt auf keinen Fall eure 12/24 Wörter irgendwo ein und klickt auch abgesehen davon am besten nichts an.
Sobald es mehr Infos gibt, melden wir uns wieder.
SB retweeted
⚠️ WARNING: BITBOX AND TREZOR PHISHING
A phishing email is currently circulating that claims to be from BitBox or Trezor and warns about an allegedly faulty Random Number Generator (RNG).
This email is FAKE.
❌ Do not click any links.
❌ Do not download any files.
❌ Above all: Never enter your seed phrase on a website.
The major danger is not a supercomputer guessing your seed. It is a configuration or backup mistake 🤷🏼♂️
SB retweeted
⚠️IMPORTANT⚠️In the next couple of days, a new shitcoin will fork off Bitcoin. It is a big security risk for people who just believe they will get an "airdrop" and want to sell it, to get more bitcoin.
I will write more about it, but here is the TLDR: 👇
SB retweeted
Some more verification that Coinkite's cofounder DocHex (Peter Gray) is the same person as the nym switck who contributed the code for libngu.
This code change is at the center of the entire Coldcard RNG bug.
On Clarity.fm clarity.fm/petergray where you can pay Peter for his time, Peter verified his phone number which ends in "44"
This same phone number ending in "44" is tied to both DocHex's and switck's X accounts.
The odds of sharing the same last two digits of a phone number is 1%.
Combined with @jamesob detailed gist and findings that DocHex's GPG key signed 61 switck commits – I think it is conclusive now that they are the same person.
I haven't told the full story yet, but I came to the same conclusion back in May 2025 when I started doing an audit of `coldcard/firmware`.
I wanted to figure out conclusively where the CC RNG was getting sourced from, and found that it backed up to some shady library called libngu (github.com/switck/libngu) that had literally 6 stars on github and was maintained solely by a pseudoanon tranny.
I knew from past experience that linking to libsecp256k1 from Python was pretty easy, which seemed to be the stated purpose of the library use, and so I was confused about why it was there.
I sent a report to the CC team that I had doubts about whether the true RNG was actually in use, and pointed out that the hardcoded yasmarang constants in libngu were sloppy. I advised they rip the whole thing out and link against libsecp256k1 directly.
I was told that if something was wrong "we'd already know about it by now" and that everything was properly configured for the real boards.
I didn't follow up rigorously, which was a horrible mistake on my part.
SB retweeted
Anyone want to bet a hardware wallet will exit scam within the next 5 years?
Probably by blaming an accidental bug or rogue employee.
Basically exactly like an exchange, but this time a hardware wallet.
SB retweeted
DICE ROLLS DO NOT PROTECT EVERY COLDCARD FEATURE
Even if your seed phrase is safe because you generated it with dice rolls or imported an existing seed, several Coldcard features may still be vulnerable due to the Yasmarang PRNG flaw.
Affected features include:
• Paper wallets
• Device cloning
• USB sessions
• Secret Teleport
• Co-signing keys
• Password generator
• HSM mode
The seed itself remains secure if it was imported or generated with sufficient dice rolls, but using these features can still expose secrets generated by the flawed random number generator.
