#coldcard #hack #entropy #sad #CoinKite cannot come back from this. Even if they could rebuild the lost trust the company AND principals (due to negligence piercing the LLC/corporate protections) are going to be sued into oblivion. The only HONORABLE move @nvk and @coinkite can do is simple: They should FULLY make both the hardware and software 100% open source. This would allow the community to rescue the existing devices and project from being useless. This is also the most effective, if not only way for the people behind this debacle to regain a small amount of respect in the community. And... It is right. Not holding my breath... I assume the lawyers and liquidators will be running the show soon.

I run a little #nostr #relay on the other side of the earth from me. If you happen to be near Helsinki it might be a snappy one for you! relay.jmoose.rocks Feel free to use it. My logs are rotated and purged frequently.

One thing that may not be super evident yet is the legal tsunami that's coming for #Coinkite and #NVK and possibly even investors. (though I believe there is less risk there) If it were an American company, I believe protections offered by LLCs and Incorporation can be pierced in the case of criminal negligence. The evidence of this bug being reported to coinkite by multiple sources... customers, security analysts, and possibly even competitors is extremely damning and would make that criminal negligence easy to prove. I wonder if the principles are busy deleting things and virtually shredding documents, so to speak. I think if email records, for example, were entered into the court record, it could be exceedingly damning for both the company and the principal actors.

I am learning to tell myself something and to live by an idea. Sometimes you can really screw up. Sometimes you can do something that actually causes you deep regret. But I think that's gonna happen to almost anybody who's really living this life. But I have to allow myself to be forgiven, and forgive myself, and stand up and start swinging again. And even if I fall back down... same thing. Psalm 103 is one of the most powerful pieces of writing in the world for me. The whole thing is the most beautiful description of grace, but one verse stands out to me. "He has removed our sins as far from us as the east is from the west." What a beautiful way to say that He puts infinity between us and our sins.

I want to say this is an extreme take and it is really, but it sure resonates right now. At the same time, I want to know where the line is between scams, mistakes, grifters, even ones who don't know they're more or less one of those things and people just using a tool. You could say the same thing about who gets to drive a car or who gets to use a gun. In fact, people do. And I'm not sure if we're attacking the right thing or the wrong thing in a situation like this. But it is worth dedicating serious thought to. View quoted note →

Well, this is going into evidence. I wonder what the class action is going to look like. It's possible some good people get hurt. It'll be interesting to see how they handle the various influencers. Maybe not ones who just made a brief recommendation, but ones that had money going back and forth because of it. Oof. View quoted note →

I've been giving some thought to the theory that cold card could be something coordinated to try to scare people out of custody, etc., etc. It certainly could be possible, but I don't think I buy it. And here's why. 1. This is certainly one of the most massive negative things that the Bitcoin community has ever faced. But in the grand scale of things in the world today, it's anothet tempest in a teapot. (NOT downplaying the pain of people who lost their savings.) 2. Frankly, though cold card is responsible for this, so are all the people who used it. I'm not saying this in a victim-blaming way. I'm saying that the victims of this attack have all of us to be upset with because something this fundamentally awful should have been caught in code that everyone could see. 3. The idea that this has been going on for years and it has been known about is explainable in a lot of ways other than conspiracy. NVK has a habit of tossing away criticism and just immediately labeling anything negative as fud. And the community has always been ready to just lap that right up for the most part. It's very possible that the people who lost coins between 2021 and now have been people who are victims of a collision rather than an attacker. So it could be conspiracy and I think we should be watching as more of this unfolds. I think the Bitcoin community has been participating in some cult-like behaviors that have been negative for the adoption of Bitcoin and for the health of the people that are working on it and using it. I think good regular people did the "right things" according to the priests in the Bitcoin community and they got burned and this is the most tragic part of the whole thing. That pronouncement, that what they did were the right things. Sounds more like a bad religion to be than life I say the next thing I'm going to say a lot, but I mean it. And if this event is enough to significantly harm the trajectory of Bitcoin as a tool to help people be more free and sovereign, then Bitcoin was a failure the day the white paper came out. We just didn't know yet. I don't think that is the case. I think Bitcoin is a hopeful technology we can use to live better lives But I also think the best way to handle what's happened in our community is to realize what it is. It's a tool. It's not a club. It's not a faith. It's not a set of rules and it can be used for evil. It can be co-opted My heart hurts for the people hit by this thing.

I have been seeing #Sparrow wallet mentioned a lot for use in recovery and for ordinary users to download so they can move coins to a hot wallet, etc. First of all, let me say this is my favorite Bitcoin wallet. But it's actually very similar to the Coldcard in that it is an extremely complex piece of software. When you're making your wallet, you can choose derivation paths, for example. Sparrow really is for the passionate and the power users. Perhaps someone else knows a easier to use wallet that runs on Windows and Mac. Something like Blue Wallet may be good for a temporary hot wallet. @bluewallet

BlueWallet - Bitcoin Wallet for iOS and Android

BlueWallet - Bitcoin wallet and Lightning wallet for iOS and Android

Bitcoin wallet and Lightning wallet for iOS and Android focus on security and UX. Open source, Segwit and HD wallets, lightning network, plausible ...

@HODL not sure if you got this one yet or not in your list. View quoted note →

#coldcard #sad #rng With the number space being so small, it was probably just a matter of time before we would have seen collisions. I wonder if some of the reports of very early losses may have been collisions by someone who just won the lottery so to speak... kind of a terrible lottery for the other person.

#coldcard #hack #rng #sweep #privacy You know, the more I think about it, the more amazing I find it, that the people who most often told the so called plebs: "Don't Trust, Verify", were the people the plebs trusted most... and the ones who ultimately broke their trust. It is a tragedy in the truest sense of the word. 💔⛓️‍💥

#coldcard #hack #rng #sweep #privacy I have had another thought I want to share with whoever reads my thoughts. So we all know that the Coldcard addresses created by these deterministic private keys are being swept. The MK3 devices are already done being swept. And attackers have moved on to the slightly harder MK4 devices etc. I have a lot to say about this inevitable process but for this post... I know many of you are very adamant about privacy and may have even done utxo coin control and tried to acquire non KYC coins and so on... Well, you might as well make peace with the fact that your UTXOs are eventually going to be known even if you have already moved your coins to another wallet. Because the attackers will eventually find your wallet and see your history and all the UTXOs and everywhere they went, etc. So this stuff's going to all be cataloged and kept by black hats, white hats, and the rest. Once everything is settled and the smoke is cleared, you can work on anonymizing your UTXOs however you choose to do that in the future.