unit's avatar
unit count@nostrplebs.com 3 weeks ago
from CoinKite X Account To all Coinkite users and the entire Bitcoin community, To all Coinkite users and the entire Bitcoin community, I'm sorry and I'm devastated. Our team is heartbroken about yesterday's news. As a team that has dedicated our lives to securing the Bitcoin held by millions of individuals, businesses, and families, this is our core responsibility, and we fell short. If you know anyone who owns a Coldcard, please make sure they see this. Some affected users may not be watching social media right now, and every hour matters. We do not store customer information, and would appreciate all assistance in reaching affected users. If you generated a seed using a Coldcard wallet, move your funds now, using our updated best practices, before reading further. We take full accountability for the firmware bug and we offer our sincere apologies to those affected. We continue to work 24/7 to understand and fully scope the extent of the issue. What we're doing today: We've shipped a firmware hotfix that removes the software fallback path entirely. This protects new seeds going forward. It does not fix seeds that were already generated on vulnerable firmware. If your seed was generated before the fix, it needs to be individually migrated to a new seed. A firmware update alone cannot do that for you. We will publish a full technical writeup of how the bug entered the codebase and why our own review process didn't catch it once we've verified every detail. We would rather be accurate than fast on the technical postmortem, even though we know people want answers now. We will publish updates at
COINKITE Blog
COINKITE Blog
Stay up to date with Coinkite — COLDCARD, Opendime, Tapsigner, Blockclock. Firmware releases, security research, and Bitcoin cold storage.
 as we learn more. We do not have full attribution or scope of the issue yet, and we won't speculate until our full technical evaluation is complete. We are committed to working with affected users who want to pursue a police report, insurance claim, or their own investigation. We will provide a written incident summary specific to your loss and any transaction data we can share. We are cooperating fully with the on-chain investigators and any law enforcement agency that opens a case. We know an apology doesn't return anyone's funds. We know we'll have to earn back our users' trust. That starts with being open and telling the truth about how this happened. To every other developer: we believe this is a sober reality of the new AI paradigm. AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike. We started Coinkite because we believed in Bitcoin and in people's right to hold their own keys. We remain committed to doing everything going forward in the best interest of the Bitcoin project, the industry, and our users. nvk, coinkite

Replies (12)

Noshole's avatar
Noshole noshole@turdsoup.com 3 weeks ago
He actually thinks he can come back from this? “We’ll have to earn your trust back” That ain’t happening.
mister_monster's avatar
mister_monster 3 weeks ago
> full accountability I don't think that word means what they think it means. They're accountable? Proceeds to blame AI and then *shit on open source.*
StackSats.IO's avatar
StackSats.IO StackSatsIO@nostr.com.au 3 weeks ago
>We are committed to working with affected users who want to pursue a police report, insurance claim, or their own investigation. Wonder what their commitment is to dealing with customers who want to pursue a class action lawsuit?
1 replies ↓
Default avatar
npub1c2ap...s4hq 2 weeks ago
Bitcoin is truth and sometimes truth is painful to acknowledge. They lied about the physical product they sold. At minimum 8th and 9th commandments. They are admitting fault. Forgiveness is not just about confession but restitution. They say they want forgiveness which means they want both (even if their pride resists). So justice - to them, requires their victims to allow them the chance at restitution. In that sense a class action lawsuit is a moral imperative. This applies to those influencers who also serves as public paid salespeople. Especially if they espoused a philosophy that they had verified the product (the open source code in this case both enable and compels anyone who was paid by cold kite to verify if the influencer espoused it. And the flaw it seems was basic and sheer incompetence at the basic function). Many of these salespeople too have expressed fault and confessed for forgiveness ( they too need a chance to make restitution. Again justice for victims is messy but likely privacy for victims is best preserved by class actions). I am not a lawyer but I think shilling a physical product will not be protected from the usual “non financial advice” disclaimer. For example when Apple sells me a computer and I use it to buy a house and the house loses money, Apple isn’t responsible for my financial blunder. But if they sell me a computer and they and their paid endorsers communicate they have verified it’s not a bomb, but a high school level hack causes it to blow up my house, that wasn’t “financial advice” that went awry-> it was a criminal sale. I feel bad for those who were victimized. Again not a lawyer but I suspect class action lawsuits - as clumsy and frankly bad as they are - will serve a moral purpose to allow justice and healing on both sides. And while they are clumsy they may be more effective in these cases because most of the victimizers are public figures who have no idea how invasive the process Of discovery is going to be, especially since I bet a lot of them just engaged in a lot of on chain activity; and will probably prefer to settle than go through discovery which may reveal a lot more innocent but technically criminal activity they did as part of routine coin operations that would never otherwise hurt anyone or come to light.
↑