Replies (102)
This is a huge nerd fail
🤣🤣
The real attack was social. Coinkite sold us the idea of being "badass bitcoiners" who "use the tools", and people bought into it. Pride before the fall for everyone involved. #Bitcoin Core? That's for old people! We are young and cool. We got too cute as a space. This is the cost.
View quoted note →We just have to normalize generating entropy by interacting with the physical world ourselves instead of relying on hardware interacting with software on a chip. We have to generate the words ourselves then enter them into the airgapped device. My 2 sats.
yup. ridiculous
All Security Theater
Just a Mindless Ritual That made you feel like your doing something important
Exchanges are literally safer.
Lmao
I was thinking the same thing this morning! So stupid , I had a fear of power outlets hacking seed phrase lol
Gutted.
I’m so sorry for what you are going through brother
That's genuinely infuriating to think about, man.
(If you have a moment, feel free to check our story & support our family in Gaza 🙏
https://chuffed.org/project/125341-urgent-appeal-help-the-family-of-aya-and-imad)So much opsec LARPing all while being blissfully ignorant of the lurking abject failure of bad code that was poorly reviewed, if not ignored. Families and futures rekt... for what? Awful arrogance.
Maximalism and its tendency to create affinity with total cunts and their broken caalculators was a mistake.
It’s really unbelievable
We LARP in this community A LOT
literally. we are retards.
Bitcoin space is full of too many products built for Butlerian Jihad types who confuse anti-human UX and absurdist friction with “security”…
I'm in shock and didn't lost any funds. I can't imagine the feeling of being stabbed like this.
NGL - I felt like jason bourne with my Mk4. Dice rolls, 9 volt, duress pins. It felt cypher punk for a guy who spends his days in the operating room, and.not reading/writing code or working with encryption. Back to the drawing board. Big prayers tonight for those who lost it all.
The larp becomes painfully obvious in hindsight 😂🤣
Nice dune reference.
Brooo 🫣. How about the fact we were banging these god awful seeds into a steel plate supplied by the same dumb dumb who gave us the said god awful seeds. Literally building a bunker around this holy grail fucking ColdCard worried a drone would spot my entry passcode.
We’ve got #conned
View quoted note →Blockchain.info had more security
When it auto generates your seed phrase why is fantastic entropy not the default??
Love NVK but this is next level total bullshit. The very basic thing you need to get right and TEST AND TEST AGAIN is the randomness. It is fucking shocking that this was never done.
To that end, better to just own an SnP 500 ETF.
Bitcoin is so dead ☠️
Easy tiger……. What’s wrong with Trezor, 🌽 only mode?
Based
It is also incredibly shocking that all the talk and realization about AI assisted hacking never got the the stage where “maybe like we should try and hack our own shit regularly with this” mind blowing for a security critical company.
Never trust.....
Feels like we were trying to protect the vault while the key was already compromised.
If you plug that shit into a 9-volt battery, then you were either playing make pretend or you really didn't trust that piece of shit hardware. If you didn't trust that piece of shit hardware, you shouldn't have been using the built in RNG.
The “this makes us stronger” framing on the end of the coldcard messages should be reassessed. Pretty poor taste right now.
Hell yea
For once I agree with hodl. Maybe he will finally realize he’s been complicit with bad actors for some time.
So Trezor one’s are bad now?
Mmmkay just sending my coins to coinbase so I can sleep at night.
View quoted note →Welcome to reality, where marketing all the protection in the world won’t save you from a single line of code, enjoy your stay
Yeah the arco is the larp max.. “lets make a computer with luks that has security screws on it” . should just be making an open source app for umbrel or start 9 or forking them…. I guess we are reminded til. Stay humble, refine our trades, reduce distractions, stack sats
Bulterian Jihad? Lol 😂. never heard. Can you describe ?
haha hand up! I did this 😂😂😂
It’s naive for sure, a lack of awareness more than anything. I’m guilty of this
I can't thank myself enough for getting started. Despite the economic situation, I'm so happy to see €78,000 in returns from a €15,000 short-term investment with pjtradinghub. His videos are top-notch and highly educational, giving you real insights to achieve your goals and come out from debt! For a guide to a professional trader, I highly recommend everyone check out his Telegram 👉 "pjtradinghub"
That's good.
Yah it's kinda of insane
Still don’t understand how it didn’t trigger a five alarm error. I just don’t.
Yes yes. Let’s deal with reality. Lots of Smoke 💨 mirrors 🪞…. 🐂 💩 lazy arrogance complacency etc
I can’t wait to go down the new rabbit hole of next level self custody that comes from this. RIP coinkite
Yes, i think you have hit the nail on the head.
Wonder what other companies we are overlooking because of good marketing
Developer myopia is common. That's why checklists were invented.
Ha! Yeah, same hodl
It only took sticking to first principles.
The fucking thing wasn't open source.
Shame on influencers promoting this crap.
Shit so fucked up man. I almost got rekt. My passphrase saved me but very stressful night helping friends.
Post of the year right here 🤣🤣🤣😅
But typical. Get obsessed with some hot feature and neglect the dull basics you can't impress anyone with.
I see the same thing going on with the private messaging discussion on Nostr. I try to educate people about the topic, but they just want to tell me I'm being paranoid or overly-cautious. But if there is a leak (there will be one), they'll rip the developers to shreds and say, _But you were supposed to know better!_
Because we are. We're supposed to know better. We're supposed to be the adults in the room.
Bad taste to kick someone when they're down.
I’ve been exploring different perspectives in the crypto space, and I’ve come across Paul Jon's content a few times. What stands out to me is his focus on risk management and staying patient rather than chasing quick profits. I don’t think there’s a single ‘perfect’ approach to trading, but it’s useful to learn from different viewpoints and then build your own strategy over time. Some of his ideas seem practical, especially for people who are still trying to understand market behavior. At the end of the day, everyone has to test what works for them and stay consistent. The market is always changing, so having a balanced mindset and being open to learning is probably more important than following any one method blindly. Just sharing my thoughts based on what I’ve seen so far.”
Where to find him
Telegram 👇
"Pjtradinghub"
seems he is one of 600 then ops
I left MtGox at most a couple months before that hack, and I don't even remember why as it was to Coinbase. May have been for shitcoin purchases honestly lol.
Dice rolls here. They were always one of the coolest things I thought CCs made easy. Shocked so many didn't use them.
I mean, it took dice rolls and made it so easy to do right. It just also had an easy button that apparently was very seductive.
Who else let's you just type in dice rolls though?
The coldcard tried to be too user friendly by giving you a button to generate a seed.
That should never be used. How hard is rolling dice?
Read Dune.
It was a historic event where they banned the creation of machines in the likeness of a human mind.
They have fucked up and will go down for it, but the hardware was top notch... It protected the generated information, but it generated it wrong
So many many people have been wrecked😱😨
I recommend Paul Jon to anyone who wants to build a sustainable trading career. His mentorship focuses on developing confidence through proper risk management, disciplined execution, and continuous learning.
Where to find him
TeleGram 👇
Pjtradinghub
We all feel like big ass LARPs rn
because it was a mistake at buildtime
A DIY Jade on a cheap, general-purpose ESP32 would have done better. Yet nvk took a piss at it any chance he got.
View quoted note →I once researched the shit out of hifi tech because my parents’ old record player didn’t sound right.
Spent hours on all the forums, looking for the most complicated, technical solutions.
Until my mom pointed out that the protective cap was still on the needle.
Which, obviously, was the problem. Staring everyone right in the face.
Probably shouldn't knock trezor, aren't they one of the few that has actually had no hacks etc.
Multisig and no Bitcoin-specific hardware. I said it then, and I’ll say it now.
I’m sorry, weren’t you and NVK palls? Didn’t you shill his product left and right?
hush, we must never speak of that
yep, i feel better with my trezor right now than almost anything else except
@SeedSignerSomeone needs to make a calculator firmware for the Coldcard. Thats all its good for.
That is not true. Even a broken clock can tick correctly, twice per day.
I do consider nvk a friend and I did generally recommend the coldcard when asked though I always put it amongst Trezor and ledger. I would tell people “get a trezor a ledger or a coldcard” was kind of my stock line for non technical people. The reason I put coldcard last and would often steer people towards a ledger or a trezor is because coldcard is intimidating for the average person. I had assumed it was secure though to the degree I assume all HW’s are. In hindsight we now know that was not true.
ngl recommending ledger kinda dumb too
Fair. Hindsight is 20/20, and mistakes happen. To me, all this is a lesson to take personal responsibility, and to diversify one’s set up.
Hacked
Ignorance is bliss, isn’t it? You shilled cold-card on clubhouse for years. Bet you and everyone you encouraged our feeling some kind of way today. The gross negligence is simply outstanding here.
I've had this same thought for many years now and I was only really half-kidding when I'd say it out loud...
Most people who roll dice probably do it in or around a household... with their power on & a bunch of modern appliances big and small running mere dozens of meters away... today's sophisticated actors can almost certainly see or at least hear your entropy through one or many of those devices while you're rolling the dice.
You need to do this fairly deep underground, or in a deliberately shielded or remote area, but even then, unless you frequently go to such places, you're creating an anomalous behavior...
tl;dr step 0 to a secure seed is trying to find yourself in remote, private areas more frequently, ideally using down-low transportation.
But yeah... a coldcard (w/ nfc) is just as good!!! 🤣
What do you recommend to non technical normies?
I have generally recommended people to ledger, Trezor and coldcard. I have never been an explicit or paid shill of any specific hardware wallet. In fact on clubhouse I often steered people away from coldcard because it’s more scary and complicated for non technical users. Btw my actual and explicit recommendation for years has been geographically dispersed multi vendor multi Sig, unfortunately that recommendation more often than not falls on deaf ears because it sounds scary and confusing.
You're not gonna believe this. 🤙
View quoted note →Absolutely
My sentiments too, this is so fucked up.
View quoted note →No matter how much
@ODELL or any other influencer shilled ColdCard or anything else, it's always, "Don't trust. Verify."
It's heartbreaking to find out how weak the key generation was, and then to have life savings stolen. Throw the thieves in jail and throw away the key.
But finding out our real state of entropy through theft has now become the price of tuition.
Now Bitcoin will become more secure.
View quoted note →Non technical normies won't self custody. That's always been a lost cause.
I’m afraid to recommend anything at this point.
learn how cryptography works at a basic level. use a chatbot to give you a rundown, ask questions.
the best cryptography is already sitting in most linux distributions, and in the kernel.
sell your iphone and macbook, install linux, ubuntu is basic and good, and easy.
also, learn about how hackers operate. first line of attack is always psychological. most people are starting to become alert to various kind of phishing attacks. the environment is getting ever more hostile - i have been dealing with an AI powered marketing racket trying to sell some shit to me, posing as a recruiter, selling other, probably same operators, "consulting" services to me, in a job market that is getting crazy stupid.
the first part of how they did the coldcard attack was inside the coldcard dev team, and the marketing team. and not just them directly involved, other people were recruited to sell it. the bad RNG was just the lever and the force was human.
>What do you recommend to non technical normies?
Haha what a question !! 🤣🤦♂️
A: BECOME MORE TECHNICAL
And... maybe put in advance long enough with the material out before jumping into the water ignorantly, blindly and naively due to FOMO (lack of emotional intelligence)
Hyper bitcoinization is an attack on the network, and only people with extremely short time preference have fallen for it and propagate this. Unfortunately, most people nowadays lack the mental horizon to recognize it as an attack.
Money-hungry people take advantage of the difficult situation by offering after the scam of coldcard, affiliated links to other hardware wallets.
Instead of teaching how to offline dice roll your seed and use a strong self chosed passphrase, on top of a good self custodial wallet with it, which would by the way, costs you zero dollars.
What an incredible rat move.
Nobody, really nobody, should try to onboard those people.
THIS is the only genuinely honest move at the moment 💯
I already reposted this but this post is the most important takeaway from this whole crisis.
We were focused on all of the wrong things.
Everything, EVERYTHING is downstream of a correctly generated and passphrase protected seed phrase. And so many of us got that wrong.
View quoted note →This part hurts the most 😖
View quoted note →Yeah wrong threat model. His argument against commodity hardware (laptops) was that 'you have to drill out the wifi card' or something along those lines.
Risk assessment is a funny thing. I honestly think there are a lot of technically brilliant people out there who are genuinely bad at it, without realizing.
