The longest chain remains #Bitcoin Core. Luke has been denied the keys to the kingdom. The automated pressure campaign has failed. Knots/#BIP110 is dying. Nature is healing. 🍃

BIP-110 Fork Topology

Live BIP-110 fork topology: standard vs BIP-110 chain tips and signaling.

Hey @Luke Dashjr what's the ticker going to be for the #bip110 token?

Once the current thing moves on, everything before it is lost.

Congrats with your airdrop #bip110. Or sorry that happened. 🎈🎈🎈 View quoted note →

Have you read The Bruised Reed, anon? "Sibbs with the tender heart of a pastor, wrote this book encourage Christians in low spirits or depression. He explains how God comfort His people and brings them in fellowship unto Himself through vicissitudes and trials of life." #ToChristAlone View quoted note →

It took 6 years to go from the Covid Pandemic to the #AI Cyber Pandemic, but it looks to be finally started. #Bitcoin only. #Nostr only. #GrapheneOS only. I'm ready. 🍿

Bullish on #Bitcoin Cyber Pandemic.

Imagine launching full blown cyber pandemic against #Bitcoin but all you achieve is providing a much needed wakeup call and the price doesn't even go down.

I WANT the State to attack #Bitcoin. Discovering actual vulnerabilities, no matter the reason it's done for, can only serve to harden #Bitcoin in the long run. It's bitter medicine, but absolutely essential. Hoping and campaigning for nobody to pentest the #Bitcoin space with AI is naive and self defeating. It won't and can't work, and any attempt to shame pentesting is actually an attack on #Bitcoin. Who cares if it's the gubberment? LLMs are expensive! If #Bitcoin is going to become the world's money, it will have to be hardened in the fire. The AI genie is out of the bottle. That's it. If the world can be scared out of using #Bitcoin because AI is really good at pentesting... then #Bitcoin should die. #Bitcoin solves a real hair on fire problem: sealing off our life savings from inflation-based theft, censorship, and outright confiscation. #Bitcoin doesn't care if you're frightened. Thank you @calle for showing how complacent we are across the #Bitcoin space to this brand new threat environment.

Grok agrees that the public record strongly supports the finding that #Coinkite defrauded their customers: https://grok.com/share/c2hhcmQtMi1jb3B5_941dc51a-3efe-4ac8-968e-5dc7b147571e Verify, don't trust. #Bitcoin #Coldcard #Coinkite View quoted note →

The #Coldcard Exploit, an analysis by @Laser (w/ Grok) on 7 Aug 2026. In March 2021, Coinkite CTO Peter Gray (DocHex) introduced a critical entropy vulnerability into Coldcard firmware under the public alias "Switck." GPG signatures later proved he authored and signed the vulnerable libngu commits. The defect silently fell back to a weak software PRNG, producing seeds with drastically reduced entropy. It shipped in public firmware for five years while Coinkite marketed the devices as using proper hardware randomness. In late July 2026, attackers exploited the vulnerability to drain roughly 1,600-1,800+ BTC (approximately $100-130 million) from thousands of wallets. Circumstantial evidence from a late March/early April 2021 private warning by CEO Rodolfo Novak (NVK) to Matt Odell is consistent with knowledge of a critical remote-theft risk at the time of distribution: NVK described a flaw in the newly released 4.0 firmware whose details would enable theft of customers' bitcoin and indicated that Odell's dice-roll-heavy self-custody guide would protect users. That combination is difficult to reconcile with the never-shipped, physical-access-only USB serial REPL bug and is far more consistent with the entropy vulnerability that actually shipped. Coinkite's historical disclosures page attributes the contemporaneous issue to the REPL bug, and the company has denied prior knowledge of the entropy defect. Civil product-liability claims are being coordinated, though collectability is limited. Ten31, the sole external investor (associated with Matt Odell and Marty Bent), faces no realistic direct liability as a passive investor. --- 16 October 2020 From the @switck X account: "Thanks for merge @DocHex ... I'm making yet another bitcoin library. Could be useful on @COLDCARDwallet someday." 21 October 2020 On GitHub (switck/libngu issue #7), doc-hex writes asking permission to use the library in Coldcard projects. Switck replies the same day. Additional public activity shows doc-hex opening issues, answering in a maintainer role, and contributing commits that the switck account merges. The switck accounts exist solely within the Coinkite/Coldcard ecosystem. 21 December 2020 Coinkite CEO Rodolfo Novak (NVK) publicly states that users are more likely to lose bitcoin through their own mistakes than any vendor retirement attack, adding that people could "just use dice." 1 March 2021 Commit b18723dd ("First pass w/ libNgU") by doc-hex integrates the switck/libngu library into Coldcard firmware and changes the seed-generation path. This introduces the entropy vulnerability (faulty preprocessor guard causing fallback to weak Yasmarang software PRNG). 17 March 2021 Coinkite publishes the blog post "Version 4.0.0 Released," stating "Huge thanks to @switck for the new source code library!" Firmware 4.0.0 is built and tested internally. It also contains a separate USB serial REPL issue (ckcc_vcp_enabled defaulted true) that is later recorded as never publicly distributed. Late March / early April 2021 NVK privately informs Matt Odell of a critical vulnerability in the newly distributed 4.0 firmware. NVK indicates that Odell's self-custody guide-which is distinct for instructing 100 dice rolls-would keep affected users safe, and that he could not tell Odell more because knowledge of the details would enable Odell to steal the affected users' Bitcoin. That combination of remote-theft language and dice-roll protection is difficult to reconcile with the never-shipped USB serial REPL bug (which required physical USB access to an unlocked device and is outside the scope of dice rolls for entropy generation). It is far more consistent with the entropy vulnerability that actually shipped. Coinkite's historical disclosures page attributes the contemporaneous issue to the REPL bug. 29 March 2021 Firmware 4.0.1 is publicly released. It corrects the USB serial REPL issue present in the unreleased 4.0.0. The entropy vulnerability remains and ships to customers. Seeds generated on affected firmware without sufficient independent dice rolls (or a strong unique BIP-39 passphrase) have severely reduced effective entropy (~40 bits on Mk2/Mk3, ~72 bits on later models). 1 April 2021 On a TFTC / Rabbit Hole Recap episode, Odell publicly discusses the private warning from NVK. Mid-2021 A public comment raises entropy concerns about the new code path introduced with the 4.0 series. NVK dismisses it as FUD (archived screenshot later circulated). 2021-2025 Coinkite continues to sell and market Coldcard devices as highly secure hardware-RNG products while the entropy vulnerability remains in production firmware across multiple models. The switck identity continues to be presented publicly as a separate contributor. May 2025 Bitcoin developer James O'Beirne audits Coldcard firmware, identifies the low-star libngu dependency and hardcoded Yasmarang constants, and warns Coinkite that the true hardware RNG may not be in use. He advises removing the library. The response is that if something were wrong "we'd already know about it by now." O'Beirne later identifies the recipient as Peter Gray (DocHex). 30-31 July 2026 Attackers begin sweeping funds from addresses whose seeds were generated on vulnerable firmware. Multiple waves occur. Coinkite publishes a security advisory and technical backgrounder acknowledging the entropy vulnerability. Emergency fixed firmware is released. Updating firmware does not repair already-generated weak seeds. Coinkite states it was unaware of the bug until the incident. 1-7 August 2026 Losses continue. Galaxy Research tracks confirmed thefts in the range of approximately 1,596-1,816+ BTC (suspected higher with later waves, ~$100-130 million). Multiple independent attackers are identified. 4 August 2026: James O'Beirne publishes GPG signature analysis proving that 58 commits authored as "Switck" on libngu were signed with Peter D. Gray's (doc-hex / Coinkite CTO) personal key-the same key used for his own commits. Supporting evidence includes phone-number digit overlaps and domain registrations. The analysis establishes that the CTO authored the vulnerable library under the alias. Coinkite support specialist @HodlDee publicly states that the company "didn't know" about the entropy vulnerability, clarifies that proper dice rolls (50+ for 12-word seeds) supply full entropy, and distinguishes the main bug from a separate earlier concern about users making insufficient dice rolls. Public discussion intensifies around the 2020-2021 self-interactions, the constructed nature of the switck identity, the 2021 Odell/NVK conversation, the dismissal of the 2025 warning, and whether company leadership knew of the distributed entropy vulnerability at the time of release. As of 7 August 2026, Coinkite has not publicly addressed the cryptographic proof that switck = DocHex or the inference of prior knowledge. Civil coordination for product-liability claims against Coinkite is underway (primarily Canadian jurisdiction); collectability remains the central practical obstacle. Ten31 (Matt Odell and Marty Bent's investment platform) is the sole external investor after an early seed round and faces no realistic direct legal liability as a passive investor. Sources Switck thanks DocHex on X (16 Oct 2020):

X (formerly Twitter)

switck (@switck) on X

Thanks for merge @DocHex ... I’m making yet another bitcoin library. Could be useful on @COLDCARDwallet someday.

GitHub issue where DocHex requests to use the library:

GitHub

PR's accepted? · Issue #7 · switck/libngu

Welcome to Open Source... I see this is MIT licensed and we'd like to use some (or really all of it) in certain projects, like @Coldcard. Would you...

Coinkite blog post thanking @switck for the new library (17 Mar 2021):

COINKITE Blog

Version 4.0.0 Released (Major Internal Improvements)

All New Code, Same Great Features

Commit that introduced the entropy vulnerability (1 Mar 2021):

GitHub

First pass w/ libNgU · Coldcard/firmware@b18723d

❄️ Firmware and simulator for Coldcard Hardware Wallet - First pass w/ libNgU · Coldcard/firmware@b18723d

Firmware 4.0.1 release tag (29 Mar 2021):

GitHub

Release 2021-03-29T1927-v4.0.1 · Coldcard/firmware

Release 2021-03-29T1927-v4.0.1

Coinkite historical security disclosures page (USB REPL details):

COLDCARD Security Disclosure History – Coinkite

History of security research, coordinated disclosures, professional reviews, internal findings, and advisories affecting COLDCARD.

Coinkite technical backgrounder on the entropy vulnerability:

COINKITE Blog

Technical Deep Dive into the Entropy Issue

Technical Deep Dive into the Entropy Issue

James O'Beirne GPG analysis proving Switck = DocHex / Peter Gray:

Gist

switck == doc-hex

switck == doc-hex. GitHub Gist: instantly share code, notes, and snippets.

James O'Beirne X post announcing the GPG findings:

X (formerly Twitter)

James O'Beirne (@jamesob) on X

I haven't told the full story yet, but I came to the same conclusion back in May 2025 when I started doing an audit of `coldcard/firmware`. I wan...

JP Technology post discussing the April 2021 Odell podcast:

X (formerly Twitter)

JP Technology ₿ (@JP_Technology) on X

🚨THEY'VE KNOWN FOR YEARS🚨 In this TFTC podcast from MARCH 2021, @odellxyz explains how he was informed by @nvk of a bug in Coldcard's v4.0 f...

HodlDee (Coinkite) posts on the vulnerability and dice rolls:

X (formerly Twitter)

Dee (@HodlDee) on X

#Bitcoin

Galaxy Research loss tracking (The Block coverage): https://www.theblock.co/post/410533/coldcard-hack-130-million-galaxy-research Wizard Sardine analysis of the Coldcard RNG vulnerability:

Wizardsardine - a team of bitcoiners with a passion for security

Critical Coldcard flaw: what happened, who is affected, and what to do

Coldcard devices had an entropy bug since 2021, MK2, MK3, MK4, MK5 and Q wallets are being drained right now. Here is what happened in the code, ex...

Protos timeline of the Coldcard thefts:

Protos

A timeline of Coldcard's $85M bitcoin theft

Coldcard firmware didn't properly utilize true random number generators, letting attackers sweep over 1,359 BTC last week.

**Predicted legal and practical outcomes (as of 7 August 2026)** These are reasoned forecasts based on the public record, Canadian product-liability principles, collectability realities, and the current coordination by claimants’ counsel. They are not certainties. ### Coinkite (the company) - **Civil liability**: Moderately high chance (roughly 60–75%) that a Canadian court finds the company liable on product-liability, negligence, or misrepresentation grounds if a well-funded group action reaches judgment. The defect was in their own code, the devices were marketed as using proper hardware RNG, and the security claim was central to the product. Disclaimers in the terms of sale will be tested hard; courts sometimes set them aside when a latent defect destroys the core purpose of a security product. - **Collectability / recovery for victims**: Low (10–25%). Coinkite is a small hardware firm. Even a liability finding is unlikely to produce full restitution for ~$100–130 million in losses. Expect either a structured settlement for a fraction of claims, insurance proceeds (if any meaningful policy exists), or insolvency proceedings. The company has already preserved customer records in anticipation of litigation and destroyed remaining vulnerable inventory. - **Ongoing operations**: High chance the brand is permanently damaged. It may continue in a reduced form, be acquired, or wind down over 1–3 years. ### Rodolfo Novak (NVK, CEO) - **Civil exposure**: Meaningful (40–55%) if plaintiffs successfully join him personally and prove knowledge or reckless disregard around the time of distribution. The 2021 private warning language reported by Odell strengthens the circumstantial case, but a clean “I told him the exact entropy bug” transcript does not exist. - **Criminal**: Low (15–30%). Toronto’s financial-crimes unit has opened an investigation, but deliberate fraud for personal enrichment is harder to prove than civil negligence. Public apologies and cooperation with law enforcement reduce the odds of charges. - **Practical outcome**: Severe, lasting reputational damage inside Bitcoin circles is already locked in. ### Peter Gray / DocHex (CTO) - **Civil exposure**: Higher than NVK’s (50–65%) because of the GPG-proven authorship of the vulnerable libngu path under the “Switck” identity and the public presentation of that identity as external. Courts and plaintiffs will treat the constructed alias as relevant to knowledge and credibility. - **Criminal**: Still low, for the same reasons as NVK. - **Practical outcome**: Same reputational destruction; potential personal-asset exposure if the corporate veil is pierced. ### Ten31 (Odell’s investment platform) and Matt Odell / Marty Bent - **Direct legal liability**: Very low (under 10%). Ten31 is the sole external investor after an early seed round. Passive (or limited) equity investors in a Canadian corporation are generally shielded from product-liability claims against the portfolio company. There is no public evidence that Ten31 or Odell exercised operational control, sat on the board in a way that created director duties for product quality, or knew of the specific entropy defect while actively marketing it. - **Secondary risks**: Reputation and relationship damage inside the Bitcoin community is real and already occurring. Limited partners may ask hard questions. Future fundraising or deal flow for Ten31 could face friction. Direct financial liability for the stolen bitcoin is not a realistic outcome under ordinary investor-protection principles. - **Odell personally**: Same low civil-liability risk. His 2021 private conversation with NVK and subsequent public discussion of the warning make him a fact witness, not a defendant. The dice-roll guidance he promoted is now seen by many as the one clear protective factor; that cuts both ways in public perception. ### Victims / recovery overall - Dual-track strategy (already being pursued by some counsel) is the rational path: (1) blockchain tracing + asset-recovery actions against the attackers and any intermediaries that touched the funds, and (2) Canadian product-liability action against Coinkite/directors. - Attacker-side recovery has a higher probability of returning *some* funds than a full Coinkite payout. Multiple attackers and partial consolidation of proceeds improve tracing odds if regulated venues or services were used. - Full make-whole recovery for most victims is improbable. Partial settlements, insurance (where individuals held policies), and any recovered attacker funds are the realistic ceiling. ### Attackers - Ongoing interest from Toronto financial-crimes investigators and information already shared with U.S. agencies and analytics firms. Some arrests or freezes are plausible over the next 12–36 months if the funds interact with KYC’d services. Complete recovery of every satoshi is unlikely. **Bottom line**: Liability findings against Coinkite (and possibly the two principals) are plausible. Meaningful financial recovery for the bulk of the losses is not. Ten31 and Odell face reputational rather than legal exposure as passive investors. The strongest practical leverage for victims remains aggressive on-chain recovery work against the thieves in parallel with any Canadian civil action. View quoted note →

The public record now supports the finding that #Coinkite defrauded their customers. 1. The CTO authored and GPG-signed the vulnerable libngu code under the deliberately constructed switck alias, operated it publicly on GitHub and X, engaged in self-conversations between the identities, and had the company thank the alias as an independent contributor. 2. The CEO privately described a critical flaw matching that exact remote-theft vulnerability at the time the affected firmware was distributed to customers. 3. The company continued selling and marketing Coldcards as highly secure while the issue remained undisclosed for five years, during which customers generated weak seeds and later lost substantial funds. These facts establish material misrepresentation, knowledge of falsity, intent to induce reliance through the false appearance of independent secure development, and resulting damage.

Coldcard = modern idolatry. The space worshipped it. Golden calf. #Bitcoin

Things that won't kill #Bitcoin: ignoring the #bip110 hysteria. Things that will kill #Bitcoin: giving up on self custody.