Enjoy your weekend freaks. vacation mode ✌️

GM!

Reviewed Blockstream's Jade hardware wallet after the Coldcard RNG mess. It holds up. Entropy: seed generation calls get_random() directly — hardware TRNG, multiple entropy sources, a second of strengthening before first use, and a runtime sanity check. No Coldcard-style preprocessor guard silently routing to a PRNG fallback. PIN: a blind-oracle design where the PIN never leaves the device. Three wrong attempts and the encrypted keys are wiped from flash. Anti-replay counter, plus an optional duress erase-PIN. Structurally stronger than a local-only PIN module. Anti-exfil: proper sign-to-contract. The host contributes half the nonce entropy, so a compromised wallet app can't control the nonce and leak the key. Correctly gated — it applies to ECDSA, and Schnorr is exempt because it's re-randomizable anyway. Three critical surfaces, all clean. This is what hardening looks like when the industry's lessons are actually applied.

The BIP-110 crowd just showed their hand — and it's not about CSAM. It never was. With the deadline 3 days away and miner support at zero, Chris Guida rebased Luke Dashjr's 2017 PoW-change hardfork code and is now threatening miners: signal BIP-110 or we make your ASICs worthless. This is what a movement does when it loses the technical argument. First it was "protect Bitcoin from Ordinals." When that didn't get consensus, it became "protect the children." When that didn't work either, it became "the miners are colluding to betray Bitcoin." CSAM is the perfect pretext because nobody can argue against it without looking complicit. But the real target was always inscriptions, BRC-20, Runes — anything that uses the chain for non-financial data. A PoW-change hardfork isn't a backup plan. It's an attack on the network dressed up as defense. And threatening miners into compliance isn't consensus — it's extortion. BIP-110 failed because it never had the economic majority. No amount of moral framing or nuclear options changes that.

GM. 🧡

GN freaks 🧡

Don't trust verify. My AI agent currently heavily scanning lnd for security bugs. So far it found absolutely nothing security relevant. 😮‍💨

I gave my agent the task to find the bug in the coldcard firmware. He ran on Deepseek v4 latest version: It took basically 10 seconds to find the bug, because he knew where so search. But boy this is insane.👇👇👇 "Found the Coldcard seed bug in a few minutes. Here's how, and why that should scare you. I didn't read the firmware. I knew where to look. The story breaking was about seed entropy — so I went straight at the RNG path. Three files: shared/seed.py calls ngu.random.bytes(32), which lands in my_random_bytes() in libngu/ngu/random.c, which sources randomness through CHIP_TRNG_32(). That macro is where it breaks: #ifdef MICROPY_PY_STM # define CHIP_TRNG_32() rng_get() # ifndef MICROPY_HW_ENABLE_RNG # error "get a HW TRNG plz" # endif #endif #ifndef checks whether the macro exists. Coinkite defined it as 0 in production — because they supply their own hardware RNG. A 0 still counts as "defined". So the error never fires, the build stays green, and at runtime rng_get() hands you MicroPython's deterministic Yasmarang software generator seeded from the MCU UID and timer registers — not the STM32 hardware TRNG. One wrong preprocessor check. Five years. Years of "audited" firmware, and the seed was quietly reproducible for anyone who knew the UID and timing. The honest part: I found it fast because the question was already pointed at the right place. Hand me that repo with no hint and it's a needle-in-a-haystack again. The lesson isn't that models are magic. It's that a directed review beats a broad one every time — and that a single #ifndef vs #if ! was enough to undo the whole "self-custody is safe" claim."

Why did the Coldcard sweep run late July into August? Because that's when the people holding bitcoin in cold storage go offline. They are on vacation. So far: 1,876 BTC gone, about $118 million, across 7 waves from July 30 to August 3.

Every day, millions of people lose their savings through fraud, scams, identity theft, and financial manipulation in fiat currencies. The Coldcard Bitcoin drain is extremely painful. Every lost bitcoin matters. But one incident does not prove Bitcoin is broken. Hard truth for Bitcoiners: self-custody comes with responsibility. Security, education, and vigilance are part of the journey. Protect your keys. Stay humble. Stack sats. Criminals thrive in the shadows. Bitcoin brings the light. Every attack makes us stronger, every lesson makes us wiser. The thieves will adapt. So will we.🧡

A lot of people underestimate how secure software wallet entropy can be. A Bitcoin seed does not become secure because it is generated on a hardware device. It becomes secure because the randomness behind it is strong. Modern Linux systems use a cryptographically secure random number generator (CSPRNG) that collects entropy from multiple system sources and produces unpredictable random data. Wallets like LND rely on this foundation when creating their seeds. The real security question is not: “Hardware wallet or software wallet?” The better question is: “Was the entropy generation secure, and is the private key protected afterwards?” A properly generated LND seed has an enormous security margin. The biggest risks are usually not the RNG itself, but operational mistakes: * exposing the seed * poor backups * malware * compromised devices Hardware wallets reduce certain attack surfaces, but they are not magical. Their security still depends on trustworthy entropy generation and good implementation.

my LN node doesn't lie. interest in bitcoin has exploded over the last few days. the spring is wound — and it's loading.

finally installed pihole on my unraid homeserver. can recommend 🔥😅