Coinkite CTO, Peter D. Gray (DocHex), created a nym named "switck" in 2020, then used it to contribute the libngu library that contained the RNG bug. Crucially, Coinkite publicly thanked switck in their 2021 release notes, and the commits were signed with Peter D. Gray's GPG key, meaning he had full control over the code that went into production. This looks like he deliberately used the pseudonym to separate his personal identity from the code contribution. 🚨🚨🚨 image
Laser's avatar Laser
Coldcard in 2021: 'a [retirement attack] is when the project makers have a "bug" in the entropy generation for later retrieval.' image View quoted note →
View quoted note →

Replies (8)

Probability skyrocketing. nevent1qqsqqqp8nrd2d8k7uewuvvlprcs7atgk8uzv3pkvgd07hsjtqqdkhucpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgq3qvjk0gp2l4qnte2uy2l3ya78m5ays4wc7wmd6k64gw5498g8tf49q7uunvp