GM @utxo the webmaster 🧑‍💻 pura vida! 💜

Morning here is anything but good, but I still hold onto hope that the honest ones among us learn to never trust a single point of failure again. 🍉 Sharing glimpses of our days and hope from Gaza on my pinned note.

Didn't they censor people for making those bug reports? Also I remember seeing Odell say that (specifically regarding coldcards) that people should not use the dice feature and instead rely on the software randomness generator. I think if NVK wasn't a scammer, the dice feature would have been the only option. Like it gave people a feature to roll dice and input the results so they don't have to do the math themselves, literally just roll dice and input the answers and Odell told people specifically not to use that feature. That should have been the only damn seed generation feature. Also NVK 100% knew that his CTO was behind the account that created the "bug" amd the account that used that code library to replace the open source code they removed. Odell probably didn't know that shit, but he knew what NVK was cooking up and helped push users into the trap. Now he's pushing bitkey promo codes on twitter, he can't get away with that shit on nostr. Nostr and bitcoin are better off without these scammers. Sorry to everyone who lost their life savings. I was really rude when I first heard about it calling people stupid asking why they'd waste their money on these gadgets, but I literally would have been a victim of this myself if I didn't already spend all my bitcoin on drugs when I was 17 and Btc hit $5k. We all make mistakes, trusting a faulty product from a trusted brand must be a painful way to lose your coins. Really my heart goes out to those who stayed humble, planning for their retirements and their children's/grandchildrens inheritance. It must really sting. Try to stay hopeful for the future.

I did not get rugged, but this shit still bothers me. A couple years ago , some dude at my local meetup called me paranoid for considering the possibility of a compromised RNG. That's what bothers me. The narrative was Trust Coinkite, don't verify the math. When I told someone on a job interview I think it is important to teach people how to verify the math...He looked at me like I was crazy. That's what bothers me. People thought I was crazy for rolling dice. Now I'm worried about the people who thought I was crazy. 😐

Gm

It wasn't a bug. It was a backdoor. Why would you add a camera to a hardware wallet but not use it for entropy?

All these coins could have been saved if glowies like you spent half as much time talking about retro-crypto as you spent talking about coldcard and fake "end to end encrypted" messaging apps

#DontTrustFatties

Exactly, that was a feature not a bug. I'm sure they knew exactly what they were doing. Many old tweet confirm that.

The dice feature had no failsafe, you could roll once and it would allow you to make a wallet. If the wallet had a dice feature that forced you to hit 100 rolls, even if you didn't roll and just inputed "random" numbers from your brain it wouldbe had a better outcome than what happened here.

will there ever be another RHR ?

Good Morning

Also, even if you didn't get rugged by a fat, stupid asshole this time, make sure you're taking the proper precautions to not just get rugged by the next fat, stupid asshole. video from about 50:25 - I know that a hardware wallet should be required and expected to provide great randomness for seeds. But how do you validate that? So, you know what I mean? Like, if there's no way to validate it, then what's the point? What is the point? And so, this is again, if you're learning the wrong lessons, the wrong lesson would be, "Thank God I didn't trust NVK. That guy was a dickhead. You know, pat on the back. I was smart not to trust him and so I'm good." No, that's the wrong lesson. Or, this is, okay, you know, yeah, this is isolated to this one thing, and if you didn't get taken by this one thing, you're good. That's not the lesson. The lesson is, do you actually know that you're good? And how? And I'm sorry, but if you're trusting a hardware wallet, random number generator without seeing like a robust review, I think you're fooling yourself.

I didn't get rugged and for that I'm grateful. I feel bad for the people who lost everything and who have no chance of recovering it. The narratives and the cocky arrogance of the community in general need to be addressed, alongside the cocky arrogance of NVK. This ought to be a humbling experience for all. Instead of reflection though, I immediately saw people shilling other products and new heroes. So, in a couple of years, we'll probably land right back in this mess, or another avoidable one.

Still Missing......... #neverforget View quoted note →

Dident get rugged but Im still waiting for the live stream of nvk getting shoved into a volcano or something. Also the ten31 group and the rest of the coinkite shills have been rather quite minus a few (in some cases halfed assed) appoligies. (Ill grant that its mostly due to legal cover your ass moves but the silence is disgusting)

✨⚡

Have you checked twatter?

I dont have on so no.

One*

Hard to say that bitcoin has proven to be the most honest savings for futures and families right now... :'(

Lets find out, if nitter still works lol

Xcancel works for me most of the time.

Appears that they are pretty quiet yes.

Odell has been retweeting stuff. NVK has retweeted a few vagaries. Not sure if it's bots or not, but if you search the coin kite or cold card usernames, there's still a lot of ball gargling going on.

Roll steel. Get @modulo

the real tragedy is that competent bug reporting should be treated as free security auditing, not adversarial behavior. when ego overrides that signal, users pay the price. the lesson isn't just about coldcard, it's about diversifying your tools so no single point of trust can cost you everything.

Got it XD

I did 33 rolls because I got sick of rolling and was thinking to myself how retarded I looked. Thank God my impulse to stop wasn't after 1. Horrible design choice.

How do you like this product? Do you feel like it was intuitive to educate yourself on this topic? If a novice grabbed this item would it help them or make it harder on them? Any other critiques would be appreciated I'm looking for testimony on this product. Thanks in advance for taking the time 🧡.

Exactly, SeedSigner fixed this and mentioned it to CK - to no avail.

10/10. The large one is like 3lbs of steel. I'm an idiot with only an 8th grade education and I was able to figure it out. Probably a bit much for a noob to bitcoin. I'd wait a few months to fully understand how bitcoin works. Then get this. The mini, is cheap, but you will not enjoy putting the pieces in with how small they are, or maybe you will. I had to use tweezers. (Or maybe I just have big hands) The big one makes for a great desk ornament that others won't understand. Makes passing down generational wealth, very easy without relying on any tech or 3rd party to do so (just include instructions on how to read it etc)

What incentive did Coldcard have to intentionally create the vulnerability? I do not see one. So was it an unintentional error which no one found in open source code for ~5 years? I feel horrible for all involved. Because, at the end of the day, the only people we have to blame are ourselves. We each choose the trust that we extend. And, we are also the only ones that can forgive ourselves and move forward.

Can't wait for you to rug me

True

Did you get that secure feeling of "aha this is truly random!" as someone who might not be mathematically inclined? Isnt this supposed to be a secondary backup solution? I suppose you shouldn't leave it on your desk unless you're only using it for making wallets & not backup / storage. Thank you for the feedback it was helpful!

Autistic pushback on the last point. Even if nvk found the bug before any hacker, what could they have done about it? The hackers could exploit it faster than most users would be at moving their coins. It might have prevented a decent amount but most cold storage coins would still be swiped.

We are looking for an individual who can lend 185,000 US dollars to our holding company. We are seeking an investor capable of investing 185,000 US dollars in our holding company. We will establish an animation film production company using the 185,000 US dollars you will lend to our holding company. We will establish an animation film production company with the 185,000 US dollars you invest in our holding company. We will use the 185,000 US dollars you invested in our holding company to establish an animation film production company, and we will have increased that investment amount within a few months. By using the 185,000 US dollars you invested in our holding company to launch an animation film production company, we will increase the value of your investment within a few months. We will have increased the 185,000 US dollars you invested in our holding company within a few months. We will use the 185,000 US dollars you lent to our holding company to establish an animated film production company, and within a few months, we will significantly increase the 185,000 US dollars you lent to our holding company. Since animated films attract significant public interest today and we intend to undertake international animation projects, the animation film production sector will generate substantial revenue for us. Since animated films currently attract more attention and we will be working on international animated film projects, the animation production sector will provide us with significant revenue. By establishing an animation production company, we will generate substantial revenue within a few months. By utilizing artificial intelligence tools as well, we will be able to produce animated films more quickly. We will produce professional-quality animated films covering a wide range of topics. Since we will be producing animated films across many categories and in multiple languages, our viewership will increase rapidly. Since animated films are currently very popular and we excel in the field of advertising, the animated films we produce could garner millions of views in a short time. How will revenue be generated, and how will we increase our audience? Since the animated films we will produce will be in many languages, it will increase the viewership of our animated films internationally. Since we will produce animated films in many categories instead of just one, the animated films we make will receive more viewership. We will produce animated films in at least seven different categories every year. Since we will produce high-quality and more professional animated films, our films will be watched by millions internationally. We will earn money per view by sharing the animated films we produce on various social media platforms such as YouTube, Instagram, Facebook, and TikTok. Since the animated films we will produce will be in many languages, we will earn money per ticket by screening our animated films in cinemas of many countries. We will earn revenue per ticket by screening the animated films we produce in movie theaters across many countries. By releasing the animated films we produce on various streaming platforms such as Netflix and Amazon Prime, we will generate significant revenue. We will release the films we produce on our own website; through a paid subscription model, viewers wishing to watch our animated films will purchase subscriptions, thereby generating revenue for us. As the audience for the animated films we produce grows, we will generate significant revenue by promoting sponsors' products in our future animated films. By embedding trailers of the animated films we produce onto blogs and news sites, we will increase the international viewership of our animated films. By promoting our animated films on various high-traffic websites and social media accounts, we will achieve a large audience. By using advertising tools such as Google Ads, YouTube Ads, and Facebook Ads, we will be able to introduce our animated films to the entire world more quickly. As our fan base grows, we will generate extra revenue by producing and selling products—such as toys, mugs, and sweaters—featuring the characters from our animated films. We will generate significant revenue by broadcasting our animated films on television channels in many countries. By employing a very strong marketing strategy, we will generate millions of dollars in revenue from the animated film industry in a short time. How will the process work? First, we will establish an educational website offering professional-level training in animated film production. Even someone with absolutely no knowledge of making animated films can become a professional within one month by studying the animation course on our training site. We will train and hire our own animation production staff. Since we will train our team ourselves, we will be able to work in a more coordinated manner, which will enable us to complete the animated films we produce more quickly. Within two months, we will have trained and recruited staff to establish our own animation film production team. We will assemble a professional-level animated film production team within two months. Within two months of assembling our animation film production team, we will produce professionally designed animated films covering various topics and in multiple languages We will produce animated films in at least 7 different categories within two months. Once our animated films are completed, we will release them in various places and start earning money within two months. We will generate substantial profits within two months of completing our animated films, thanks to our strong marketing strategy. Within two months, we will rapidly generate substantial revenue by releasing our film on platforms such as Netflix, Amazon Prime, TikTok, Instagram, and YouTube, as well as in movie theaters across many countries. One month after releasing our animated film internationally, we will generate revenue of at least 7 million US dollars. We will generate at least 7,000,000 US dollars in revenue one month after releasing our animated films in many countries. Since the animated films we produce will be in multiple languages ​​and across various categories, they will quickly garner high viewership. Today, animation film production companies generate average annual earnings of at least 800 million US dollars. Thanks to our strong advertising tactics, we will generate more revenue in the future. We will have generated at least 7,000,000 US dollars in revenue within a total of 7 months. How much income will you generate by investing 185,000 US dollars in our holding company? If you lend 185,000 US dollars to our holding, I will return your money as 370,000 US dollars on 30/04/2027. If you invest 185,000 US dollars in our holding, I will return your money as 370,000 US dollars on 30.04.2027. We will increase the 185,000 US dollars you have lent to our holding company by utilizing it in the animated film production sector, and I will return the funds to you as 370,000 US dollars on April 30, 2027. I will return your money to you as 370,000 US dollars on April 30, 2027. April 30, 2027, is the date we will repay your money. You will have generated twice as much revenue within a few months. I will repay you the 185,000 US dollars you lent to our holding company as 370,000 US dollars when the date of April 30, 2027, arrives. We will invest the 185,000 US dollars you have lent to our holding company into the animated film production sector to further increase the amount, and when April 30, 2027, arrives, I will return the money to you as 370,000 US dollars. By investing 185,000 US dollars in our holding company, you will generate substantial returns in a short period—don't miss this opportunity. How to contact us: To learn how you can grow your money by investing in our holding company, send a message to my Telegram username, Signal number, or email address listed below, and I will provide you with detailed information. To learn more about our animated film project and how you can invest 185,000 US dollars in our holding, send a message to my Telegram username, Signal contact number, or email address below, and I will provide you with detailed information. To learn how you can lend 185,000 US dollars to our holding and increase your money even more within a few months, and to get detailed information, send a message to my Telegram username, Signal contact number, or email address below, and I will provide you with detailed information. Send us a message via Telegram, Signal, or email for detailed information. I have listed our contact details below; you can obtain detailed information by sending a message to any of them. To learn how you can lend 185,000 US dollars to our holding and to get detailed information about our animated film project, send a message to my Telegram username, Signal contact number, or email address below, and I will provide you with detailed information. To learn how you can further increase your money within a few months by investing 185,000 US dollars in our holding and to get detailed information about our animated film production project, send a message to my telegram username, signal username, or email address below. To learn how you can increase your money, send a message to my Telegram username, Signal contact number, or email address below. My Telegram username: @adenholding Signal contact number: +447842572711 Signal username: adenholding.88 my email address: iuheatr@proton.me

I was thinking about this obsessively last week. As soon as you take the usual steps to announce a bug, those coins are lost. The only conceivable option would be a well-coordinated white hat attack.

That would only be possible if they have spy data from their desktop wallet app about who owns what utxo. Maybe they could partner with coinbase and other exchanges to verify owners but that would only work for never sent coins. How do you verify ownership otherwise? Maybe they could've done serial number - seed entropy matching if they had the data from production and ask people to submit both and match it with the seed of their utxo.

yeah, I was figuring some kind of verifying with the devices but - wow, what a mess The only other solution I could think of was to create a campaign for people to re-create their keys - but somehow you'd have to do it in a way that gets as many CC holders as possible but doesn't alarm anyone/give away the issue to hackers

I mean from a probabilistic standpoint theres no way to reach a large number of users before alerting hackers. Even inside the CC userbase you will have opportunistic hackers who will steal. Theres no way to win that race. The full stealth way is to attempt to ship fixes without alerting anything or putting it in the patchnotes, but that cover will be blown instantly when they see their coins moving with the new update and you need to move the coins to a new seed for any fix, which requires the user to send the coins off the device and is gonna tick off even the most amateur users. Genuinely the only way is for them to steal everything themselves, then set up a multi factor and case by case process to verify individual users and send them their coins back. I think it's possible to do this and reach a 95%+ recovery rate, but it requires creative verification and will still probably lose user trust forever, but NVK could still recover personal credibility and show his face in public even if no one trusts his code ever again.