I logged into X for the first time in a while to understand the post-mortem of how Coldcard was able to be attacked and the full extent of the threat. (Reluctantly, I really hate that place.)
Coldcard and Rodolfo Novak (AKA NVK) were supposedly one of the most respected brands / personalities in Bitcoin. The Coldcard was the machine you used to generate and secure your precious Bitcoin seed and defend it from an NSA covert ops team, or whatever.
The Coldcard was supposedly for Serious People and was the ultimate solution – everything else was an "inferior piece of shit".
Yet somehow, they were able to fuck this whole thing up so badly. The literal number one thing that a hardware wallet needed to do: to generate and store a secure seed, was botched so badly that $40million worth of BTC was stolen in half an hour.
The flaw in the Coldcard firmware is not obvious and involves the interaction between a few different files and config etc, but still - the error has been sitting right there for years. Some of the more serious people have commented that this thing should have failed safe and not done anything if it wasn't giving true entropy. Others have brought up the controversial move that CoinKite made from open source to "source viewable" - whatever.
I was never impressed by the aggressive and dismissive persona that this guy NVK projected online, however I have never met him in person and recognise that we live in the age of short-form video and algorithmic feeds – so you gotta do what you gotta do for clicks.
But zooming out, it seems that instead of doing all those podcasts and conferences and taking swipes at genuine open-source projects, a serious project would have made sure that their product actually worked.
A real security / cryptography team and a proper business would have isolated that thing, run unit tests, done some sanity checking on the entropy, red-teamed their own system, and had many sets of eyeballs on that code.
But the thing failed, and I wonder if it is time for all of us to look in the mirror.
These kinds of people - and there are more of them out there, had the trust and the respect of a huge swath of hardcore Bitcoin enthusiasts.
Why?
I think it is because they talk like a "Bitcoiner" and look like a "Bitcoiner"?, but really it is a LARP.
There has been so much hate and anger in Bitcoin stirred up lately from these kinds of people, whether from the BIP110 crowd, general bigotry, and even some of the most cherished Bitcoin-only products.
It is all so tiring.
Some of these people are just simple minds. They want an ideology or an easy idea, an "us vs them" that they can play out in their mind and online that feels good. But hard reality is nuanced, economics, money and cryptography are complex topics.
The more nefarious and intellecutually gifted of these people use manipulation and snake oil to charm people into thinking that because "Bitcoin Only" or "no shitcoin inside" or "steak loving / freedom loving" that somehow what they say is right and what they have works properly. They speak the right shibboleths and go on the right podcasts to be anointed as OG.
I am adjacent to this. I am sure I've said some things that were not correct. I have my own humble podcast and have met my fair share of "influential Bitcoiners". There are many genuine people out there. I have met some very talented builders and nuanced thinkers. But more often than not those kind of people keep their voice down, they listen, they consider things deeply.
I have also met (or at least seen) my fair share of loudmouths and know-it-all Bitcoin influencers. They want followers - they want legions who will buy their shitty product or invest in their treasury company or something.
I have met their acolytes too, the ones who follow after every podcast, who doomscroll X, who repeat the shibboleths and are quick to use a No True Scotsman argument against anything that does not align with their prescribed worldview.
I once mentioned to someone like this, the most self-sovereign of all plebs, that I was running a Lightning node - do you know what they told me?
"You know that is a waste of time."
What are they all looking for? Something that gives them an identity in this strange tribe of ours?
What do you even do with freedom once you attain it?
They certainly don't want the detail and nuance and inherent compromise required of our messy fallen world – they don't want the nuance that Pseudo Random Number Generation is not the same as True Random Number Generation.
I long for essays on economics and political theory, of nuanced debate about elliptic curves that I cannot hope to fully comprehend. I pine for civil debate and actual insight. I thought the Coldcard post-mortem Block did was actually great and insightful compared to what Coinkite put out.
I feel like a bit of that lives on Stacker News and I have a few Bitcoin friends in real life who I can have long walking conversations with and trade viewpoint - but for the most part it is a sea of noise out there.
Whatever the LARP is in Bitcoin, I hope the fallout from Coldcard and the BIP110 washes away at least a bit of it.
– CE
What you were watching was a crisis. Of a novel kind too because normally this would go onto a security list, get patched, then you get the "update and roll over now" after a few hours and then next week we'd know what's what.
This was live. Extreme pressure. Even in the thread here on SN. I am sure some stackers didn't sleep much Thu->Fri, and on Twitter we saw people deprivating themselves of sleep beyond what is wise. Pressure to solve it. Ask the bot. Share preliminary unverified findings... on and on and on. This all went down in record speed.
To give you a comparison: 2 years ago, for a similarly complex, high priority bug, I needed 2 days to confirm, 1.5 days to patch and do a release, and luckily the ecosystem was ready to adopt quick - within a week most was fixed when wave 2 happened because someone figured it all out from reverse engineering the patch. Of course I didn't have a bot, or an army of people on twitter, or so many eyes on it. But the speed of this should give resolve. Wave 2 happened after 12 hours or so because once you are in this public setting, there is no going back and every fool has a bot now.
If you're not actively reviewing, having hardened process and spend at least 20% of your awake time on security then you better doomscroll X for every product you depend upon. Because that's the world we live in now.
We all know that this is the issue. And if we are honest, we know that this is the problem for each of us. We trust and we don't friggen verify. This vuln is the proof. Yes, we have a serious issue. Virtue signal became more important than actual work. We grew fat. We are lazy mfs. I am. You are. Everyone is.
Realize it now. And ffs get yourself on a diet and be lean again.
If this CC exploit was found and disclosed to Coinkite the outcome would have still been lost coins. Maybe not as many.
After 5 years? Yeah. After 2 months? Nearly nothing. Before release? None at all.
People still set up wallets with low entropy. As soon as its public, thieves would go looking for the exploit and find it fast.
I'm not sure what you mean. The key to finding bugs is finding them early.
The earlier you find them, the less damage they do, or maybe the real truth is the inverse: the longer you don't find them, the more damage they do.
In this particular situation users have already set up a flawed wallet. Coinkite can fix the vulnerability but as soon as they disclose to the pubic it wouldn't take long for an attacker to find the exploit and steal the slow mover coins.
Yes. So there is no great answer on a bug that has accumulated vulnerable coin for 5+ years. I cannot see any way to do it right when that history already built up like that. That is probably the other thing, besides the speed at which this went from question mark to "found it", in which this is unprecedented - I honestly don't remember any fundamental flaw with such exposure time in our space. Do you?
Influencers (and NVK) should figure out a way to reimburse their followers that got rugged.
Bugs happens, but promoting a device (built on clearly questionable DIY stack) as if it was better that everything else, while having all the tools (ie. opensource code) but not the knowledge to verify the claim, is something else.
Hopefully this is the end of the bitcoin religion, and we can go back at ignoring influencers and using bitcoin as money.
The biggest LARP happening among Bitcoin is the idea that you have "opted out of fiat" by simply holding Bitcoin. Even though you use fiat every day for everything, and you talk about the fiat price of Bitcoin more than you talk about creating circular Bitcoin economies.
Denominating your net worth in Bitcoin is not enough to claim you've opted out of fiat. Stop lying to yourself.
So true 100% no ISP takes bitcoin for payment so anyone living on a bitcoin standard is using some hack to pay their fiat bills
lol. That's actually the one thing you can pay directly with sats. Your point stands but your example is wrong.
What ISP in America takes Bitcoin? Drop the name so we can all drop our current ISPs
silentlink, nadanada. have fun staying kyc'd.
Silent link leverages existing tech. When you pay them in bitcoin they are converting to fiat and paying the major telecom companies.
Nice try though.
Why do you care about what your counterparty does with their sats?
I don’t. I am making my point that no one truly lives on a bitcoin standard when the people you pay dump it for fiat to pay whatever producer/ provider you are buying goods and services from
The biggest LARP in bitcoin is that "opting out" is a victory "against" the state.
Bitcoin is peter pan syndrome at scale. Infantile/adolescent tantrum throwing, rejection of the state of the world, a rejection of one's life. Low dimensional utopianism by idealist losers who are largely cultural orphans who anchored to the robust legibility of engineering, within which, bitcoin is remarkably obvious -- no genius required, but bitcoiners want to feel special for loudly declaring the world "wrong," which is a metaphysical/moral claim.
Read Nietzsche. Read Luhmann. Read Jünger. Read Musil. You have no "rights" that do not emerge from the magnanimity and grace of hard power, phaggot, there is only the actual reality. Violence is part of the market. Libertarianism is for retarded, whinny faggots. Stop lying to yourself, or keep your circular jerk-off circle, doesn't matter much to the world, but bitcoiners are content with the feeling with power, a bit of purchasing power -- little real ambition to reshape the world.
An intriguing comment!
Nietzsche: morality (including rights) is historically contingent.
Luhmann: rights are system-generated stabilisers, not absolutes.
Jünger: power can override liberal abstractions.
Musil: modern values are often more fragile than they appear
This made me smile, thank you. I'm reading The Man Without Qualities right now actually.
I am involved with some Bitcoin policy work back in New Zealand, and as a part-time journalist have also met with plenty of bankers / politicians and even a few central bankers.
It is always interesting to politely bring Bitcoin up and see how they see it "from their side of the fence."
For a lot of plebs "opt-out" of fiat is just putting head in the sand. They do not recognise that you need voice (as well as Exit, à la Albert O. Hirschman). Money is a political project and requires acceptance and negotiation from the other person to be used as a MoE. We all try to orange pill our friends, but many are reluctant to vote, get involved in politics, or try and shape the regulatory framework.
One of the most damaging phrase in Bitcoin I have heard people (mis)quote from Satoshi is:
"If you don't believe me or don't get it, I don't have time to try to convince you, sorry"
What is the alternative to civil engagement and discussion? Armed revolution? Mass disobedience?
They choose to hold their coins and wait, but this forms an apathy fuelled by No True Scotsman and puritan thinking. Heck, even the Shitcoiners are on "our side" in the market for private money, but are too juicy a target.
Maybe this is why the influential X/podcast Bitcoiners get so many followers? I dear say they have a strong commanding voice and extreme self confidence like our dear NVK which reminds them of the kind of mythical tribal leader missing from our modern world?
I always come back to the idea of: once you opt-out, once you have freedom - what do you do? From that platform of freedom how does it serve others and improve over what we currently have? If your "freedom" amounts to hating on a wallet because it supports shitcoins and listening to 40 hours of podcasts a week, then I don't think that is freedom.
Nvk is a piece of shit, this is the worst tragedy in Bitcoin history. As soon as the news was broke, nvk immediately started attacking his customers who were victims of his incompetence and calling them liars.
feels like we’ve been hearing about mythos vulnerability exploits for months now… how irresponsible is it than someone selling crypto hardware didn’t immediately run Kimi and Sol to search for vulnerabilities as soon as they were available???
Facts!! refused to take responsibility
He just handled it really badly, not professionally at all, he could have done something. Preferred being miserable and sorry. Wonder if he got swept too.
I think @DarthCoin owns the SN copyright on this one 😀
NVK hated lightning. The POS flow on the coinkite site sucked since forever! But yet I dealt with it for the unique product line”
But I agree with this post. The podcasters and the overall community in general have lead people to the slaughter house with blunder after blunder
We gain education but then are fed products and companies that are dogshit and crush the community and the little economy we do have in bitcoin.
Hopefully we go through the fire to make it better for those coming up behind us. But the LARP is real!
Coinkite didn't even use Segwit addresses, lol.
The signs were there we just choose to ignore them
I like Paul Sztorc's quote 'The last 10 years of Bitcoin have been a disaster'
I don't often agree with a PS's takes, but no lies detected on that one! honestly embarrased to be the "bitcoin" guy in my circles lately, been taking alot of Ls!
I literally never heard of that ever.
Maybe you fell for some advertisements. That's a you issue.
"Supposedly".
Every influencer have been shilling them for years. NVK was always quick to dump on everything else.
Having A hardware wallet, sure. But this one out of the many options available? I have never heard anyone say that this one stood out in any way or form. I find it confusing why you portray such a claim as if it was a general knowledge fact
He's kinda right. Coldcard was marketed as being the most cypher punk Bitcoin maximalist hardware wallet. It was shilled by many influencers like Odel, Marty, BTCsessions etc.
Maybe, just saying I think most would agree CC has been shilled as the solution by a lot of Bitcoin influencers especially after the Ledger and Trezor email leak etc. 11 minute supercut of Bitcoin influencers big and small shilling Coldcard
He's absolutely right imo. If you closely follow Bitcoin twitter, the podcast circuit, youtube etc Coldcard was definitely presented as the ultra-secure, gold-standard cold wallet option.
Fascinating. I have never heard of this and I follow this space some. I know for sure using any cold wallet is highly recommended, but never that this specific one was supposed to be the holy grail.
Yeah that's what makes it even worse. All these people getting rekt were doing what they were told was the right thing to do. "Not your keys, not your coins!". Well these were their keys and they still got rugged. It's really terrible.
I try hard not to listen to "influencers" and to instead make my own judgements.
I don't dispute your point that much of the influence peddling is a LARP.
As I see it, the problem with CC was that it shipped with the ability to create a seed w/o dice.
What I have found to be wild in my short time as a bitcoiner, is advertising. Podcasters who I know dont have technical backgrounds, recomending products that if failed, would have serious consequences for their audience. I have had irl conversations about HWWs, I did not give brand recommendations, even of the brands I use, it seemed unwise. When Bro Jogan podcasters advertise supplements and something goes wrong with the product, the supplements dont work as advertised and dont do anything, instead of someone loosing serious money. It's time for bitcoin podcasters to get some beef jerky sponsorships.
I am not blaming the podcasters for this mess, but I've been annoyed with the lack of seriousness many have taken when it comes to advertising products or services.
The "this is not financial advice" disclaimer leviosa wont be cuttng it after this, thats for sure
You know what I thought this morning, if governments want to attack Bitcoin they don't have to bother. Leave it to us to self destruct by ourselves, we're showing we can do a pretty good job.
And we'll achieve our long stated goal of reducing goverment deficits, cos they won't have to spend any taxpayers money on it.
Other note, very good article here on the technical side of this. There's no other way to say this, it's negligence (polite word for piss poor technical design, execution and testing) by Coinkite.
I use CC and have recommended them to friends and family, not any more. In the process of moving all my funds somewhere else now.
https://wizardsardine.com/blog/coldcard-rng-vulnerability/
Contrarians. Sloptulists. Bitcoin is full of them. If you have average IQ, you can smell them from a mile away. They're such pathetic losers.
You just earned yourself a place in my podcast feed. I'm always looking for people who have some intellectual humility, as well as an interesting perspective.
Thank you. I am taking a small break right now, but hope to begin again soon.
I’ve enjoyed the little I listened to today
Great post. Bitcoiners are learning this year to be skeptical of people who display significant hubris.
We always knew about "slaying your heroes"; it's nice to be reminded of it so painfully. Antifragility
You’re right and thanks for saying it well
I only larp crime
thank you
While I wasn't directly affected, I really feel like i've been LARPING myself!
I even used to talk down on self-custody crypto because I think it is a larp how are you self-custodying something that is centralised, but with this fallout, its a major egg on face moment and yes like many I was asleep at the wheel and outsourcing verification to the wisdom of the crowd
I'm for sure eating humble sauce with my meals from now on
Also known as 'Deterministic Optimism'.
They always leave clues.
I guess 2021 (when the bugdoor was introduced) was pretty weird time in Canada. Couldn't buy food without a vaxx in a lot of places, and everybody from Mayor Doug Ford to your local doctor was griftin'...
Anyhow, they'll be a red notice by now coz it's crypto and not farma or arms.
I agree with you; you should have tested your product with several security companies, since they claim to be the best wallet and we trust them. I believe the attacker went through all the companies doing that and left Coldcard for last, thinking it was the most reliable, and voila! It's a sad day for Bitcoiners!
best I can do is 2
https://github.com/switck/libngu/blame/cf1988aa54969a7d2dcef261ee664a41a7013262/ngu/random.c#L29
Most 'Bitcoiners' and 'Libertarians' are LARPING sheep wannabes.
Or worse, like @DarthCoin malicious frauds.
The desperation of many Stackers to be in the in crowd enables and empowers these fraudsters and conmen.
The HW hype is a hotbed of bullshit.
Just learn how to build your own cold storage.
Its not that difficult.
But no, most 'Libertarians' prefer a branded and hyped 'security' of a third party gadget to making the effort to DIY.
Similarly we have USA waging war on Iran at the direction of its Zionist owners and the petrodollar, and near complete fucking silence from SNs 'Libertarians'.
The whole space is so full of blind conformist stupidity and hypocrisy.