The future won’t wait for you.

@TFTC21

.@Bitkey is fast-tracking coin control after strong customer demand. Product Lead shares an early proof-of-concept for labeling UTXOs and choosing which coins to spend.

@TFTC21

Users are reporting that Coldcard's emergency firmware update is bricking some devices. These reports are anecdotal and have not been confirmed by Coinkite, but if you're planning to update, move your funds off the device first. x.com/northernH0DL/s…

@TFTC21

A good breakdown by @Rob1Ham on how to assess your risk level and next steps if you hold bitcoin on a Coldcard. x.com/Rob1Ham/status…

@TFTC21

A security researcher @1440000bytes flagged a vulnerability in Bitkey's inheritance setup flow. The team responded within hours, confirming no funds were at risk thanks to their defense-in-depth architecture. A patch was submitted to both app stores and they hosted a public X Space to walk through the technical details with the community.

@TFTC21

Asia's leverage boom is unwinding fast. $67 billion in margin debt has been wiped across South Korea, China, and Taiwan since their recent peaks. South Korean leveraged ETFs tied to SK Hynix and Samsung have lost 63% of their assets, down $7 billion. h/t @KobeissiLetter

@TFTC21

A third wave of the Coldcard seed-entropy hack has been identified. 1,367 BTC (~$88.6M) drained across 4,585 addresses in three waves. Funds are 100% unspent, still sitting in the attacker's wallets. Galaxy Research has the full breakdown.

@TFTC21

Galaxy Research is tracking the Coldcard hack in real time. They've identified three waves of sweeps so far: 1,367 BTC (~$88.6M) drained from 4,585 addresses. The first wave hit 1,196 addresses in a 41-minute window, all paying an identical 30 sat/vB fee. Automated key scanning, not owners moving funds. Galaxy notes "the loss profile is dominated by sub-1 BTC addresses in count, but by larger addresses in value. This appears to be the shape of individual self-custody, not institutional holdings." Not one coin taken was created before the vulnerable firmware shipped in March 2021.

@TFTC21

.@KLoaec from Wizard Sardine just published a full technical breakdown of a critical Coldcard vulnerability. Every seed generated on the device since 2021 is compromised. Wallets are being drained right now. The chip has a perfectly working hardware random number generator. Nobody was calling it. "The Coldcard replaces MicroPython's randomness module with its own, deemed more conservative. To do so, it disables the original one... The catch is that MicroPython does not remove rng_get() when that flag is 0. It replaces it with a software imitation." The result: "a Coldcard seed no longer held a single bit of physical randomness." A compile-time safety check should have caught this but used `ifndef` instead of `if`. "One character stood between that safeguard and its purpose." It passed on every build for 5+ years. Seeds from 50+ dice rolls or pre-2021 are safe. Everyone else: move funds now. wizardsardine.com/blog/coldcard-…

@TFTC21

TFTC 778 w/ @hot_town: "The playing field is being leveled. It's no longer limited by technical ability. This opens up whole new economies." We discuss: ⚡ Building with AI agents ⚡ Bitcoin & the agent economy ⚡ Why open source wins

@TFTC21

Gold has closed below its 200-day moving average for 39 straight trading days. The longest streak since 2022.

@TFTC21

Block engineers trace COLDCARD attacker to blockchain services provider. Clay Garrett, engineering lead for @blocks Bitkey, shared that during their investigation of the COLDCARD drain, Block's team identified an unusual pattern in the sweeps that led them to a breakthrough. The attacker used a paid account at a well-known blockchain services provider to query the targeted addresses and perform related activity during the theft. Block contacted the provider directly and their internal logs "matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests." Garrett noted there is no evidence the provider knowingly participated in or facilitated the theft, stating it "was supplying its standard services in response to requests that did not reveal their broader purpose." The team is now sharing the information with authorities and will provide further updates when doing so won't interfere with the investigation. This is a significant development as it means the attacker left an identifiable trail through a service that maintains account records, potentially giving law enforcement a direct lead.

@TFTC21

Conner Brown of @bitcoinpolicy urges Coldcard victims not to destroy compromised devices after the firmware flaw that drained tens of millions in BTC. “If you have a Coldcard that was compromised, do not throw away or destroy the device.”

@TFTC21

.@Bitkey is fast-tracking coin control after strong customer demand. Product Lead shares an early proof-of-concept for labeling UTXOs and choosing which coins to spend.

@TFTC21

Users are reporting that Coldcard's emergency firmware update is bricking some devices. These reports are anecdotal and have not been confirmed by Coinkite, but if you're planning to update, move your funds off the device first. x.com/northernH0DL/s…

@TFTC21

A good breakdown by @Rob1Ham on how to assess your risk level and next steps if you hold bitcoin on a Coldcard. x.com/Rob1Ham/status…

@TFTC21

A security researcher @1440000bytes flagged a vulnerability in Bitkey's inheritance setup flow. The team responded within hours, confirming no funds were at risk thanks to their defense-in-depth architecture. A patch was submitted to both app stores and they hosted a public X Space to walk through the technical details with the community.

@TFTC21

Asia's leverage boom is unwinding fast. $67 billion in margin debt has been wiped across South Korea, China, and Taiwan since their recent peaks. South Korean leveraged ETFs tied to SK Hynix and Samsung have lost 63% of their assets, down $7 billion. h/t @KobeissiLetter

@TFTC21

A third wave of the Coldcard seed-entropy hack has been identified. 1,367 BTC (~$88.6M) drained across 4,585 addresses in three waves. Funds are 100% unspent, still sitting in the attacker's wallets. Galaxy Research has the full breakdown.

@TFTC21

Galaxy Research is tracking the Coldcard hack in real time. They've identified three waves of sweeps so far: 1,367 BTC (~$88.6M) drained from 4,585 addresses. The first wave hit 1,196 addresses in a 41-minute window, all paying an identical 30 sat/vB fee. Automated key scanning, not owners moving funds. Galaxy notes "the loss profile is dominated by sub-1 BTC addresses in count, but by larger addresses in value. This appears to be the shape of individual self-custody, not institutional holdings." Not one coin taken was created before the vulnerable firmware shipped in March 2021.

@TFTC21

.@KLoaec from Wizard Sardine just published a full technical breakdown of a critical Coldcard vulnerability. Every seed generated on the device since 2021 is compromised. Wallets are being drained right now. The chip has a perfectly working hardware random number generator. Nobody was calling it. "The Coldcard replaces MicroPython's randomness module with its own, deemed more conservative. To do so, it disables the original one... The catch is that MicroPython does not remove rng_get() when that flag is 0. It replaces it with a software imitation." The result: "a Coldcard seed no longer held a single bit of physical randomness." A compile-time safety check should have caught this but used `ifndef` instead of `if`. "One character stood between that safeguard and its purpose." It passed on every build for 5+ years. Seeds from 50+ dice rolls or pre-2021 are safe. Everyone else: move funds now. wizardsardine.com/blog/coldcard-…

@TFTC21

TFTC 778 w/ @hot_town: "The playing field is being leveled. It's no longer limited by technical ability. This opens up whole new economies." We discuss: ⚡ Building with AI agents ⚡ Bitcoin & the agent economy ⚡ Why open source wins

@TFTC21

Gold has closed below its 200-day moving average for 39 straight trading days. The longest streak since 2022.

@TFTC21

Block engineers trace COLDCARD attacker to blockchain services provider. Clay Garrett, engineering lead for @blocks Bitkey, shared that during their investigation of the COLDCARD drain, Block's team identified an unusual pattern in the sweeps that led them to a breakthrough. The attacker used a paid account at a well-known blockchain services provider to query the targeted addresses and perform related activity during the theft. Block contacted the provider directly and their internal logs "matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests." Garrett noted there is no evidence the provider knowingly participated in or facilitated the theft, stating it "was supplying its standard services in response to requests that did not reveal their broader purpose." The team is now sharing the information with authorities and will provide further updates when doing so won't interfere with the investigation. This is a significant development as it means the attacker left an identifiable trail through a service that maintains account records, potentially giving law enforcement a direct lead.

@TFTC21

Conner Brown of @bitcoinpolicy urges Coldcard victims not to destroy compromised devices after the firmware flaw that drained tens of millions in BTC. “If you have a Coldcard that was compromised, do not throw away or destroy the device.”