I’m not going to re-explain the RNG bug. That part has already been documented. What I want to know is who exactly was behind switck, and why this identity existed in the first place.

Someone checked the actual Git signatures in the switck/libngu repository. They found 58 commits authored as “Switck” signed with Peter D. Gray’s personal GPG key. The same key also signed commits under Peter’s real name, with both identities being used during overlapping periods. Unless Peter shared or lost control of his private signing key, the obvious conclusion is that GitHub switck was Peter Gray operating under another name.

Now look at the social-media side.

In 2019, u/switck posted: “#defcon seems like a good time to start a new identity. Follow me!”

That tweet is real and still online.

Later, the account promoted switck/libngu, thanked u/DocHex for a merge and said the library might someday be useful on Coldcard.

So the account that announced it was starting a “new identity” was apparently Peter’s alias, publicly speaking to Peter’s main identity as though they were two different developers.

The same thing appears on GitHub. doc-hex opened issues in the switck/libngu repository. In one pull request, doc-hex added four commits, then switck merged them. GitHub lists no reviews.

And this wasn’t some unrelated side project. switck/libngu became part of Coldcard. The switck account introduced a critical piece of the vulnerable RNG path, and doc-hex later integrated libNgU into the Coldcard firmware. Coinkite itself confirms that this migration moved wallet-seed generation onto the wrong RNG implementation.

None of this proves Peter intentionally created the vulnerability, knew it could be exploited or had anything to do with the thefts.

But it is still extremely fucking weird.

Why was a security-critical Coldcard library hosted under a pseudonymous personal account instead of Coinkite or Coldcard?

Did Coinkite know that switck and doc-hex were apparently the same person?

Why create the public appearance of two developers interacting, submitting code and merging each other’s work?

Who independently reviewed the library and the Coldcard integration if the library author and the person integrating it were apparently using the same private signing key?

And why has Coinkite explained the technical bug without addressing who controlled the switck identity?

Peter, if you read this: was switck you?

If it wasn’t, why were dozens of Switck commits signed with your personal GPG key?

If it was, why did you publicly talk to that account as though it belonged to someone else? Did NVK and the rest of Coinkite know? Who was actually reviewing your work?

There may be an innocent explanation. But after this code path left customer wallets vulnerable and people lost bitcoin, hiding behind silence is not an explanation.

I'm reading about people losing their bitcoins because of a flaw with the wallet's random number generator. But how do the attackers/thieves know of all the UXTOs out there, which ones happen to have private keys that were generated with that wallet?

Hi people. I am trying to understand the bitcoin thing as an outsider a bit better.

Since there have been... I don't know how many exactly but, it seems like a LOT of different cryptocurrencies created since Bitcoin has been around.

What do you think that it is that makes BTC persist now and remain so popular all this time since it came out? What are people not able to replicate or improve upon? I would have thought you could just make a different currency that "does what BTC does, but better" but that clearly hasn't worked because people clearly tried with all these altcoins and such.

What is it to you personally that makes you drawn to bitcoin as opposed to some alternative?

My hardware wallet does not have coin control. I now have a couple of unknown dust deposits.

Do I need to be concerned and move to a wallet with coin control to isolate the dust? What can actually happen if I spend that dust. There are plenty of phishing attacks we already have to deal with from data leaks. So following my dust opens up more phishing attempts, but in and of itself it can’t cause issues can it?

Would this concern you enough to switch wallets?

Am i the only one who thinks that perhaps (i repeat, perhaps) the whole coldcard shitstorm happened in good faith? Could it have been "just" a huge, disastrous oversight caused by poor software development practices? I’m not here to excuse anyone. What they did is terrible. But as i read their documentation and the way they try to explain how to stay safe in the crypto world, i sense a genuine passion that clashes with the narrative that it was all an inside job.

I went through the three major all-time highs in Bitcoin's history and how long it took to recover the price after each crash:

• Dec 2013 → dropped 85% → took 4 years to recover
• Dec 2017 → dropped 84% → took 3 years
• Nov 2021 → dropped 77% → took 2 years and 4 months

The recovery window seems to be shrinking each cycle (4 → 3 → 2.3 years), though there's obviously no guarantee the next one plays out the same way.

Interesting extra data point: according to a Bank for International Settlements (BIS) working paper, an estimated 81% of people who buy crypto at some point in the cycle end up losing money — not necessarily because of a bad entry price, but because they don't hold through the drawdown.

So being in the 19% that actually wins is easy — you just need the ability to wait. I don't understand why nobody's talking about Bitcoin right now, when we're at cycle lows and the recovery keeps getting faster each time.

BIS source: https://www.bis.org/publ/work1049.htm

The infamous Lubian hack saw $3.5 billion siphoned off from a Chinese mining pool.

That was just six years ago, and yet a company like ColdCard has learned nothing from the biggest heist in recent crypto history?

The Technical Cause: Weak Entropy
Independent cybersecurity teams, including Arkham Intelligence and the Milk Sad research team, revealed that the hack was not a complex network breach but rather an exploitation of weak cryptographic key generation.

The Flaw: LuBian utilized a flawed pseudo-random number generator algorithm (similar to vulnerabilities found in Libbitcoin Explorer software).

The Exploit: Instead of using a secure, uncrackable 256-bit random number, the wallet software used a highly vulnerable 32-bit seed to generate its private keys.

The Result: This severely lacked entropy, allowing hackers to easily brute-force and replicate LuBian's private keys within just a couple of hours, seamlessly draining the wallets.

There is an active petition for keeping Bitcoin tax free in Germany (after one year hodling). It reached 21.000 signatures within the first 24 hours - let's make it 30.000 to put it on the agenda of german Bundestag.

You need to sign up in order to put your signature but it's worth it.

Everyone can sign - not just germans!

https://epetitionen.bundestag.de/petitionen/_2026/_05/_30/Petition_201716.nc.html

Thank you!

The network processed 20,364,529 transactions in July 2026, making it the second-best month in entire history by transaction count. As new users, institutions, and Bitcoin-native applications continue to arrive, on-chain activity keeps pushing toward record territory.

We think that, it's a remarkable achievement for a network that has been operating for more than 17 years and continues to reach new milestones. Congratulations to everyone contributing to the Bitcoin ecosystem!

I'm not trying to make this an "I told you so" post, but I'll admit that's roughly how I felt reading the Coinkite advisory last week.

Quick recap for anyone who missed it. A firmware integration mistake from March 2021 caused Coldcard seed generation to fall back to MicroPython's software PRNG instead of using the chip's hardware RNG. The build check tested whether a macro existed, not whether it was enabled, and since the value was zero it silently passed. Nothing crashed. No warnings. Seeds kept coming out looking like completely normal 12 and 24 word phrases and nobody noticed for four years. Coinkite's own estimate is around 40 bits of effective entropy on Mk2 and Mk3, and around 72 bits on Mk4, Mk5 and Q, against the 128 bits that should have been there.

On July 30 someone drained 1,196 addresses in 41 minutes. Later on-chain analysis has the total north of 1,300 BTC.

I've never trusted device-generated entropy. Not because I'm smart, but for a genuinely dumb reason: I can't audit it. You cannot crack open a hardware wallet and confirm that the number came out of a real TRNG and not out of a timer register. You just trust it. And trust is the exact thing we spend all day telling each other not to do. Don't trust, verify, except at the single most important moment in the whole stack, which is the birth of the key, where basically everyone just trusts.

I've said this for years and always sounded like a crank. This week made me realize how few of us actually do it, so here's my process. It's much simpler than people expect.

The reasoning

No computer is truly random. It simulates randomness. A die bouncing across a table involves physics nobody can model or predict. That's actual randomness, not an imitation of it. When you roll it yourself and type the result, you stop outsourcing the most critical part of your security to firmware you've never read.

The tool

I use Ian Coleman's BIP39 tool. It's free, the code has been open on GitHub for years, plenty of people have gone through it, and most importantly there's a standalone single-file build that runs fully offline. You download one HTML file and that's it. No server, no network calls, nothing.

Link: https://github.com/iancoleman/bip39/releases

Type that address into the address bar. Do not Google it. I'm serious about this one. I've seen sponsored ads for clones of this tool, and the clone had hardcoded entropy. You generate a seed, everything looks right, you deposit, and the coins are gone. Searching and clicking the first result is a great way to hand your wallet to someone for free.

On the releases page on GitHub, under the latest version (0.5.6), expand assets and download bip39-standalone.html. That single file is all you need.

Going offline

Pick your paranoia level:

• Basic: unplug the machine from the internet. Cable out, Wi-Fi off at the hardware switch if you have one. Only then open the file.
• Better: use a second device. An old laptop you don't use for anything else, no network.
• The annoying level (mine): an amnesic system like Tails booted from a USB stick. It writes nothing to disk and forgets everything on shutdown.

If you're going to skip all of that and open the file on your daily driver with forty tabs open, do yourself a favor and stop here.

Generating the entropy

With the machine offline, open bip39-standalone.html in your browser. It loads exactly like the online version, just without any internet.

1. Tick "show entropy details". A new panel opens with an entropy field and a bunch of technical readouts underneath.
2. Under "valid entropy values include", pick the Dice [1-6] option. It shows an example like 62535634 so you can see the expected format.
3. Grab your die and start rolling. Type each result into the entropy field. No spaces, no commas, all run together.

It ends up looking like this:

6245612344552631245563124563123456311243563212345641... 

As you type, watch the panel below. It updates "Event Count" (how many rolls you've entered) and "Total Bits" (how much entropy you've actually accumulated) in real time. That counter is what you follow, not my guess.

My reference numbers:

• 12 words: you need at least 128 bits. In this tool that works out to roughly 80 rolls.
• 24 words: at least 256 bits. Somewhere around 155 to 160 rolls.

Yes, it's tedious. I put on a podcast and get through it in about 15 minutes. Given what it's protecting, 15 minutes is cheap. And if you overshoot, fine. Extra entropy doesn't hurt anything.

A quick tip on the die: ensure you actually roll it so it bounces. A light, two-inch drop with a warped novelty die creates bias, so rolling more frequently helps to counteract that.

If you're more advanced, the tool also accepts coin flips and playing cards as entropy sources. Same idea. I'm using dice here because it's the easiest for most people to get right.

Getting the seed

Done rolling? Scroll down. Your phrase is already sitting in the BIP39 Mnemonic field. That's it. Just confirm Mnemonic Length is set to whichever you wanted, 12 or 24.

Write the words down on paper, in order, by hand. Don't photograph it. Don't type it into your phone. Don't email it to yourself, don't put it in Notes, don't put it in Google Keep. Paper, pen, in order, then check it word by word twice, paying attention to the ones that look similar.

After that, restore the seed into whatever wallet you trust, hot or cold, and use it normally. If you want to stay fully offline, Electrum or anything else that takes a BIP39 import works fine.

When you're finished, close the browser and delete the file. On Tails, just shut down.

Stuff I do and strongly recommend

• Test before you trust it. Restore the seed in your wallet, confirm the addresses match what the tool showed, send a small amount, try spending it. Only then move real money.
• Do not use the example dice string I pasted above. Obvious, but someone will. That's an illustration.
• Consider a BIP39 passphrase. It's another layer, and in this exact incident a strong passphrase also kept people out of the blast radius.
• Never type an existing seed into this tool while online. The tool is offline by design, but people aren't.

Being honest about the downsides

This isn't a foolproof solution, and I'm not going to pretend it is.

The weak point is that the seed passes through a general purpose computer. Browsers cache, systems swap, there's always some surface. A hardware wallet that takes dice input directly on the device (Coldcard itself does this, which is the irony here) has the advantage that the seed never touches a PC at all. If you have that option, and you trust the device to do the mixing, that's an equally valid path and arguably a better one.

There are other approaches too: hand-picking words from the wordlist, computing the checksum manually, coins, cards. Each one trades off differently between security, complexity, and how likely you are to screw it up. Honestly, the biggest risk across every manual method is the user making a mistake and bricking their own money.

And the obvious point: this isn't Bitcoin only. It applies to anything using BIP39, so most of the rest of the space too.

This is the method I use, trust, and recommend to friends and family. It isn't the only correct one. Do your own research, understand what you're doing before you do it, and above all, store those words properly. Generating the most perfectly random seed in the universe means nothing if the paper ends up in a kitchen drawer or in your camera roll. No generation method survives bad storage.

If you use a different method, drop it in the comments. I'm actually curious how many people here generate entropy by hand versus how many just hit generate and hope.

So Coinkite guidance displayed on the display is: "... each roll adds only 2.585 of entropy. For 128-bit security, which is considered the minimum, you need 50 rolls, and for 256-bits of security, 99 rolls."

They let you press the buttons 1-6 (and only those) for each roll. So you can only use a D6. If you did it 50 times, you think you did the minimum to have 128-Bit security.

Here are my questions:

• The 2.585 entropy per roll are based on entropy values 0-9 (base 10), right?
• If I limit the entropy values to 1-6 (D6 dice) I introduce a massive bias, right?
• Is it fair to assume that the resulting entropy is just 1.67 per roll?
• Is my ColdCard dice genrated seed realy secured by the minimum 128 bit, or more like with just 84 bits?

Look, I'm no expert, indeed hope I'm wrong.

UPDATE: I was wrong - see below.

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

With computers getting faster and more advanced can we no longer trust a 12 word seed phrase?

Starting to have major doubts after Bitcoin Puzzle #135 was brute-forced which is the equivalent of 135-bits of entropy (in comparison a 12-word seed phrase is equal to 128 bits of entropy)

After this coinkite coldcard situation we cant trust code that is open source, we cant trust code that is closed source, and we definitely cant trust a statement saying "we use a TRNG so your seed is secure".

Every hardware wallet manufacturer needs to release hard proof that their TRNG works, their code is complete and robust, and their entropy generation actually meets a minimum 128/256 bit standard.

Even if their code is closed source a reputable 3rd party auditor can run tests on seed entropy generation to statistically prove 256 bits of entropy is being used.

Every wallet manufacturer should have this 3rd party audited proof of entropy document available to view on their website, and if they do not do this by the end of this month we as a community should boycott that manufacturer to help ensure safety for all bitcoiners.

https://x.com/inverse_hanlon/status/2084689208627925384

A CEO who dismissed the threat by name, a pseudonym that turned out to be the CTO, two warnings four years apart, and a company whose entire answer was that it would have already known.

They Sold the Warning

On 21 December 2020 (22 Dec UTC), replying to Bitcoin security researcher Michael Flaxman, who had just posted about hardware wallets eliminating the risk of a retirement attack during seed generation and Rodolfo Novak “NVK” addressed the question head on.

My money is on people screwing themselves out of their BTC before any vendor tries a retirement attack.Alternatively people could just use dice ;) Ten weeks later on 1 March 2021, Coinkite’s CTO shipped a commit titled “First pass w/ libNgU” that routed Coldcard’s seed generation into a software pseudorandom number generator seeded from the device’s serial number and a clock.

NVK’s threat model in December 2020 pointed outward. Users were the risk. Vendors were not. Ten weeks after he said so his co-founder shipped the vendor version and it stayed shipped for five years.

The dice line is the other half: He offered it with a wink and it turned out to be the only thing standing between his customers and total loss. Oops They sold it again

On 10 October 2021: seven months into shipping the defect the official Coldcard account posted that Coldcard makes retirement attacks impossible.

Someone in the replies asked what a retirement attack was. Coinkite answered it themselves. It’s when the project makers could have a “bug” in the entropy generation for later retrieval.

Their scare quotes not mine. By then somebody had already tried to warn them. The escape hatch was optional on purpose Look at what that 2021 post was actually selling: Dice rolls. The documentation it linked to still opens with a sentence that reads differently today; if you don’t trust the TRNGs in your COLDCARD, you can introduce your own randomness with dice. At least ninety nine rolls for a full 256 bits.

But that setting is “opt in” and sits behind the default that looks fine from the outside.It asks the user to press buttons a hundred times to avoid trusting the manufacturer.

Every person who still has their bitcoin took that option, or used a (strong) passphrase, or ran multisig. Every person who got swept trusted the default.

That is the architecture a retirement attack requires. You can’t make the mitigation mandatory because then there’s nothing left to collect. You can’t omit it because the paranoid customers will ask why. So you offer it, document it, recommend at least ninety nine rolls, and let the default do the work. When it detonates the record shows you warned your users, therefore neatly covering your tracks if this was an inside job.

Coinkite built the structure, warned of the attack it enables, and then pushed a firmware with a backdoor for five years.

The pseudonym was the CTO Here is the detail that reorganizes everything else. Coldcard’s crypto ran through libngu, a library on GitHub under the account switck. About six stars. Maintained by one person: apparently pseudonymous. When James O’Beirne audited the firmware that’s what he found: a random number generation for a device holding billions of dollars in bitcoin backed up to what he described as a shady library with six stars maintained solely by a pseudoanon.

Dylan LeClair ran GPG verification against that repo and published the output. James O’Beirne then published a full census: fifty-eight commits authored as Switck carry a good signature from Peter D. Gray’s personal key: the same key that signs nineteen other commits in the same repo under Gray’s own name. The key is expired and the signatures are still good. The RNG selection commit is among them. Signed 28 January 2021, switck published no GPG key of they/their own.

Peter Gray is Coinkite’s CTO and cofounded the company with NVK. Coinkite has never had more than about twenty people and by most accounts Gray wrote the large majority of the firmware.

So switck was Coinkite’s own CTO. Cryptographically proven; not inferred. Every outside reviewer who looked at libngu saw an unaudited third party dependency by an anonymous stranger and worried about supply chain risk. Coinkite’s own people knew it was in house and had no reason to review it as external code.

The use of a pseudonym here means that no one audited that chunk of code. Outsiders assumed insiders had. Insiders knew there was no outside to check.

They were warned in 2021 Five weeks after the commit on 7 April 2021 someone in a Telegram group flagged the change. Their post sounds in retrospect like a man watching a car roll toward a cliff. Roughly quoting:

“The 4.0.x firmware was a radical deviation from every firmware since 2018, with all crypto and BIP39 related code replaced by libNgU. Is it was wise to replace the many-years-old TrezorCrypto code, which has been heavily scrutinized by white hats like Johoe and penetration tested by wallet.fail, with something new. “switck” might be a talented pseudonymous coder, but the commit history is bad” (and they linked to it)

The post sat in a Coldcard Telegram group under an embedded NVK tweet about the 4.0.x upgrade: the same tweet in which he said he doesn’t check Telegram.

That warning posted five weeks after the defect shipped was correct in every single way. Five years and four months before the money starting mysteriously leaving peoples cold storage.

They were warned again in 2025 In May 2025 James O’Beirne audited coldcard/firmware. He wanted to establish conclusively where the RNG was sourced from. He traced it into libngu, found the six-star pseudonymous repo, and was confused about why it was there at all. Because linking libsecp256k1 from Python is easy and that appeared to be the stated purpose.

He sent Coinkite a report. In his own words: he had “doubts about whether the true RNG was actually in use”, and he pointed out that the “hardcoded yasmarang constants in libngu were sloppy”. He advised them to rip the whole thing out and link against libsecp256k1 directly.

That’s the bug! He identified the exact library, constants, and the question of whether the hardware RNG was being used. And he told them to remove it!

Coinkite’s answer, as O’Beirne reports, was that if something was wrong “we’d already know about it by now” and that everything was properly configured for the real boards.

That is not a technical response. That is an appeal to their own reputation offered to a developer who had just traced the code and found otherwise. And in a separate post O’Beirne identifies Peter Gray “@DocHex” as “the same guy that shrugged off my report of the possibility of the defect in May 2025.” The same Gray who wrote the library. The same Gray who was switck.

There was follow-up of a kind. A Signal group titled “LNGU Clean up” was created on 23 May 2025, with members shown as “n,” “Doc,” “andres,” and one other. Doc-hex is Gray. “n” is NVK. So Coinkite formed a group about cleaning up libNgU and named it after the problem. Then they shipped… nothing! Absolutely no fix fourteen months. The group’s messages were set to disappear after four weeks so whatever was said there is gone, just like the bitcoins that were in hundres of hard working peoples Coldcards.

O’Beirne blames himself for not pushing harder. He calls not following up rigorously a horrible mistake on his part.

Hold that next to Coinkite’s public explanation which is that an attacker probably used AI to find something nobody could reasonably have caught. The developer who caught it is apologizing. The company that was responsibly informed is blaming the clankers.

He didn’t know what was in his own crypto library Coinkite’s technical postmortem is worth reading in full because its author is if nothing else candid.

He explains that he set the macro to zero believing it meant neither implementation would be compiled. That is not what it does. And he writes that the bulk of the randomness in the device was coming from a PRNG he did not know was in the codebase at all because it arrived through a submodule. Meanwhile the carefully written hardware TRNG code was still being used, but only by accident and only for things that didn’t matter.

He is describing a submodule he wrote. The company selling immunity to entropy tampering did not know which random number generator its product used for five years. The man who says he didn’t know is the man who authored both sides of the mistake. And the answer when it finally surfaced was that libngu XORed one software PRNG against a second software PRNG seeded from constants hardcoded in public source. Two deterministic streams XORed together produce a deterministic stream. The built in health check rejects adjacent repeated values which any nondegenerate PRNG passes without effort. Those are the same hardcoded yasmarang constants O’Beirne told them to rip out.

Coldcard seeds generated in that window contained no physical randomness whatsoever.

They bought a press release not an audit Peter Todd says Coinkite brought him on in early 2014 as “Chief Naysayer”: an advisory role. Years before the first hardware wallet existed there was a press release. By his account he was given nothing to work on: no tasks, no work to bill for, and then the arrangement quietly dropped. He says it’s still on a LinkedIn profile that he hasn’t logged into in a over decade.

His assessment now in his own words: “if they had kept him on and asked him to audit the codebases, there’s a good chance he’d have spotted the practices at issue, and maybe eighty million dollars wouldn’t have been stolen”. He puts that audit at roughly $50k and asks what Coinkite spent on podcast sponsorships instead.

The company announced that a famous skeptic was reviewing them and then never asked him to review anything. The press release was the product.

All the things they said Coinkite’s public position throughout this crisis has been that it had no idea the flaw existed until the day the money started moving. Two documented warnings and a Signal group named after the problem say otherwise.

NVK’s stated position on attribution: they “don’t have full attribution or scope yet”, and they “won’t speculate until the technical evaluation is complete”. Coinkite then suggested publicly that the attacker likely used an automated tool to comb the public source and find the flaw before they did. That’s speculation. This propisition rests on absolutely no evidence. And it happens to be the only theory of the case in which nobody at Coinkite knew and nobody at Coinkite failed.

You can decline to speculate or you can float the hypothesis that clears you. Doing both inside the same week tells you which one was the priority.

Coinkite told customers it kept purchase data for 90 days. When breach notifications went out they reached buyers going back to 2019. Challenged, the company pointed at a policy page, conceded it has no deletion schedule and said the addresses would be kept “for now.”

A verifiable lie caught within a few days of the largest breach of trust in hardware wallet history, and on a question where the answer was easily verifiable. This speaks volumes of NVK’s character.

The fix broke too On 31 July Coinkite shipped out an emergency firmware update. Three days later a contributor opened pull request #692 against the Coldcard firmware repo, reporting that the hotfix had introduced a new failure on the hardware RNG path.

The entropy fix itself is correct: rng_get() now resolves to the board’s true hardware accessor instead of the software fallback. But rng_get_or_fault() had no recovery path for the STM32’s RNG seed error flags. After a seed error the peripheral stops delivering data and the shipped code never clears the condition; so every later call times out and raises OSError(EFAULT) for the rest of that boot. Because rng_get() now sits on the keypad scan path (an interrupt callback that runs before login) that exception lands before the PIN prompt. Power cycling clears the flags; if the error recurs on the next boo: the user is locked out of the upgrade menu too and the device is essentially bricked.

The original report overstated the stickiness. The flags do not survive a power cycle: so this is not a permanent brick from a single glitch. It is still a serious regression: an emergency patch for a five-year review failure shipped fast that can take the device down before the user can enter a PIN.

692 was closed in favor of #693, a cleaner recovery sequence from a Coinkite contributor, with #698 as the Mk3 follow-up. Both were still open when this was written. The point is not that nobody noticed. The point is that the first hotfix for a five-year entropy failure needed a second round of patches within days. Giving the attacker MORE TIME to execute sweeping funds from vulnerable wallets.

What they’ll say Three objections are coming, and they’re the ones I’d make if I was NVK for sure Galaxy says the waves may not share an operator. True: and irrelevant to the part that matters. Galaxy’s caution is about waves two, three, and four. Once wave one went loud on 30 July the vulnerability was public property and anyone with tooling could pile in. That’s what waves three and four look like. Wave one is the one that tells you something. 1,082 BTC out of 1,195 addresses in 41 minutes with seeds already computed; executed by someone who had been preparing while nobody else on earth knew there was anything to prepare for.

The bug was publicly findable: anyone could have found it. Two people found it in public and said so, in 2021 and in 2025. Both were told it was fine. The set of people who knew this was a live question before 30 July is not the general public. It’s a short list and Coinkite was on it.

A mass sweep is too loud for an insider. It’s too loud for the rational insider who bleeds quietly over years and never triggers a referral. The loudness cuts against a careful inside job. It does not erase the warnings, the Signal group, or their response that if something was wrong they’d already know.

What I think happened Somebody inside that company knew what was sitting in the codebase and knew what it was worth.

Look at the timeline: Ten weeks before the bug shipped the CEO publicly waved off the idea that a vendor would ever run a retirement attack and pointed at dice as the alternative. His co-founder and CTO then wrote a crypto library under a pseudonymous GitHub account with about six stars, and shipped the device’s entire randomness path through it.

Five weeks later someone flagged the swap in a Coldcard Telegram group and was ignored. Seven months after that the company marketed immunity to the exact attack class the defect enables and made the only reliable defense an “opt in”.

Four years in: a Bitcoin developer audited the firmware found the library, named the hardcoded constants, told them to remove the whole thing, and was told they’d already know if something was wrong. They opened a Signal group called “LNGU Clean up,” set the messages to disappear, and shipped nothing. Coins were leaving through 695 transactions nobody noticed. Then somebody who had been precomputing seeds for a long time took 1,082 BTC in 41 minutes.

Each of these has an innocent explanation available. All of them stacked in the same direction inside a company of twenty people. This is not a run of bad luck. Inverse Hanlon’s razor exists for exactly this shape: when incompetence needs that many separate coincidences to line up the same way the incentive is the simpler explanation.

I can’t say for 100% it was an inside job of course: every document that would definititevly prove it belongs to them. The “LNGU Clean up” thread, whatever survived a four week expiration. Whatever code review they ran and when. The commit history around anyone who touched rng.c after May 2025. Roughly 600 attacker addresses are already in front of federal investigators and Coinkite says it’s cooperating. Cooperation is cheap.

Coinkite has apologized, published a postmortem, shipped a fix that needed a second round of patches within days, and offered its customers not a single sat as compensation.

The man who found this in May 2025 is publicly apologizing for not pushing harder. And NVK is blaming AI.

The people who still have their bitcoins are the ones who read Coldcard’s own documentation, saw the line offering them a way to distrust the manufacturer’s randomness, and took it. Nobody told them that one sentence in the docs was the difference between keeping their money and losing it.

I want to see what the general consensus on RIVER wallet is on Reddit.

This has probably been said by others, but I haven't seen it spelled out.

If this hacker created a fresh wallet for every wallet that was sweeped, rather than sweeping them all into a single wallet, how would anyone know which wallets were hacked (aside from the original owner)?

A victim would have to identify the bitcoiner walking around spending their bitcoin specifically. All victims would have to track unique addresses. He could consolidate lots of small amounts into one address, but nobody is going to go to the authorities over those. Meaningful amounts would never be consolidated.

If you have an exchange then all of the original addresses are associated verifiably with a single owner. Sweeping them into many addresses serves no purpose.

But this one... It's weird on so many levels.

To be this intelligent, and to not plan for the other side.

To me this screams of someone using an LLM in a rush, in a fever l vibe coding fever. Or else someone not looking to use the bitcoin, but to make as much noise as possible.

I don’t understand the “self custody is dead” narrative. Self custody is not dead, ColdCard was not “hacked”. An exploit in the RNG for seed phrase generation was discovered and seed phrases were stolen through this exploit.

A hardware wallet’s most important feature is not its seed phrase creation, it’s just a convenient feature.

A hardware wallets purpose is to hold the seed phrase securely and sign transactions offline, transmitting only the transaction data.

Any FUD around self-custody is truly a head in the sand approach, as those who did everything to secure their wealth from a zero-trust perspective (both when it comes to institutions AND software) have nothing to worry about.

Obviously, ColdCard users (such as myself) need to reevaluate their financial relationship with this company and its products, but I don’t think this speaks to self-custody as a whole.

When a big hack like this occurs, it draws other hackers into the playing field. Whenever a vulnerability like this is discovered, it’s open season for hackers. Expect to see more hacks over time.

There is also the fact that a lot of victims are not active on Reddit. Some victims are probably oblivious to what’s going on because their hardware is locked away in a safe.

For the folks that said it would take millions of years to brute force, remember anything that can go wrong will go wrong. The reason banks and financial institutions are “safe” is because even if they get hacked and lose your money, they have a liability to repay you back. With self banking, there is no liability, making you the ultimate pig for slaughter.

Ive been invested for over 10 years and still think Bitcoin and cryptocurrency are incredible technologies, and in an ideal world they’d be perfectly legitimate and practical currencies for everyday use. But with these recent security breaches, along with the lack of broader government and societal support, I don’t see crypto overcoming its current obstacles anytime soon. Because of that, I don’t want to end up in a situation like the Coldcard users affected by this latest breach.

I’m genuinely sorry for everyone who lost significant amounts of money. That’s truly awful. ???? I really hope there’s some way for at least some of the funds to be recovered.

Just curious how many others have used devices like Ledger/Trezor and used them to generate your 12/24 word seed phrases WITHOUT the 25th word, or dice rolling.

I think I am going to get another titanium plate and reroll myself and add 25th word.

Had my AI research Pre-July 2026 Coldcard incident sto see if they are related to the newly discovered entropy bug. My AI agent thinks some incidents are likely to be the same entropy bug with a different attacker.

Went through a divorce a few years ago and had to sell my 4 BTC at about $60k each - naturally, BTC jumped up to $126k shortly after. After several years of fighting debt and reestablishing my retirement, buying a house, and restocking safety funds I’m proud to say I finally received a bonus that didn’t “need” to be used.

So it’s my absolute pressure to share with you all that I purchase 1/2 a BTC this morning. My apologies for the certain major price drop that’s coming. ????????????

I just wanted to take the time to share:

After the COLDcard fiasco, the phishing scams are heating up! Per Trezor, They are seeing an increase in phishing scams and warn users to stay diligent.

NEVER SHARE YOUR SEED PHRASE WITH ANYONE!!

Always verify everything! Hardware wallet companies will never ask you for your seed phrase. Any website or email that asks for it is scamming you and you will lose your Bitcoin. DO NOT ENTER YOUR SEED PHRASE ANYWHERE ONLINE!!!

Take the time to review your security, and verify everything!

Stay diligent friends!

Since the Coldcard failure I have seen some people arguing self-custody is "dead" and that all bitcoin holdings should be through a custodian.

I think this is completely wrong. A failed hardware wallet does not prove that self-custody is the mistake.

The Coldcard crisis shows that controlling your keys doesn't automatically make the solution safe.

A hardware wallet is still a product, and its entropy generation, firmware, components and recovery process can fail.

Moving everything into an ETF avoids some personal key-management risks, but replaces them with institutional, legal and access risks.

The real mistake in self-custody imo is treating any single device, seed or custodian as incapable of failure. For meaningful holdings, custody should be designed so that one failure cannot evaporate the entire position.

Do you think this is a fair assessment, or am I missing something?

I had around 0.08 BTC / $5,000 stored on my Coldcard and that wasn’t even spare cash, it took me months to save. then I checked my wallet and saw "amount lost" gone fck! my seed was never online, the device stayed locked away, and I thought I did everything right.

Now I’m hearing the problem may have started with how some seeds were generated and that honestly pisses me off like its not my fault. I bought a hardware wallet to avoid this exact nightmare.

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

kept saying "i'll do it eventually" forever, mostly just laziness and being scared i'd mess it up somehow. finally sat down and did it last month after reading one too many horror stories about exchanges getting hacked or freezing withdrawals. honestly wasn't even that hard once i actually did it. what made it click for everyone else, was it a specific scare, seeing it happen to someone you know, or just finally forcing yourself to do it one day

Insane week of bad news for BTC.

CC hacks, now up to 60% chance of a rate hike in September, Strategy sells more BTC... and yet, we're pretty much flat.

Dare I start to hope that this is what bottoming looks like?

To be in the bitcoin space to begin with I would think requires a level of critical thinking maybe not the average Joe carries (at least when it comes to money). But somehow bitcoin plebs tend to turn their brain off when they are in the presence of other "high profile bitcoin maxis". Twitter is full of these people, I could name a few but most of you already know all of them. The same critical eye lens you use against the "system" needs to be used against these people until proven otherwise.

They are not like us average Joe. Bitcoin was meant for us. Not for those who use the popularity of bitcoin for their own gain. Let's stop putting these influencers on a pedestal. Stop idolizing. They don't want the best for you and me.

I am surprised it took them so long to send emails to their users.

"Important: Trezor is not affected by the Coldcard hardware wallet vulnerability. Trezor users: your funds are safe.

Hi,

On July 30, Coinkite disclosed an issue affecting wallets generated by certain versions of Coldcard firmware.

Trezor devices are not affected.

Coldcard’s issue relates to the way certain devices generate randomness when creating a wallet. Trezor does not use Coldcard’s firmware or code.

Trezor generates wallets using multiple independent sources of randomness, including device hardware, the connected host and, on newer models, Secure Element chips. With our entropy check feature, you can also verify that your wallet backup is generated randomly.

Who may need to take action

You may be affected if:

Your wallet was originally generated on an affected Coldcard device

You later recovered or imported that same backup created on the Coldcard onto a Trezor

Moving a wallet backup to a different device does not change the backup itself.

If this applies to you, follow Coinkite’s official guidance and migrate your funds to a newly generated wallet backup as soon as possible. Take care to verify every step before moving funds.

Please share this information with anyone you know who may use a Coldcard hardware wallet.

Stay alert for scams

Security events often lead to phishing attempts designed to create fear and urgency.

Please remember:

Never share your wallet backup, aka recovery seed (12/20/24 words)

Only enter your wallet backup directly on your Trezor device during recovery

Trezor will never contact you asking for your wallet backup

Do not follow wallet-migration instructions from unsolicited emails, messages or phone calls

If you are not affected, you do not need to take any immediate action.

Stay secure,"

WHITE HAT DRAINS OF COLDCARD WALLETS BEGIN

The white hat wallet drains of exploitable COLDCARD wallets are now underway, according to @coinjoined

If your COLDCARD was compromised, do not destroy the device. It could be needed if a recovery process is established.

If a white hat secures your coins before you move them yourself, any future claim may depend on proving ownership with your device and KYC records.

Users without a way to verify ownership could face a much harder path to recovery.

I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe ~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff
- Last bull run started after the FTX crash, LFG!
- Nothing stops this train, whatever ever doesn't kill us makes us stronger
- Hardware wallets are a marketing scam
- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must
4. You can never have enough bitcoin

Hadn't this happened I would have probably tattooed those phrases on my chest. But today I am rethinking.. why? Why wasn't 1 BTC or 2 BTC or 3 BTC enough for me? Suddenly, having cash in the bank seems like a good deal. 3rd party custody with a regulated exchange? Awesome! S&P500? Even better! Real estate? Best thing ever. I got greedy and with greed comes hubris.

Take it from someone who went all in and thought he had everything figured out and covered. Reconsider everything, how you store your coins, your investments, your diversification, everything. When FTX happened I was not directly affected, I just felt the market pain. I was naive thinking, well this is why I self custody, this won't happen to me. If you saw the coldcard exploit and thought this won't happen to me, please think again. BTC even today feels like the best risk/reward investment one could enter but the chances of going to 0 because an AI in 5 years will figure out something no one has so far, are not 0.

So maybe I won't give my daughter 5BTC, what I can give her today is time, love and attention and those are irreplaceable. I might get back to 5BTC one day (who am I kidding) but you never get back lost time. Seeing my father suffering today just brought me back to reality. It was just numbers on the screen, surely the screen now reads 0 but I still have my loved ones around.

Seize the day and don't trust anyone, even yourself.

If hackers were able to find these addresses rather easily, and the randomness wasn’t all that random after all, how come there weren’t “random” addresses made for users that were already in use?

Link: https://www.ledger.com/blog-coldcard-incident

TL;DR
Ledger explains that the recent Coldcard incident was caused by a firmware bug that weakened the randomness used to generate recovery seeds, making some seed phrases predictable to attackers.

Updating the firmware alone is not enough if your wallet was initialized with affected firmware. Users must generate a brand-new seed phrase and move their funds to a new wallet. Reusing the old seed on another device does not fix the issue.
Ledger says this vulnerability is specific to the affected Coldcard firmware and does not affect Ledger devices.

The incident is a reminder that secure seed generation is critical for any hardware wallet, and users should keep firmware up to date and follow good security practices.

Hello,

I was thinking about the Coldcard incident and what an attacker who now controls hundreds of stolen BTC could realistically do.

The interesting part is not moving the coins. The blockchain is public, the addresses are known, and every transaction leaves a permanent record.

The real question is: How could an attacker turn such a large amount of BTC into fiat money without exposing themselves?

I came up with two theoretical ideas and would like to hear what people with more knowledge about blockchain forensics think.

The first idea would be extreme fragmentation. The attacker could split the BTC across millions of wallets and create a huge amount of transaction activity. The idea would be to make the connection between the original stolen coins and any future conversion into fiat much harder to establish.

Would something like this actually make forensic tracking significantly harder, or would analysts still be able to identify patterns because the entire transaction history remains visible?

The second idea would be cooperation with a powerful external actor, for example a state actor or organization with its own infrastructure and resources. Instead of trying to solve the problem only through technical methods, the attacker could rely on an entity with different capabilities and incentives.

Would something like this actually solve the problem of converting stolen BTC into usable wealth, or would the transparent nature of Bitcoin still make it difficult?

I am curious what others think.

What other options would a sophisticated attacker consider? Do these ideas make sense from a forensic perspective, or am I missing important factors?

In the early 70s, Ford rushed the Pinto to market under intense competition they were facing from cheap foreign imports. The Pinto's design cycle was hurried and unfortunately shipped containing a design defect where the fuel tank was positioned too close behind the rear axle of the car. This design made the car vulnerable to rear end collisions and greatly increased the likelihood of the fuel tank being punctured by the rear axle during a crash, causing the vehicle to catch fire and even explode.

To make matters worse, Ford allegedly became aware of the defect, but decided (in a later discovered memo) that it would be cheaper to settle wrongful death and injury lawsuits, than to fix the cars. As it turns out, the defect did cause injury and death, and after years of investigations and lawsuits, Ford was eventually found civilly liable (Grimshaw v. Ford) for the engineering defect and was forced to pay punitive damages to its victims. They were also charged criminally for the burn deaths of three teenagers in 1978, but were acquitted on those charges in 1980. They ended up recalling 1.5 million vehicles affected by the defect, that its own engineers claimed would have only cost only $11 to retrofit. It remains one of the most commonly taught case studies in business schools today.

There is much more to the Ford Pinto case if you are interested, but the main reason I am sharing this story is to illustrate that when a product is used as intended, at a certain point liability must shift from the user to the manufacturer. People who purchased Ford Pintos in the 70s had a reasonable expectation that the fuel tank was designed with safety in mind and wouldn't spontaneous combust from a common fender bender.

Likewise, Coldcard users had a reasonable expectation that the seed generation tool developed for their device would produce adequate entropy on par with industry standards in Bitcoin/cryptography. They should not be expected to audit every line of code to check for errors, just like Ford Pinto owners should not have been expected to measure the distance between their fuel tank and rear axle before driving the car.

We have this tendency in Bitcoin to be overzealous when it comes to personal responsibility/accountability. I do not think that's a bad thing per se, but there HAS to be a point where a user can reasonably say they did everything in their power to prevent something like this from happening. At SOME point, the liability for a commercial product to prevent damages must fall on the company and its engineers who designed the product, even if open source.

I think Coldcard users being expected to understand how to read code, much less review it and locate such a defect, is as unreasonable as expecting people to measure the distance between their fuel tank and axle. My condolences go out to all who are affected. This should have NEVER happened to coins in cold storage.

Sorry for the noob question, i have been using blue wallet for last year or so. I knew going to cold wallet was the next step so i had ordered cold card a month ago but it was stuck in customs so i just got it last week. I Understand its not safe if you already have the funds in cold card but what about generating new wallet?

please be kind, i am new and have been slowly saving in bitcoin

This is the wild west.

Crypto isnt mainstream and we are still in the pioneering days of crypto.

Its not easy and there isnt many rules or regulations.

Disasters like the coldcard incident is to be expected and the risks are what you sign up for.

Where these people came from thinking owning crypto is safe and easy, I dont know.

Too many normies and noobs in the space.

Got the email from CK today, thought its a scam, but the sender address is valid and I found other folks as well reporting about those emails.

This whole company is a bunch of liars.

I still cant understand how such a product in such a company, with that much reputation had zero quality management.

Its such an epic fail, I cant believe this happened not on purpose…..sorry, but that is so fishy.

I’ve been in Bitcoin since December 2025. 3-4 years ago, during a major correction, I told myself I wouldn't miss the next dip.

When Bitcoin pulled back 30% from its ATH, I finally pulled the trigger. My strategy from the start was to dollar-cost average down, so here I am preparing for my next buy while currently sitting at a -23.8% unrealized loss.

I’m strongly convinced we’ll see a solid rally starting this winter, and I want to position myself properly before then.

All the recent FUD surrounding hacked wallets isn't going to stop me from accumulating.

Current allocation:

0,21110064 BTC

(~11,60% of my whole portfolio)

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle.

I understand the 1,000 or so stolen coins from Coldcard wallets is a drop in the bucket and lots of people are saying it’s being overblown or whatever.

I just can’t seem to get it out of my head that the victims did absolutely nothing wrong. Next thought is obviously, “are my sats safe?” (using one of the current cold storage giants)

For someone like me, who is the farthest thing from a blockchain expert I wonder if it’s even worth the 1 in 1 million chance at this point.

Yes, I believe in self custody. I’ve read The Bitcoin Standard. I like the idea of changing the financial system for the better. What I don’t want to do is worry about a significant percentage of my small net worth being drained by a technology I don’t even fully understand..

I don’t want to have to jump through hoops in a world I don’t feel fully comfortable with if there is an alternative..

As much as I believe in self custody, I mainly invest in Bitcoin because I believe the value will increase.. I already own shares of IBIT in a Roth IRA.

Why not just sell my sats and reinvest the money into shares of IBIT in my taxable brokerage?

Looking for real answers here. I know this community can get passionate and I get that. I’m just an average Joe here looking for how other average Joe’s are feeling, as well as some input from the experts!

Sorry if my thoughts aren’t totally organized..

I generated my keys and made transactions using Coldcard MK3 and I thought it was the ultimate, air gapped solution to protect my BTC

I thought it was one of the most sophisticated but worthwhile solutions to make me sleep better at night knowing my keys were safe.

Out of chance not that long ago I moved over 3 BTC out of my Coldcard generated key to Kraken so I can trade for a bit then move it back.

I only left a tiny amount in that key and it ended up being drained.

I don't know if I should consider myself lucky or not

Cold card… I’m trying to be calm and I’m not even panicking. I’m not in the US and I’m following every advice. I’m afraid that I will collapse after this. What the hell i can do??? Help!

I mean it. Reach out to friends, family, anyone you trust. Do NOT destroy your ColdCard. If funds are recoverable at some point, they will probably be sent back to their original owners.

If you are isolated, feel like something could go wrong or else, please please please reach out to someone. https://findahelpline.com

Don’t keep things to yourself. You’re gonna need to talk about it. Time always does its thing. And yes, you can believe that the Bitcoin community is going to be ferocious on this one. If you have the courage to do so, you can always take a look at X. But you don’t have to. What matters most is you.

Take care of yourself people.

I've been where some of you are today. During the FTX collapse, I lost over $2 million USD. The cascade triggered margin calls, then liquidation. In what felt like an instant, six years of stacking disappeared. (Can send proof to mods if needed)

I remember the disbelief, the anger, the sleepless nights, and asking myself, "What now?" Here's what I learned: money can disappear overnight, but your knowledge, your work ethic, your experience, and your ability to rebuild cannot be liquidated.

If you were affected by Coldcard's wallet exploit, I'm genuinely sorry. Don't make irreversible decisions because of a financial loss. Reach out to family, friends, or your community. Take a breath. The charts will move again. Opportunities will come again. Your portfolio is not your identity. Your net worth is not your self-worth.

Tomorrow, the sun will rise again. And as long as you're here, you still have a chance to build something even greater than what you lost.

As a thought experiment, suppose a white-hat had been the first to discover the Coldcard RNG vulnerability. How could they possibly have disclosed it responsibly, given that weak seeds had already been generated?

A public warning would immediately create a race between legitimate owners and attackers (as happened in reality). Because the firmware source code is openly available, even a vague warning like “Coldcard-generated seeds may be vulnerable; move your BTC immediately” would immediately tell attackers where to look for the vulnerability and then exploit it.

You could instead warn Coinkite privately, but that would not solve the underlying problem. Even assuming Coinkite could be trusted to handle the information properly, it would have no better way to protect affected owners. It would eventually have to issue a public warning, creating the same race. “Silently” patching the vulnerability would effectively be the same as publicizing it, as the patch itself would identify the flaw.

Another alternative would be for the white-hat to sweep all the vulnerable funds first, but then how could they return them? Once the flaw is public, a signature from the compromised key no longer proves legitimate ownership, since an attacker can derive the same key.

Remaining silent would probably be the worst option, because more vulnerable seeds would continue to be generated.

There do not seem to be any good options here, but what would the least bad approach have been?

You probably heard the birthday paradox, having 23 people in a room creates a 50% chance that at least two of them share the same birthday.

Applying it to the vulnerable search space in the ColdCard bug (Following reports that search space was reduced to 2^32, approx 4 billion)

50% collision odds ≈ √(2 × 4.3 billion) ≈ 93,000 ColdCard Wallet Generated Seeds.

If this bug was somehow never discovered and Coldcard sold around 93k units that generated a seed on the vulnerable firmware, there would be a 50% chance that two innocent, unaware people would end up with the exact same seed phrase, and by extension every bitcoin address derived from it, giving each other access to the others funds.

Just a fun thought experiment in these dark times.

This is a tough week for bitcoin community. Wishing speedy recovery of funds for everyone involved.

Lessons learned for the rest:

1. Hardware wallets - were always a vector of a possible attack. Just like you can't trust 100% your ISP, your PC and your phone, same goes for hardware wallet.

2. To protect yourself, always use a passphrase. It makes these kinds of exploits million times more difficult, if not impossible.

3. If you have any significant funds, you must have a passphrase. If you don't, you haven't done your homework.

4. Coldcard is the only wallet that was impacted by the seed-generation issue, you are perfectly fine if you didn't create a seed on Coldcard. Trezor, Ledger and other wallets don't share the same firmware as Coldcard.

5. I wouldn't recommend Coldcard at this point but the device itself, as far as we know, is still perfectly fine but you need to realize that company is most likely going out of business, so won't be getting much support or updates from them after this.

6. Apple, Microsoft, Meta, Oracle and other firms had bugs in their code that allowed people to steal stuff. Coinkite had a bug in the code as well that allowed a nasty exploit. Bitcoin doesn't have a bug in its code.

7. Self-custody is not for everyone. If it is easier for you to let someone else manage keys, you can/should explore those options. But companies and governments fail and it happened many times in the past as well, so nothing in life is 100% guaranteed.

Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it.

You can generate a BIP39 seed entirely from physical dice:

- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.

- 50 rolls ≈ 128 bits → a 12-word seed.

The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it.

Why bother?

1. You control the entropy source. Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution.

2. The seed is born offline. It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate.

3. It forces you to understand what a seed actually is — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig.

I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: https://self-custody.cc/ — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES.

Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why.

I thought sharing this would help anyone who lowered their confidence in BTC; here is the btc hack timelines.

2011 – 25,000 BTC stolen from mt gox

2012 – 24,000 BTC stolen from linode-hosted Bitcoin services.

2014 – 850,000 BTC lost/stolen in the collapse of mt gox

2015 – 19,000 BTC stolen from bitstamp

2016 – 119,756 BTC stolen from bitfinex

2017 – 4,700 BTC stolen from nicehash

2018 – 7,000+ BTC stolen across multiple exchange hacks.

2019 – 7,000 BTC stolen from binance

2022 – ~3,300 BTC exposed in thefts related to the ftx collapse.

2024 – 12,000+ BTC stolen from dmm bitcoin (Japan).

2025 BTC hits an all time high regardless.

2026 - Coldcards

Despite that; Bitcoin hit 126K in 2025.

Believe guys. This time isn't any different than last time. BTC will hit higher and higher.

Took me years of DCA’ing to get there. I went with Coldcard because it was marketed as “ultra-secure.” I knew multisig was technically safer. I wasn’t worried about my key being guessed… I was worried about someone physically stealing it or it being destroyed.

So that was the plan: 1 BTC, cold storage, steel plate backup, fire bag, fire safe. And then… wait.

I hit the goal. I finally felt content.

Now I just feel embarrassed. Like I let my family down.

The worst part? I know Bitcoin isn’t going anywhere. I’m not hoping it fails… I think it’s going to keep making new all-time highs, and every time it does, I’ll be sitting here thinking about what could’ve been.

** I originally brain dumped my story to Claude to make it sound better because I have poor grammar. I’m admitting this in an edit at my own expense or whatever. I’m not embarrassed about my poor grammar or using AI to improve it. That said, in hindsight, it would have been more personal to not have done that. I’m sorry.

Just saying sorry, i know some people get out their soap boxes, some point fingers, some laugh.

For the ones that just woke up and had their lives turned upside down and stressing out, its going to hurt, but tomorrow will be another day. Sorry you are having to go through this.

Like many of us, I have followed the news of the Coldcard disaster. It has left me stunned and I feel terrible for everyone who has lost their hard earned BTC. After thinking about it consistently since it happened, I believe this case is challenging the concept of Bitcoin in its core and I'm curious how others look at it. Let's have an honest discussion about what it means for the future of the space. Here are my main points:

1. This is totally different from most other cases, because the affected users didn't do anything wrong. It was a complete fuck up on Coldcard's side. For years we told ourselves self storage is the only way, never leave it on the exchanges, not your keys not your coins, don't trust verify etc. But in the end you have to trust something or someone, in this case the people behind CC. Now everyone says Ledger or Tresor is safe just because they were not the ones affected. How do you actually know this? You would have said the same thing about CC a few days ago.

2. The danger of AI is absolutely real and will only increase. Without knowing the method in this case, it's likely that some form of AI was involved. The code for CC was not open source, but still viewable by everyone. It's mind-blowing that it took several years for the flaw to be discovered and exploited. Don't expect this to take so long next time. I'm not an expert in coding or cryptography, most users aren't. So in the end you just have to trust the code. Sure, it can be tested with AI too. But do I really want to expose all my holdings to this battle just hoping that it will be fine in the end? It feels way too risky and out of your control.

3. Mass adoption is absolutely not going to happen this way. I'm a nerd and enjoy the technical side of it, but even I feel overwhelmed by this. The average person is much less interested and willing to put in the work. For years we've been saying good solutions for self storage, payments and so on will be found. I don't see it. It seems to become more complicated than less. So what's the alternative here? Keeping it on the exchange, buying an ETF? It doesn't solve the trust issue and contradicts pretty much everything Bitcoin stands for. Just another asset class among many.

I still love the idea behind Bitcoin and believe in the concept. But I struggle to find good and honest answers to these points without just repeating the same old mantras we've been telling ourselves. What do you think?

TLDR: coldcard decided to move from open source licensing to a "source available" license that would prevent people from forking their firmware to make competing products. This meant they needed to replace GPL license crypto libraries, it is this refactoring that created the opportunity for them to screw up. Because of their corporate greed that decided to do this rather than continuing to build features on top of true OSS licenses.

Body of tweet:

Regarding the Coldcard entropy bug – many folks are explaining what happened but I wanted to take a minute to explain why it may have happened.

It's a disastrous situation and our heart goes out to all the Bitcoiners affected.

Here's a timeline of events:

On July 28 2020: @FOUNDATION announced our first Passport hardware wallet and noted that we were building on Coldcard firmware which at the time was GPLv3 licensed (FOSS license).

On July 30 2020: NVK publicly said he regretted choosing GPL because Coldcard now had a “clone” and that they would change things in future updates. https://x.com/nvk/status/128

8860345864527874

On November 18 2020: Coldcard added its MIT + Commons Clause license, prohibiting commercial products substantially derived from the software.

https://github.com/Coldcard/firmw

are/commit/b6b9191145d37fbb6d754597350653141596dd12

On January 8, 2021: Coldcard firmware 3.2.1 formally announced, “License changed from GPL to MIT+CC on files for which the GPL doesn’t apply.” CC is the "Commons Clause" license addendum which is "source available" instead of FOSS.

On March 1, 2021: The “First pass w/ libNgU” commit removed the GPL

@Trezor-derived crypto libraries and replaced them with libNgU. That same 120-file commit changed seed generation code. libNgU was licensed with a novel “Licensed for Bitcoin Only” license.

On March 17, 2021: Version 4.0.0 announced that all crypto and BIP39 code had been replaced and that the “last remaining GPL code” was removed. https://blog.coinkite.com/version-4.0.0-

released/

https://github.com/Coldcard/firmw

are/blob/b18723dddb6d751c39978e4364b56b2414f68b47/releases/ChangeLog.md#L12

Our best understanding right now is that the entropy bug was collateral damage from this major overhaul of the codebase.

To be clear, this overhaul was not solely about licensing. Coldcard also cited technical goals including adopting Bitcoin Core’s libsecp256k1, faster AES and SHA implementations, and reproducible builds.

But the timeline establishes two things:

(1) Foundation’s launch was the obvious impetus for Coldcard’s licensing change, and

(2) removing the remaining GPL code was an explicit goal of the subsequent v4 rewrite.

We don't know by how much the licensing pressure affected the scope or timeline of the rewrite. All we can determine is that the entropy bug was introduced inside the same 120-file commit that removed the old GPL code dependencies.

Spread your coins across multiple devices from different vendors.

Reduce the blast radius.

None of us here are reading the code. We assume someone else is. With AI getting better and better, we should expect more hacks coming.

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

The long and the short of it is that a developer disabled a compiler flag out of desperation in order to get the code to compile, then committed it with the commit message "runs". Specifically, in C: #define MICROPY_HW_ENABLE_RNG (0)

In other words they deliberately disabled hardware RNG.

You can read the full breakdown here: https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

The amount of negligence on display here is shocking, and the fact that it went unnoticed for years is just salt in the wound.

I had hardware wallets, I have all my BTC on Ledger for a long time.

And every time there was a firmware update, I had a heart attack.

Every time the software updated and I had to relog in, I panicked.

Every time I had to re-download the BTC app, I sweated through my shirt hoping my BTC would show back up.

I hoped my device wouldn't short out or fail. I realized I couldn't use any USB-C on the device, that was a tough day, I thought I lost access to my Ledger.

I was praying the business wouldn't go under, blocking access even for an instant.

I worried about someone stealing my Ledger, my phrases.

I prayed every time I made a transaction because it was all on me with basically no re-course.

And now, It's all on Coinbase and Robinhood.

I was not hacked this weekend, nor will I be. I have all my funds available right now, and I'm not losing any sleep.

Please stop overthinking this, you're not some dark web hacker who needs to be able to go-bag your BTC and escape to Argentina under the cover of night under complete anonymity assuming you'll never log into your old accounts again. It's not that serious, Fidelity will not go under like Mt. Gox or the other trash crypto companies.

Move it to a major brokerage, and have a good night of rest.

*This is general advice, some of you have legit reasons for using Cold Wallets, but for the vast majority my advice is sound.

I can’t believe how many people leave mean comments, gloating about how they always knew that Bitcoin is a scam, and so on.

Seriously, how sad of a life one must live to be happy about the misfortunes of others? Some people have lost important amounts of BTC, including people from poor countries or poor backgrounds who will suffer for years as a result of this.

If someone feels like gloating is the right thing to do here, why don’t you go to the ICU of the closest hospital and laugh about sick and dying patients? It wouldn’t be much different, think about that.

Hi, Yesterday was one of the worst days of my life. I found out that just over 3 BTC was stolen from me through the Coldcard vulnerability.

I know some people think posts like this are fake. Mine isn’t. Real people are getting hurt by these thieves.

I did what I thought was the responsible thing. Back in 2022 everyone said the same stuff, get it off exchanges, get it into cold storage, use the best hardware wallet you can. Coldcard had a reputation as one of the best. It wasn’t the easiest thing to use but honestly that kind of made me trust it more. So I moved everything onto it.

For years I DCA’d $250 a week, plus bigger amounts when I could. Never touched it, never even checked on it. I thought I was doing the smart, boring, responsible thing.
Now it’s just gone. All of it.

Looking back I probably should’ve split it across wallets, or maybe just left it on Coinbase. I already know the multisig and don’t put it all in one place comments are coming and yeah, that’s probably good advice. But I did what I thought was right at the time based on what everyone in this space was telling me to do. That’s what makes this sting so bad.

I’m angry and honestly feel sick about it. Not sure what to do next. Posting this so people know it’s actually happening to real people. Happy to answer questions if anyone has them, and if you own a Coldcard, go check on it right now.

Ever since Bitmart announced their wind-down, all withdrawals have been frozen or instantly rejected upon submission. Thousands of us are stuck in this mess with zero communication from their end.

To make matters worse, they have now completely disabled OTP messages.

A group of us are actively filing reports and reaching out to legal firms. I’m posting this to raise awareness and urge the community to look into the situation we need all the reach we can get right now..

1. https://x.com/2wwd_/status/2082044762627178664
2. https://x.com/travladd/status/2083600176359547358

I still cant belive what happend honestly. Im still in shock.

I had 3.533382 BTC that i moved into my Coldcard because everyone always says hardware wallets are the safest. I thought i was doing everything right and taking security serious.

2 days ago, i checked my wallet and it was just gone. All 3.533382 BTC gone. I kept refreshing thinking maybe it was some bug or something but nope. The transaction was already confirmed and there was nothing i could do.

I honestly dont even know what went wrong. Ive been replaying everything i did over and over in my head trying to figure it out. I barely slept since it happend. That wasnt just money to me, it was years of saving little by little.

Im not posting this for pity, just because i honestly feel sick and i dont want anyone else going through this if they can avoid it. If anyone has any idea what could of happend im open to hearing it because right now im completely lost.

I see a lot of people here wondering what to do at this point and whether trusting Coinkite moving forward is possible. Here is my take:

Unforgivable sin #1

This bug was a integration mistake, not a complex crypto flaw. It should have been easily caught by basic build time assertions. It's a huge oversight and unforgivable for a company whose very existence is based on security.

Unforgivable sin #2

The most damning issue here is that Coinkite, a company that primary and ONLY premise is the development of a secure HARDWARE device does not test the output of that hardware at runtime. The fact that they didn't check that the output produced by the seed generator passed through standard randomness battery tests is wild! They would have instantly noticed that the outputs were coming from a deterministic PRNG if they bothered to test.

Unforgivable sin #3

At the end of the day, a hardware wallet only has one job. Generate true randomness. All coldcard wallets failed at this. Yes, you could say the bug is hard to spot, especially when doing static code analysis. The code is open source and has been subject to audits, but integration tests should have discovered this flaw before the affected firmware was ever published.

The theory that this bug was discovered by AI is also a side track and completely irrelevant. This was not a complex vulnerability.

https://np.reddit.com/r/coldcard/comments/1vcfugv/coinkite_is_done_for_here_is_why/

Edit (more details):

ColdCard migrated to a different elliptic curve library in 2021. That library had a fallback to a software PRNG. The code checked if a specifc macro was defined (MICROPY_HW_ENABLE_RNG).

If the macro was defined but set to a value of 1, the library would use it's generic STM32 driver for RNG.

If the macro was not defined, the compiler would throw an error, forcing devs to fix it.

In this case, the macro was defined but set to a value of 0. That bypassed the compiler error but resulted in the library using it's fallback software RNG instead.

Coinkite erroneously assumed setting the value to 0 would tell the library to disable it's internal RNG driver and let the custom board-level RNG driver handle all entropy calls across the entire system.

In the hot fix Coinkite has a script that checks the generated symbol table and asserts that whether the rng_get() symbol originates from the coldcard board directory and throws an error otherwise. There are several other ways they could accomplish the same thing.

https://np.reddit.com/r/coldcard/comments/1vcfugv/coinkite_is_done_for_here_is_why/p11ge3v/

I see a lot of people here wondering what to do at this point and whether trusting Coinkite moving forward is possible. Here is my take:

Unforgivable sin #1

This bug was a integration mistake, not a complex crypto flaw. It should have been easily caught by basic build time assertions. It's a huge oversight and unforgivable for a company whose very existence is based on security.

Unforgivable sin #2

The most damning issue here is that Coinkite, a company that primary and ONLY premise is the development of a secure HARDWARE device does not test the output of that hardware at runtime. The fact that they didn't check that the output produced by the seed generator passed through standard randomness battery tests is wild! They would have instantly noticed that the outputs were coming from a deterministic PRNG if they bothered to test.

Unforgivable sin #3

At the end of the day, a hardware wallet only has one job. Generate true randomness. All coldcard wallets failed at this. Yes, you could say the bug is hard to spot, especially when doing static code analysis. The code is open source and has been subject to audits, but integration tests should have discovered this flaw before the affected firmware was ever published.

The theory that this bug was discovered by AI is also a side track and completely irrelevant. This was not a complex vulnerability.

https://np.reddit.com/r/coldcard/comments/1vcfugv/coinkite_is_done_for_here_is_why/

Edit (more details):

ColdCard migrated to a different elliptic curve library in 2021. That library had a fallback to a software PRNG. The code checked if a specifc macro was defined (MICROPY_HW_ENABLE_RNG).

If the macro was defined but set to a value of 1, the library would use it's generic STM32 driver for RNG.

If the macro was not defined, the compiler would throw an error, forcing devs to fix it.

In this case, the macro was defined but set to a value of 0. That bypassed the compiler error but resulted in the library using it's fallback software RNG instead.

Coinkite erroneously assumed setting the value to 0 would tell the library to disable it's internal RNG driver and let the custom board-level RNG driver handle all entropy calls across the entire system.

In the hot fix Coinkite has a script that checks the generated symbol table and asserts that whether the rng_get() symbol originates from the coldcard board directory and throws an error otherwise. There are several other ways they could accomplish the same thing.

https://np.reddit.com/r/coldcard/comments/1vcfugv/coinkite_is_done_for_here_is_why/p11ge3v/

I see a lot of people here wondering what to do at this point and whether trusting Coinkite moving forward is possible. Here is my take:

Unforgivable sin #1

This bug was a integration mistake, not a complex crypto flaw. It should have been easily caught by basic build time assertions. It's a huge oversight and unforgivable for a company whose very existence is based on security.

Unforgivable sin #2

The most damning issue here is that Coinkite, a company that primary and ONLY premise is the development of a secure HARDWARE device does not test the output of that hardware at runtime. The fact that they didn't check that the output produced by the seed generator passed through standard randomness battery tests is wild! They would have instantly noticed that the outputs were coming from a deterministic PRNG if they bothered to test.

Unforgivable sin #3

At the end of the day, a hardware wallet only has one job. Generate true randomness. All coldcard wallets failed at this. Yes, you could say the bug is hard to spot, especially when doing static code analysis. The code is open source and has been subject to audits, but integration tests should have discovered this flaw before the affected firmware was ever published.

The theory that this bug was discovered by AI is also a side track and completely irrelevant. This was not a complex vulnerability.

https://np.reddit.com/r/coldcard/comments/1vcfugv/coinkite_is_done_for_here_is_why/

Edit (more details):

ColdCard migrated to a different elliptic curve library in 2021. That library had a fallback to a software PRNG. The code checked if a specifc macro was defined (MICROPY_HW_ENABLE_RNG).

If the macro was defined but set to a value of 1, the library would use it's generic STM32 driver for RNG.

If the macro was not defined, the compiler would throw an error, forcing devs to fix it.

In this case, the macro was defined but set to a value of 0. That bypassed the compiler error but resulted in the library using it's fallback software RNG instead.

Coinkite erroneously assumed setting the value to 0 would tell the library to disable it's internal RNG driver and let the custom board-level RNG driver handle all entropy calls across the entire system.

In the hot fix Coinkite has a script that checks the generated symbol table and asserts that whether the rng_get() symbol originates from the coldcard board directory and throws an error otherwise. There are several other ways they could accomplish the same thing.

https://np.reddit.com/r/coldcard/comments/1vcfugv/coinkite_is_done_for_here_is_why/p11ge3v/

All hope is not lost. It looks like they know who did the attack on the cold wallets:

The attacker did make one mistake, however.

Block's Clay Garrett said on X that the operator used a paid account at a “well-known blockchain data provider” to query the source addresses during the sweeps, and that the provider's internal logs matched the suspected workflow with what he called extraordinary specificity, down to the number, timing and sequence of requests.

https://www.coindesk.com/tech/2026/08/01/how-bitcoin-cold-wallets-lost-usd70-million-in-an-attack-that-never-touched-the-devices

Just wanted to put out a serious warning for anyone updating their Coldcard Mk4 to fix the recent RNG/seed generation vulnerability.

I followed Coinkite's urgent advisory to the letter: updated to the new hotfix firmware 5.6.0, wiped my old seed, and generated a brand-new one. I even tested it, created two BIP-39 passphrases, and everything seemed fine at first.

But then, the premium "Don't Trust, Verify" experience kicked in.

While I was testing the passphrases—literally just entering the words and clicking apply—the device threw a critical MicroPython software crash error pointing directly to `seed.py` and another method. To be precise, I had done this exact same process successfully several times just before it happened, so it doesn't look completely deterministic, but the bug is definitely present and lurking in the code.

I had to power cycle it, and guess what? The screen now permanently reads "BRICKED". No recovery mode, no factory reset, just a hundreds-of-dollars paperweight. I bought a bundle of 2 units directly from their site, and one is already dead due to their rushed code.

If you are running the new firmware and messing with passphrases, PLEASE BE CAREFUL. This hotfix seems to have a catastrophic bug that permanently hard-locks the secure element or the firmware during passphrase application.

Hey Coinkite, I thought Coldcard was the ultimate, unbreakable fortress for paranoid Bitcoiners? Fixing a critical seed generation vulnerability with a firmware bug that literally kills the hardware is quite a strategic move to sell more devices!

This is completely unacceptable for a premium security device, also given what is happening. Anyone else experiencing crashes or weird behavior on the new firmware?

Lmk.

I think everyone is missing the economics of this attack.

The attacker isn’t trying to brute-force your passphrase.

They’re generating vulnerable seeds as fast as possible and checking whether those seeds control any bitcoin.

The moment you add a BIP-39 passphrase, every candidate seed now requires deriving and checking an additional wallet. Even a passphrase that would only take an hour to brute-force in isolation completely destroys the attacker’s throughput when applied across millions or billions of candidate seeds.

Realistically, they’ll check no passphrase, and maybe a tiny list of extremely common ones. Anything beyond that makes the attack economically unattractive.

That’s why I suspect the overwhelming majority of victims will turn out to be users who didn’t use a BIP-39 passphrase at all.

After the Coldcard exploit. How safe are other Wallets like Trezor, Ledger etc.

Can we all finally come to a consensus that leaving your coin on an exchange or buying ETFs may not be a bad idea for like 90% of bitcoin holders? For years i was mocked for leaving my coins on an exchange, yet I haven't had issues with stolen or hacked coins one bit.

Yes, as the title says, I've been stacking up for a while now with serious DCA'ing this year.

However, new requirements in my business meant I needed the cash.

BTC is a great long term investment but short term, especially now, I couldn't justify it.

I'm expecting a $1M valuation in the next 24 hours knowing my luck with this thing haha.

To the long term holders, good luck and keep going. I stand strong with my belief that on a long enough timeline you can never lose with this.

There's very few things that guarantee that same certainty.

I believed in Bitcoin. Holding it gave me peace of mind because my country has faced several FATF sanctions. I was glad to find a kind of money that cannot be censored or debased because I just want to protect myself from the money printing and my country's weak and inflated currency comapred to the dollar.

I’m 39, and I was hoping to have a good financial cushion before 50. But today, my 2 BTC were drained.

Losing my Bitcoin has changed my mindset. It’s no longer about finishing the race first. At this point, I just want to finish it. But losing my BTC feels like I’m back at the starting line. I lost years of hard work and time.

I thought I was secure because Cold Card was always praised as one of the best and most secure wallets. It’s open source, so anyone can verify.

I’m done with Bitcoin. I’m not even sure if I still believe in it. I don’t know what the future holds for it anymore. I could have stayed with traditional investments and lived a normal life. Maybe I should have just moved everything into a Bitcoin ETF when they launched. But I don't know. It's too late to do it.

To everyone who has lost their BTC, I wish you the best and good health. I hope you find the strength to start again.

The firmware source code is publicly available and can be inspected, However, Coinkite changed the license from a standard open source license to one that includes the Commons Clause, which means it's source available/verifiable rather than OSI approved open source.

Also Coldcard uses two secure elements (the Microchip ATECC608 and Maxim DS28C36B on newer models) to protect your seed.

Those chips are proprietary hardware. Their internal designs and microcode are not open source, and you can't audit what's inside them. That's true for virtually all commercial secure elements.

I won't mention the amount but it's significant enough to a point where we will have to end our friendship, they understand i didnt do anything bad but I was very vocal about "I know what i am doing"

My stack is safe because I use seed signer and generated by SP using coin flips.

I dont know how to handle this

... and if it isn't. It's just proof that people prefer comfort over freedom and independence.

Let’s face it, bitcoin would never have the adoption we are speaking of as long as stuff like this keep happening(coldcard hack). How will ever a standard person own bitcoin if even the pro’s get hacked. People that know everything about bitcoin self custody and yet again their funds get stolen. Prove me wrong.

I live in a third world country and this is more money than I will ever make. I am not 38 and this has been my savings for last 10 years.

I don’t know what to do, I went to police station yesterday and they told me to talk to cyber crime department. I know I should keep my cold card but I m loosing hope.

The victims could've followed all the general rules in self custody (generating a fresh address, keeping seed phrase secure, buying hardware wallets only from reputable sources), and yet they were still exploited. Not your keys, not your coins, unless your keys were never random.

Even long time Bitcoiners have been expressing anxiety. I bet most of you checked your balance after hearing the news, even if you've done everything right. This type of paranoia is an issue and institutionalized bitcoin products are a seemingly good solution to that.

Do you know how many people regularly visit a physical bank because they don't know how to use an app and refuse to learn? Now imagine telling them to self custody.

I am hoping that this hack will make people look more closely at the wallet software code... especially if it's open source. I'm honestly confused as I thought open source software was supposed to be more resilient bc of its transparency.

I don't own Coldcard so I'm not too worried about my stash, but I'd be lying if I said this situation hasn't affected my perspective on the current Bitcoin space.

Can someone with a hardware wallet like Ledger or Trezor be subject to the same vulnerabilities as Coldcard wallets, or do they have additional security measures?

Can I report somewhere?

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

Seriously, how many people are going to now start using multi-sig on 3 different devices of 3 different makes and then roll dice hundreds of times for all the the seed phrases? And then what, stamp them all on metal and store in a vault? Please. ETFs are about the become the go-to and Bitcoin will just be another asset managed by trillion dollar companies. Blackrock and Fidelity must be popping corks right now as this is their dream. This is a far worse day than most realize, I believe.

People are losing their minds over this Coldcard situation. The reality is that very few people truly understand how their crypto is kept safe and secure. Most have simply placed blind trust in a third party to generate a set of words for them and assumed the process was completely secure.

They have been conditioned to believe that “not your keys, not your coins” is the most important rule of all. While that principle is important, it’s not the entire story. A question that far fewer people stop to ask is: “How were my keys actually generated in the first place?”

That is the part many overlook. The security of your Bitcoin ultimately depends on the randomness and integrity of the process used to create your keys. If you don’t understand how that process works, you are still placing a level of trust in someone else.

The point I’m trying to make is that the average person is not going to spend the time researching cryptography, entropy, key generation, and proper security practices. They are not going to go through the necessary steps to independently verify that their keys were truly generated with sufficient randomness and without unnecessary trust assumptions.

For most people, convenience will win over self-sovereignty. And that’s the difficult balance Bitcoin asks users to navigate: taking full custody of your assets also means taking full responsibility for understanding and securing them.

Any idea if there’s an organized central place to upload documentation of wallet / transaction id’s in the off-chance that the stolen BTC surfaces on a regulated exchange?

Had all my BTC on 3 devices. All MK3’s. All got drained over 8 minutes on July 29th.

I’m aware chances of recouping anything are slim to none.

I’ve already filed with the authorities.

i hve trezor and i am constantly seeing my balance to see if someone is draining my wallet lol.

With this cold card complete disaster, I'm wondering how much security a passphrase adds?

Can a hacker know that a hacked wallet has a passphrase associated?

My understanding is that the passphrase wallet is completely new from the original wallet

Could a hacker somehow view transaction history in/out of a hacked wallet and then assume there COULD be a passphrase wallet associated?

The bit argument for open source wallets was always if there’s a bug the community will catch it. How come with the Coldcard bug no one was able to spot it before it happened??

From what I just heard on Natalie Brunell's podcast, this was caused by someone using China's brand new LLM that ripped off code from Anthropic. It has only been out a few days. Unlike Anthropic the China model dows not have any safeguards against people using it for bad things. The guest on the podcast stated that he was able to replicate the hacking code in 90 seconds. Seconds!! So clearly now that the word is out, many bad actors will try to replicate the LLM model to find flaws in code on every device. This is not over folks, it's just starting.

Really sorry to hear what happened to many Coldcard Mk3 users. You did nothing wrong.

To get the obvious out of the way, the hate Coinkite is getting right now is deserved. Firstly, there should have had a more thorough review process that would have caught the unintentional change in their seed generation method. Secondly, its leadership shouldn't have been so cocky and gatekeep-y. The adage "pride cometh before a fall" comes to mind. So this post is not a defense of Coinkite or an endorsement of Coldcard devices.

However, I feel the need to point out that it's best to assume all software has bugs, and after a career in tech I have never met any programmer or company who does not create bugs. Today it was the people who used a particular generation method on a particular version of a particular device that got screwed and thankfully, my setup was not affected. But I can easily imagine other alternate scenarios. None of the following things actually happened, but to me these scenarios are easy to picture:

Imagine These Alternate Scenarios

1. Ledger's closed-source chip firmware was cracked and funds drained. Everyone blames the fact that it wasn't source-readable (unlike COLDCARD), and blames Ledger users for trusting a company that had a data breach in the past.

2. The Coldcard bug was that if you used dice, the dice weren't used properly and ended up creating a guessable seed, whereas the people who used machine-generated seed were safe. Everyone still blames Coinkite, but the set of victims is actually the MORE paranoid ones.

3. There is a technical flaw or bad actor in the manufacturer of Trezor's secure element, allowing seeds to be guessed. Everyone blames Trezor for not having multiple secure elements. Should have used a COLDCARD, they say.

4. There is a mass drain of wallets from seeds generated by Electrum or Sparrow. The offline linux box users are drained, and everyone clowns on them for not using a real hardware wallet.

5. There was yet another hack at a semi-reputable exchange like Kraken or Gemini. Everyone clowns on the victims for not using a hardware wallet.

6. A bug was pushed to Sparrow's send function, so that people who transacted with the latest version, regardless of key management, sent their coins to the wrong address.

7. Regulation or corruption puts funds at bitcoin ETFs at risk of being frozen. Everyone spams "not your keys, not your coins."

Keeping Your Keys Safe is Not Simple

I hate to say that, but it's a reality the community needs to face. I write because I keep seeing comments along the lines of "f--- Coinkite, let's all move to Trezor now" or something similar. But if this fiasco has taught me anything it's that things aren't that simple. Today there is a flaw in one firmware, tomorrow it could be another by another company. Evaluating the options takes skill, and even that won't entirely save you from bad luck.

More complex setups also have risks. You could spread your money among many wallets, or have a multi-sig setup that uses multiple hardware wallets from different brands, but that increases the risk of locking yourself out if you don't do everything perfectly and remember what to do.

I wish I had an easy answer. I just want to say there are a lot of things to consider. This is why security experts talk about thinking through your risk model, rather than saying "any idiot knows to just use my favorite method or company."

The ColdCard hack has seriously shaken the BTC community in less than 24hrs. Very disturbing and disappointing. I went on a block explorer and checked out the thief's addresses (now there are 2). The whole world is now focused there- are coinjoins and obfuscation really going to work, here? How is the thief actually going to use this, realistically?

If you purchase some from this jerk P2P and then try to sell at a CEX, you could catch major heat.

Criminals could always deal with each other in BTC, but it's always a hot potato if they ever tried to bring it to market. This is wild stuff!

If somebody is new to this market and just cares about price exposure, I'd argue them owning shares of an ETF is more safer and practical than owning self custody BTC.

I don't think Blackrock or any of these multitrillion corporations are scheming in the bushes, willing to risk everything they have for somebody's .20 BTC. How do you think they would get away with that? That's entering fantasy land, and more often than not, people who care about price are concerned about practical things that actually have chances of happening. Like the chance of them fucking up(or wallet devs fucking up), ending with them losing/leaking their keys.

Just using today's event as a little reminder for the guys who think they are being super helpful when they recommend new people self custody.

Needing to set up a cold wallet. Any advice of what to be looking for?

Owner of a Coldcard MK3.

I've always hated updating devices, my coldcard included. My MK3's firmware is still 3.1.9 .

Coinkites reponse says 'the issue relates to Coldcard Mk3 firmware versions 4.0.1 through 5.0.3'

1) Does this mean my seed phrase used an adequate amount of entropy in its creation?

2) Regardless, i've already moved my funds off the coldcard wallet.

3) Is owning an MK3 kinda of like owning FTX merch at this point?

Hello, I have an mk3 which I haven’t touched since like 5 years and would like to move my funds to a different wallet. I have created the seedphrase with dice rolls but I don’t remember how many times I rolled and I also added a passphrase. I feel like I forgot everything about how to use the coldcard. Can someone give me a guide what should I do, especially if my cc was not “touched” since the first time I moved my funds there ?

I’ve been reading about the recent issue where researchers found that the seed generation on certain Coldcard Mk3devices wasn’t as random as it should have been, making it possible under certain conditions to derive affected wallets.

This got me thinking about the company’s responsibility.

If the manufacturer found the flaw, acknowledged it, and users ended up losing Bitcoin because of that vulnerability, shouldn’t the company be responsible for reimbursing those users?

I know hardware wallet companies usually have disclaimers that they’re not liable for losses, but if the loss was caused by a defect in their own product rather than user error, does that change anything from a legal or ethical standpoint?

I’m curious if there are any legal experts or people familiar with product liability who can weigh in. Has anything like this happened before with another hardware wallet company?

Coinkite (the company behind Cold Card) has 2-10 employees according to their LinkedIn Page. Their venture capital funding (tracked by PitchBook) is listed as $122K, while Tracxn logs it as $115K. This is a boutique shop, essentially a mom and pop establishment. The typical errors and omissions insurance carried by a business this size is $1 to $2 million. A likely outcome is that they are going to be in bankruptcy and customers are not going to be made whole because this is a boutique operation with no significant cash reserve, balance sheet, insurance, etc.

By comparison Ledger has 500-1000 employees, $613 million in venture capital, revenue in triple digit millions, and a 2026 estimated valuation of $4 billion. Lets talk nuts an bolts. Coinkite disabled the hardware TRNG (true random number generator) in the code. This was probably done during debugging by the developer and then not re-enabled when they shipped the firmware. As a result, the 24 word passphrase is generated using the serial number and internal clock with an XOR operation. The entire output space is 4.2 billion combinations. A desktop computer can crack this in about 20 minutes.

By comparison Ledger uses a TRNG which has undergone extensive independent, third party audits and achieved major certifications such as AIS-31 and EAL5+. The ring oscillators inside the Secure Element chip extract raw physical chaos from thermal fluctuations. The chip filters and concentrates this physical noise into a string of 256 ones and zeros (binary bits). Because the certified hardware guarantees that every bit has an exact 50% chance of being a 1 or a 0 (called "full entropy"), the mathematical possibility space is precisely:2²⁵⁶ combinations. In standard numbering, this is 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936. Using brute force it would take longer than the remaining lifespan of the universe to crack this number. Ledger also runs active hardware health self-testing to determine if an attacker tries to freeze the chip, spike the voltage, or fire a laser to make the output predictable. Ledger will refuse to generate a private key if the chip is damaged in any way.

What can we take away from all this? First I am not trying to advertise for Ledger and I have no vested interest in the company. I just wanted to compare Coinkite to a major player in the hardware wallet space so we can see the differences. You could just as easily compare to Trezor or any other number of hardware wallets, but I chose Ledger for this example. Some users may think moving to an exchange is the answer, but let's revisit some history. Here is a short list of some of the exchanges that have been hacked or collapsed: Bybit (lost $1.5 billion), FTX ($8 billion), Celcius (1.2 billion) and we could go on and on. $38 million stolen is tiny compared to the loss customers experienced when exchanges collapsed or were hacked. That is not to minimize what happened to people affected by the Cold Card firmware bug, some lost their life savings! I can't imagine the blow this would be to have saved for years and tried to do everything right to secure their hard earned money. My question is why did redditors not do any DD and religiously recommended a company with between 2-10 employees to safeguard their life savings?

EDIT: The new technical deep dive into the entropy issue from cold card https://blog.coinkite.com/entropy-technical-backgrounder/ shows it all came down to this code: MICROPY_HW_ENABLE_RNG was set to 0 disabling the hardware TRNG and causing failback to an insecure method of key generation. The compiler error checking only checked to see that MICROPY_HW_ENABLE_RNG was defined instead of evaluating the Boolean value (it should have been 1 for enabled). Coinkite's small team size is a likely a major factor behind why this complex integration bug slipped through the cracks. Because of the small operational footprint (less than 10 employees), they lack dedicated, multi-layered SecDevOps, automated regression, and independent QA departments that larger competitors use to stress-test software updates. In a large company the engineer writing code is entirely separate from the SecDevOps team, but in a boutique frim, the core developers have to wear multiple hats - writing the code, configuring the build files, checking their own work, all of this increases the risk of poor coding such as this.

With the whole Coldcard thing that just happened, figured it's worth sharing my own experience, even though I know this isnt gonna be a popular opinion here.

Back in 2024-2025 i sold off the bitcoin i had left (did a full cycle, accumulated in the bear market, sold in tranches over time) and put it all into IBIT inside my TFSA (Canadian tax free account). Since then i dont hold any bitcoin in self custody anymore, just IBIT.

Why i did it. Im an extremely security conscious person but i also deal with anxiety, and knowing i had a big chunk of money rely entirely on me never making a single mistake, one bad day, one moment of being less focused, that stressed me out way more than it should have. Not because i didnt know the best practices, just the mental weight of knowing its 100% on me with no safety net.

Also in my TFSA the gains are fully tax free, so im not "avoiding taxes" like some people are gonna assume, its literally what the account is designed for. And for people who dont know, in Canada CIPF covers up to 1 million dollars if the brokerage itself goes insolvent (doesnt cover market losses, just insolvency of the firm, want to be clear on that).

I know a lot of people here see this as a bad move, giving your coins to Blackrock, giving them more leverage over the market etc. I get the argument and its a solid one if your comfortable with self custody.

But im not posting this to convince the hardcore self custody crowd. This is more for people like me, dealing with anxiety, stress, or people who are newer and not totally confident in what theyre doing yet. Its ok to choose simplicity and peace of mind if that keeps you invested long term instead of panicking or making a costly mistake. Theres more than one right way to do this.

Anyway thats my story, downvote me if you want but wanted to put it out there for anyone asking themselves the same question.

Just curious about this.

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.

Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.

Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.

The issue is present on every Mk3 firmware version since 4.0.1. It also affects seeds generated on Mk4 and Mk5 before version 5.6.0, and on Q before version 1.5.0Q. The impact on Mk4, Mk5 and Q is not as severe but is still serious.

Simple question, which vendor is the most trusted now? I would like to avoid big mainstream players like Ledger or Trezor. BTC only hardware wallet. The second best player is?

coinkite said mk4 not affected in early analysis, but i'd not take this risk.

The biggest lesson BTC taught me is that if I plan to hold it for years, the daily chart should not affect my decisions.

I still check charts sometimes and adjust the amount I buy based on the price that day, but I'm not to treat every red or green candle as new information. I care more about liquidity, rates, ETF flows, and whether the long-term reason for holding still makes sense. A 5% drop can make you feel bad, while a big green day can make you feel late. Neither is useful if your timeframe is long.

That has affected how I look at other investments too. I try to separate “is this worth holding/owning?” from “is this a good entry today?”

What is the biggest lesson BTC taught you? Did it change how you invest in anything else?

Do this if you want to sleep like a baby when the next RNG vulnerability comes out

Coinkite needs to entice the hacker to become a white hat, by returning the funds in an organized way.

If they offered 10% -?% (after costs are deducted) of the value swept back I am pretty sure the hacker/hacker would prefer to avoid the headache of laundering stolen funds.

The process wouldn't be simple since you can no longer treat a signed message from a bad key as proof you own the key. You would need multiple pieces of evidence

This is realistically the only way users can get their funds back and it needs to happen quickly, before funds are laundered and more people start brute forcing the same key that were swept.

Its much easier to return funds to a hacked exchange, but coordinating returning funds users will be very time consuming, this is not something the hacker/hackers can do alone.

Returning the funds to the original address will just result in someone else sweeping the funds, to a new wallet.

This SparkKitty malware can scan ur phone's gallery, find seed phrases in photos, and send them to attackers. Crazy part is, infected apps even made it onto official app stores. Keep ur seed phrase offline, delete any screenshots and check which apps have access to ur photos.

Convenience isn't worth losing ur whole wallet :D

The coming “Bitcoin Hacked” “Is your Bitcoin Safe” “AI Cracks Bitcoin” are going to be obnoxious.

This is one company, with an over confident leader whose marketing positioned the ColdCard aura as invincible with the messaging pushed down through the Podcast channels.

Going so far as to not allow projects like SeedSigner from even seeing the light of day for discussion.

This ColdCard vulnerability and the method used to extract it will reverberate through all software from all industries. Nothing is safe.

Today's episode literally killed the faith of several hardcore old time bitcoiners and I'm shaken too, not going to lie. Even more than the FTX collapse.

Why? The mantra "not your keys, not your coins" was already widely spread out due to the MTX episode, so most bitcoiners were prepared and learned the lesson the first time.

What happened today is way deeper, because the mantra "don't trust, verify" is more complex.
Everyone can simply not trust, that part is fine, but what about the "verify" part? Not everyone can to a deep dive analysis on the RNG of a software wallet. More than that, most people have no clue what these things are.

And then they say open source code compensates for that.
"Well, if I can't verify by myself, at least I'm using open source SW, there are THOUSANDS of well-trained eyes and programmers watching this code, surely nothing bad could happen, right?".
And even so, half a decade later, we get this. That's horrible to the community and I'm really sad with all the horror stories emerging.

Is the future mantra going to be "not your 128+bit-true-entrophy-multisig+passphrase-setup-keys, not your coins"?

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

I don't know Coldcard but it seems from what I've read of the exploit, it's because they let the computer generate the random seed and not use anything outside the computer's software. This is kind of unimaginable to miss at the first architectural stage of building any encryption software.

Outside of password generation for non essential web logins, I don't remember the last time I generated a credential without providing some of the RNG.

Even early bitcoin paper wallet software would have you zigzag your mouse and smash random keys to generate entropy. Same with most open source encryption tools.

I might be missing something else that caused the exploit?

I currently hold my funds on a Jade Plus. Seeing all this stuff has kinda freaked me out, should I get a 13th word? Im not too experienced in this space

I’m new to bitcoin and I’m worried if I get a Trezor safe 7 it will be hackabke by Bluetooth now.

I've also been affected by the Coldcard mk3 fiasco (fml). I know it's early still but has anyone reached out to the authorities or lawyers, particularly for a class action?

I'm pretty certain Coinkite will not make things right and so we'll need to organize to get our funds back. If you've been affected, either DM me or post below if you've already reported the theft.

Coldcard sub is locked. Has anyone else had issues updating firmware? I was on version 1.4.0 and updated to 1.4.1 and the screen went black. I can cycle on and off, green led stays on, but screen goes black after startup.

For those who might be affected or are using a passphrase with their ColdCard, what can they do in the meantime to keep their funds safe? Obviously it’s best to get a different hardware wallet but what is the temporary solution until the new hardware wallet arrives?

To spread some positivity on this day where some others might be discouraged. Here is an update of some of the cutting edge work done to improve Bitcoin :

https://x.com/bitschmidty/status/2082496590783103424

-a node that syncs in nearly half the time

• a path to 5x faster (SwiftSync)

• a new GUI to make running that node easier, maybe even on mobile

• a redesigned mempool with better fee bumping and fee estimates

• a mining interface so individual miners can build their own block templates (Stratum v2)

• a private broadcast so your transactions can't be traced to your IP

• a reproducible map of the entire internet for node eclipse attack protection

• a better way to relay time-sensitive Lightning and Ark transactions for confirmation

• a multisig that's cheaper, more private, and looks like any other payment on-chain (MuSig2)

• a private payment address with zero linkable payments (silent payments)

• a threshold (e.g. 3-of-5) signature scheme that looks like a single signature (FROST)

• a proposal to fix known protocol bugs and current attack vectors (BIP54)

• a slew of post-quantum research to be ready for future attack vectors

• a first-ever independent security audit for more eyes on the code

• a new tool that attacks a live node the way a real adversary would (Fuzzamoto)

• a fix that killed an entire class of disk-filling attacks

• a replacement for a risky external library

• a consensus engine the whole ecosystem can build on (Bitcoin Kernel)

I want to help identify the cause of the recent wallet drain report by u/s1ammage, which also revealed many other addresses being drained to the same address.

1. Check your wallet balances. If there are unfamiliar transactions since July 29, 2026, after about 9 PM (US Eastern Time), you may have been affected.
2. Did you use a hardware wallet, if so, what model?
3. Did you use a software wallet (hot or watch-only), if so, which?
4. How exactly did you generate your seed?
5. How exactly did you back up your seed?

DO NOT post your seed, DO NOT respond to anyone saying they can recover your funds. Sorry for your loss.

There may still be people affected by the same vulnerability who haven't been attacked, so the sooner the vulnerability is identified, and people are alerted to migrate funds, the better.

Check in with less techy friends and family that have bitcoin and report incidents.

Edit with current conclusions:

Coldcard mk3 confirmed vulnerable, press release here: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

My own analysis: proceed with caution on Mk4/Mk5/Q. These use the same codebase as Mk3 but with slight, insufficient imo, improvements to the RNG system. If you're migrating from Mk3, consider other vendors.

Hello,

i'm looking for p2p marketplaces in Switzerland.

Where donyou guys find people that send face to face for cash?

Curious how you guys here approach sending larger amounts of BTC between your own wallets. Do you split it into smaller transactions? Use a specific type of wallet for the receiving side? Double-check everything multiple times? Or just send it normally and accept the risk?

Always interested in hearing how experienced people reduce the chance of mistakes when the amount actually matters.

I was using KAST but after everything that's happened recently, I've decided it's time to move on. For context I travel quite a bit between the US, Europe and South Africa so I need something that works everywhere without any surprises.

I've been looking at a few different options but I'd rather hear from people who use them than read marketing pages.

Trying to avoid making the same mistake twice. any recs?

I was wondering if there are any WhatsApp groups or Telegram channels for beginners to join, where I can learn about the subject or just get tips and advice from others. Right now my workload isn't too heavy, so I'd like to use my free time to learn more or share my own experiences. Of course, I'm also open to trying Facebook or other platforms since I want to learn as much as possible.

I'm pretty sure my intuition is telling me that buying BTC is way easier than selling. Is my intuition your experienced reality?

The lightning network is a second-layer solution on top of the Bitcoin blockchain that enables quick, cheap and scalable Bitcoin payments.

Here is the place to discuss and learn more about lightning!

Ask your questions about lightning

Provide reviews, feedback, comparisons of LN apps, services, websites etc

Learn about new LN features, development, apps

Link to good quality resources (articles, wikis etc)

Resources:

• Here is an awesome list of resources: https://bitcoinfo.org/lightning.html

• Want to test out your lightning fire power? tip the Bitcoin devs! https://bitcoindevlist.com/

• Previous threads: Search

• Lnbook getting closer towards being finished and can already be seen at: https://github.com/lnbook/lnbook

• Lightning Dedicated YouTube Channel: https://youtube.com/renepickhardt

• Also there is the playlist by chaincode labs: https://youtube.com/playlist?list=PLpLH33TRghT17_U3as2P3vHfAGL8pSOOY

• Lightning stores: https://www.lightningnetworkstores.com/

• Learn more and talk about lightning right here in r/Bitcoin, r/bitcoinbeginners and r/thelightningnetwork

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

I’ve been watching Bitcoin for years, and one thing I’ve noticed is that many people hesitate because they feel they missed the best opportunity.

Early investors bought when Bitcoin was much cheaper, but adoption, technology, and the market have changed a lot since then.

For those who started investing later, what made you finally decide to enter the market? Do you think Bitcoin

My car broke down so I sold a chunk of my Bitcoin to buy a replacement. Didn't want to deal with paying a couple extra thousand in interest, so I paid outright.

So Bitcoin is probably about to pop off real soon, because that is how my luck works.

Now I just have to make monthly payments back into my Bitcoin account, instead of to the bank.

Will hopefully remember to update after 36 months, which would be the loan term at 7.5% APR

All grace is given to the HODLer

May his patience grant eternal peace. Shall his enemies fear in his presence.

And lo, the Lord sayeth that the Redditor shall quake at the sight of the emerald line ascending to the heavens, and the Redditor, after much wailing and gnashing of teeth, shall repent. This fallen one then FOMOeth unto the memecoin anew, crying out “rug not my tendies for I seek the lambo of god and the company of prostitutes”. Alas, when the line reddeneth once more, the Redditor selleth again in shame. Amen.

Holdeth fast to thy belief, through red candles and deep valleys, and yield not unto the temptations of panic.

Patience, conviction, and long-term faith over short-term panic.

A cautionary tale against the "weak-handed" who succumb to fear and sell at the bottom.

​₿

In the next two weeks I’ll receive $8,400 post tax.

I’m owed $6,400 in a tax refund I should get next year in the early months.

I have 0.1 BTC, and around $2,000 in cash right now.

I’m going to Shanghai where I’m not sure how much my spending will be (my apartment is paid for already). Most spending will be restaurants and travel within China. My best estimate is somewhere around $1,000 a month. I’m there for 4 months, so $4k spend.

Then I go to south east Asia for backpacking where I’m budgeting around $500-750 a week, though I’m not positive on these numbers. I think I can pull off $500 a week all in, for 17 weeks, so call it $8,500.

So to sum it up, I’ll need about $13,000 to spend over the next 10 months or so, before I move back home and have no expenses with a job starting soon after.

Counting my tax refund and my income and my current savings plus my bitcoin I have, about $23K. That’s about a $10k cushion.

Would any of you buy more bitcoin in this situation? I’m thinking if I resource constrain myself I may be more inclined to just spend less, and if I really need it I could just sell the bitcoin. Idk not sure what to do here, these prices seem great

Would like to reach a full BTC and thinking to take a mortgage on the house at low interest rate to get there faster. Anyone done this? Thoughts?

Anyone have any experience with this Bitkey.World hardware wallet? No seed? Any feedback appreciated

I’ve been seeing a lot of people talking about the CLARITY Act, but most explanations are full of information that goes over my head. How will this be beneficial for bitcoin? Is it negative for Bitcoin in anyway? What are your thoughts?

If you're using multisig to secure your bitcoin lets assume you have three physical keys & backups plus your wallet descriptor. Or perhaps you're using a 2-2 multisig, if so, why and how did a 2-2 fit your security model?

How have you distributed your keys & backups and how have you stored your wallet descriptor.

Are you utilising family to hold backups, and how many of you are keeping more than one key in a single location?

Share what you're willing, etc. I'm just curious to learn about the practicalities of multisig from real people who use multisig today.

Stuart Haber and Scott Stornetta are two of the Godfathers behind modern cryptographic timestamping or “Block Chain”. Their contributions to Bitcoin are showcased by three academic works referenced in the Bitcoin Whitepaper References section.

These two legends have laid as much of Bitcoin’s groundwork as giants like Adam Back, Wei Dai and Hal Finney. In a recent interview, Stornetta repeated a theory about Satoshi that originated from his colleague, Stuart Haber.

The Theory: when talking about Satoshi, “...we’re talking about one person, who was professionally a software engineer, and was really dabbling more with the cryptology as well as with the economic incentives...There’s one thing that I haven't seen anyone analyze, and that is the structure of the (Whitepaper) footnotes.” These suggest Satoshi was a “non-professional cryptologist” who “discovered this thing (Block Chain) by reading about it in the Encyclopedia of Cryptology.” - Scott Stornetta

This characterization of Satoshi is not much of a ground breaking take. It is consistent with many others who have suggested that Satoshi was an individual polymath coder, not a group.

But the detail about the Whitepaper footnotes and a mysterious book are interesting.

What are the clues that relate the structure of the Whitepaper footnotes to this mystery encyclopedia? Has no one looked at this angle involving the Whitepaper footnotes before?

The Satoshi Times went down this rabbit hole to see what could be found, and the details are fun.

We found that there is an Encyclopedia of Cryptography and Security that was published in 2005 by Henk C. A. van Tilborg via Springer, that matches the description given by Stornetta. This pre-dates Bitcoin (2007-2008), and thus could have been a primary resource used by Satoshi Nakamoto in his invention of Bitcoin.

Continued on https://satoshitimes.com/encyclopedia/

imo lately it looks like money started rotating from AI stocks to crypto/btc.
when they drop, btc used to drop harder but now btc even goes up when they drop.

First, take a look here: https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/2r2u6SbHun4/m/S-ZUsHNICQAJ

What's that? Another post-quantum algorithm massively neutralized. Now they're doubling the number of bits by default to fix this.

This is not a new thing in cryptography. When RSA (one of the earliest public key cryptography algorithms) was first discovered, people thought that RSA keys are secure with a small size (~200 bits). Then what happened? Index-calculus-style techniques and the number field sieve algorithms and others were discovered, and they DESTROYED RSA that have smaller keys! That's why RSA keys are 2048+ bits nowadays.

Same with some elliptic curves using MOV attack.

The security of cryptographic algorithms DOES NOT ONLY depend on their parameters. It depends on what attacks humans (and AI now) can figure out.

We're lucky Satoshi picked something that's secure for bitcoin, the Secp256k1 curve. Worked out well so far.

Developing a secure quantum algorithm will take YEARS, and lots of algorithms will be broken. Rushing it doesn't help.

Conclusion: Now imagine us moving to post-quantum in bitcoin, because everyone is rushing it, and we end up with a broken algorithm. Now THAT, would literally destroy bitcoin. Imagine the irony, where Secp256k1 is still safe, but the "new shiny" post-quantum algo is broken.

It took 5 months on 200GPUS. He is the same person who had solved #120 and #125.

Been looking at wallet-tier data recently and wanted to see what this community makes of it.

According to Santiment's on-chain tracking, wallets holding 10–10K BTC added roughly 19,700 BTC over an 8-day period this month, while wallets holding under 0.01 BTC pulled back on buying. Separately, CoinDesk reported that whale addresses accumulated over 270,000 BTC in a two-week window earlier this year — described as the largest on-chain accumulation spike on record.

No price predictions here, just trying to understand the pattern: does this kind of wallet-tier divergence actually tell us anything reliable, or is on-chain data overrated as a signal? Genuinely curious how people who've been holding through multiple cycles think about this.

I've noticed that most people spend a lot of time learning when to buy Bitcoin, but much less time learning how to protect it.

For those who've been around for a while:

What's one security lesson you wish someone had told you when you first got into Bitcoin?

It could be about self-custody, backups, exchanges, scams, or anything else that made a difference.

So much discussion about the cycle and where BTC price will be in September and October this year.. What out of ordinary world events could delay or bring forward the end of this halving cycle ?

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

Anyone had this happen to them?

I’ve been buying BTC for a few years. And got into it really hard the last 4ish years. And I used to talk to anyone about it, but I do that less and less now. One of my closest friends is so resistant to it, and funny enough he’s the most tech savvy person I know! In the past year I had 3 instances where I brought it up in convo with old friends and new acquaintances, and the reaction was so hostile! I think some of that is ppl being angry they missed out in part… idk. But anyway, yea it’s kind of a rift between me and one of my oldest friends. But I’m kinda at the point in my BTC journey where I believe opting out of the fiat/ debt/ credit creation banking system as it stands is a moral imperative tbh. American society is so out of whack between inflation/healthcare/housing/education… and that’s being brief, but I see the compromised monetary system at the core of it all. Talking politics without talking about money is like talking about plumbing without talking about water. And Americans love to talk politics. Anyway yea my BTC conviction has caused rifts in my relationships. Curious of others stories around this.

I know that past doesn't guarantee future outcomes.

But, if I had gone all in since 2021 (starting at the previous peak) and did so throughout the past five years, I would have been able to buy my dream house and car by now.

I already have a decent amount of retirement savings.

Going to take the risk and put all my discretionary income into Bitcoin for the next four years!

Feel free to save this post and I'll update it during the next bull run, and you'll see if I made the right choice or not.

What are some businesses you guys have/do spend bitcoin at? Bitcoin only or Bitcoin accepting websites like soap miner or beck and bulow. Give me suggestions to support fellow bitcoiners.

I have watched Bitcoin since approximately 2015. Every time it hit all-time highs I wished I had bought, and every time it hit a cycle low I was glad I didn't. I'm tired of playing the psychological gymnastics of trying to time the perfect bottom. I'm officially biting the bullet and starting a $600/week DCA. I fully expect the market to crash 20% tomorrow just because I finally bought in, but I'm ready to ride it to $200k or zero.

Why would I want to use Bitcoin at local restraunts or other expenses?

Why wouldn't you just use fiat as it is less valuable.

10-15 years from now or do you feel more pessimistic about that?

I'm a teenager and I don't have much money rn since I have everything in the bank and I can't access the cash(it's not a lot but it would have been nice to use it for BTC)

But since Bitcoin entered the bear circle I started accumulating 100$ at the time(as soon as I got the money through presents or working), now I have 100/200$ to spend but should I buy now or just wait a bit longer for the price to come down? What would you do in my situation?

P.s. everything I've accumulated is in my cold wallet and I've reached 0,016btc

Thanks

I bought Bitcoin recently and i want to see some helpful advice

The only thing I can find is bitvalve and the retun is almost half the value.

Do you still remember the first time you heard about Bitcoin? When did it came across your local media channels? When was the first time you read about it in a newspaper?

For me it probably was in the 2017 bullrun.
Didn’t check earlier articles yet, but it had me wondering about the rest of the world.

Go ahead! ⬇️

✌????

???? WARNING ????

Bots are spamming Reddit with fake problems to do with BTC, to create a false sense that BTC, or services related can't be trusted.

These posts are then fed into ai services which use these as examples of why to avoid BTC.

This practice is often paid for and promoted by boomer Legacy banking companies.

Manufactured FUD so to speak.

Ignore stack and Hodl ????

Its already up 0.5%.

I've noticed a generational gap in BTC acceptance. I'm 65yo and it seems people my age & older are at best BTC ignorant & at worst totally against it.
I know one guy, 76yo, teaches Finance & Econ at a respected university. He's also a partner in a wealth management firm. He thinks BTC is "gambling". I get this all the time w/ the older crowd ("boomers") so often that I don't discuss it anymore w/ them.

It makes me wonder how much the $price of BTC is generationally related?

Who has the invitation code @layerEdge #layerEdge?

The case for holding your own keys is that a balance you control can't

be frozen, inflated or reversed by someone else's decision. I hold that

position and I'm not arguing against it. What I've been trying to work

out is what it actually covers.

Because a wallet secures a ledger entry. It doesn't secure the things

you spend it on, and those run on infrastructure that increasingly has

a remote stop built into it.

Two examples that made this concrete for me.

Las Virgenes MWD in California, 2022, installed flow restrictors on

households that repeatedly exceeded their water allocation — a machined

disc that drops the service line from around 30 gallons a minute to

roughly one. The tap still works. A garden doesn't. No court order, no

visit, no negotiation.

And Mazibuko v City of Johannesburg: prepaid water meters in Phiri,

Soweto, from 2004, where the valve closes automatically when a

prepaid allowance hits zero. It went to South Africa's Constitutional

Court, and in 2009 the residents lost. Automatic, remote,

no-appeal shutoff of a household water supply was found lawful.

The reason this belongs here rather than in a homesteading sub: the

architecture is identical to what we already argue about with money.

A meter that reads usage and a meter that limits usage are the same

device with different policy attached. It's the custodial model,

applied to a physical input.

Which is why I don't think stacking alone is a complete exit, and I say

that as someone who does it. Cold storage in a house where the water,

the power and the connection all have a remote stop in them is a

partial position. Genuinely interested in how people here think about

that gap, because I don't have a clean answer for it either.

I put the full breakdown of both cases together here:

https://youtu.be/ekU-Xugvu1U — sources in the description.

I am putting out a serious warning for anyone considering using NC Wallet.

My funds are being held in what appears to be a deliberate internal lock. I initiated a Bitcoin withdrawal of 0.00272744 BTC exactly 100 hours ago. To ensure a fast transaction, I explicitly turned off their "No commission" option and paid the priority network fee myself. Despite this, the transaction has been stuck in "Pending" status for over 4 days. No TxID (transaction hash) has been generated. This is 100% proof that NC Wallet is holding the funds internally and has not even broadcasted the transaction to the Bitcoin blockchain.

Support (Ticket: NW-150331) sent a generic automated reply blaming "blockchain congestion," which is a flat-out lie since there is no TxID to track. Since I pointed this out with technical facts, they have gone completely silent and ignored all my email. Stay away from this platform.

If anyone has tips on how to force them to release an internal hold, please let me know.

Do you just love it so much? It’s so cute

Just sitting here thinking about how few people are posting to Reddit subs or Twitter about Bitcoin. With those that are posting talking about loss porn and anxiety.

It’s just another bear market that that people will remind each other of in years to come. “I shoulda bought more! Why didn’t I buy more?” we’ll lament on social media and at parties.

Ahhh.. the good ole days. They are right now.

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

I got the standard answers when I started, and none of them held up when I pushed on them. Putting the working here in case someone else is stuck at the same place.

First, the Ponzi thing, because it comes up in every one of these threads. A Ponzi has four features: promised high returns with little risk, a central operator, old investors paid out of new investor money, and concealed flows. Bitcoin has none of them. It's volatile with nobody promising anything, there are over 10,000 nodes and no operator, nobody is paid a return, and the entire transaction history since 2009 is public. That question is settled and I don't think it's interesting anymore.

The one I couldn't get a straight answer on is the security budget.

Miners are paid two ways: the block reward and transaction fees. The reward is 3.125 BTC and halves every 210,000 blocks, roughly every four years. Next halving is around April 2028, taking it to 1.5625. Fees are currently around 1% of what miners earn.

Miners pay for power in fiat, not BTC. So if fees stay at 1%, the price has to roughly double every four years just to keep miner revenue flat in dollar terms. Bitcoin has historically done that. The honest position is that a maturing asset shouldn't be expected to keep doing it forever.

The usual response is "that's a 2140 problem". I don't think it is. It's a next-decade problem, and it resolves one of three ways: fee share climbs off 1%, price keeps doubling, or miners start leaving.

The part that made me more comfortable, not less, is what happens in that third case. Nothing breaks. Difficulty adjusts every two weeks based on the hash power actually on the network. Miners leave, difficulty falls, and the ones who stayed earn more. Hash rate has climbed through every dip so far, which is decent evidence the economics still work.

But I'd rather have a test than a vibe, so here's mine. Watch two things over the next few years. Hash rate rising and fee share climbing meaningfully off 1% means the security model is fine. Both falling together means the bear case is real.

Related: bitcoin has to be used, not only held, for fees to develop. Satoshi made this point back in 2010. As it stands there's no shortage of use — roughly $25 trillion in bitcoin moved on chain in 2025 per Glassnode, more than Visa and Mastercard volume. What matters going forward is whether that activity keeps settling on chain rather than migrating entirely to custodians and ETFs, because that's where the fee market comes from.

If someone has a solid counter to the fee-market case I'd genuinely like to read it. The permabull version of this answer is "fees will rise", which isn't an argument.

I've used NC Wallet for years with no problem, always small amounts. The withdrawals always take an hour or so. I sent a small amount and attempted to withdrawal 48hrs ago, and the transaction has been stuck with no TX ID, my messages to support have not been replied and no email from them with ticket tracking. Just crickets. I hope someone from NC Wallet sees this and solves the issue.
User ID QWLUL3XZMDGIGJCN6OFQ

I saw some horrible predictions on Twitter, IG from 2024-2025 and i want to see which one was actually the worst

Just asking, I really want to buy quite a lot and I don't know if I should put everything in a single cold wallet.

I already have a Trezor model t, is it necessary to upgrade or is any kind of Trezor good?

P.s. I plan to become a whole coiner before 2029.

Thanks in advance for your help.

I've noticed that some of the loudest Bitcoin FUD seems to come from people who already hold BTC.

If you're bullish long term, why let every correction shake your conviction?

Is it just emotion, or do people expect Bitcoin to move up without volatility? What do you think? or y'all playing around? Lol

So I signed up with casa a few years ago. I'm used to getting a ton of spam/scam mail, but recently I realized that all of the crypto related scam mail is going to the email I used for my casa account. I haven't used that email for anything else since then, and these scam emails are new since then.

Was there a data leak that I maybe missed an email from them about? Was there a hack I don't know about? Does anyone else get crypto specific scams going to an email they used for a bitcoin company?

Been doing personal finance tracking for a while, spreadsheets for everything: bills, savings rate, all of it. A few months back I started logging my Bitcoin buys the same way. Cost basis, date, current value, the whole setup.

And I genuinely cannot decide if it helps or hurts.

On one hand it makes DCA feel real and tangible. You can watch the average cost come down over time and that part is actually satisfying. On the other hand, checking it during a dip feels like a bad idea because suddenly the red numbers are right there in a column staring at you instead of just being an abstract price on an app.

The people I know who seem the most relaxed about holding just kind of buy and forget. No spreadsheet, no checking. They bought at whatever price they bought at and they are not doing the daily math. Meanwhile I am over here color coding cells.

Part of me wonders if the tracking mindset is a personal finance habit that just does not translate well to something you are supposed to hold long term without flinching. Or maybe the spreadsheet is fine and I just need to check it less.

Hey! I remember the monthly updates from [u/jamespunk](u/jamespunk) who kept stacking €500 worth of Bitcoin each month since 2017.

Reddit posts discontinued in 2024, and the blog is no longer maintained:

https://er-bybitcoin.com/category/post/

Please let me know if he's managed to retire early! I'd be so happy for him.

Sometimes I just buy a little BTC when I have extra cash. No big plan. No perfect entry. No “expert” signal. Just kinda feels better than letting the money disappear on random stuff. Trying to time BTC perfectly honestly stresses me out more than just buying small and moving on. Anyone else do this, or am I just being too casual with it? lol

Ask (and answer!) away! Here are the general rules:

• If you'd like to learn something, ask.
• If you'd like to share knowledge, answer.
• Any question about Bitcoin is fair game.

And don't forget to check out /r/BitcoinBeginners

You can sort by new to see the latest questions that may not be answered yet.

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

Hello,
I’m a regular LBank user who has only traded using funds that I deposited legitimately. However, my account was suddenly frozen, and I can no longer withdraw my assets.
I have never violated LBank’s rules or terms of service. I have never engaged in illegal activity, suspicious transactions, money laundering, or any other prohibited behavior. Despite this, my withdrawals have been restricted without any clear explanation.
I have contacted customer support multiple times, but I keep receiving the same generic response: my account is frozen. No one has clearly explained why my account was frozen, what triggered the restriction, or how long the review process will take.
A significant amount of my funds is locked on the exchange, and the uncertainty has caused me a great deal of stress and anxiety. The most frustrating part is that I have no idea when—or even if—this issue will be resolved.
I’m posting here to ask if anyone has experienced a similar situation with LBank.
Were you eventually able to recover your funds?
How long did it take to resolve?
What steps did you have to go through?
Did you need to submit additional documents or complete another verification process?
At this point, my funds remain locked, and I still have not been given a clear reason for the account freeze.
If anyone has gone through this before or has any advice, I would sincerely appreciate your help. Thank you.

I’m running a bit of a psychological experiment on myself, and I’m curious if anyone else has tried something similar.

A little background: I’m 6’4”. As a teenager, I was pretty overweight. During high school I got sick, took up cross-country running, and leaned out. In my 20s I stayed in decent shape, but by my 30s the weight slowly came back. At my heaviest I hit 272 pounds.

In 2021, I went keto and lost 55 pounds in about five months. I got down to 212 pounds and was honestly in the best shape of my life. Fast-forward to today, and I’m hovering around 225-230 pounds. I’d like to lose another 25-30 pounds.

Here’s the experiment.

We all know processed foods today are engineered to be incredibly appealing. Food companies spend enormous amounts of money studying consumer behavior, psychology, flavor, packaging, marketing—basically everything they can to get us to buy and eat more. I’m not saying it’s some grand conspiracy; it’s just business. But I’ve realized I’m pretty susceptible to those impulse purchases.

So recently, whenever I find myself standing in front of a bag of chips, granola, candy, or some other processed snack that I don’t actually need, I stop, look at the price, open my Bitcoin app, and buy that exact dollar amount of BTC instead.

My hope is that over the next six months I can slowly rewire my brain. Instead of getting a short-lived dopamine hit from food that doesn’t move me toward my goals, I redirect that impulse toward something that aligns with my long-term goals.

I fully recognize that an impulse buy is still an impulse buy, and Bitcoin is obviously a volatile asset. I’m not pretending this is some guaranteed financial strategy. But if the alternative was spending that money on junk food anyway, I’d rather own a little more Bitcoin. Best case, I lose weight while stacking sats. Worst case, Bitcoin drops and I keep buying over time while still improving my health.

Has anyone else intentionally redirected an unhealthy habit into buying Bitcoin—or investing in general? Maybe replacing gambling, drinking, smoking, or some other impulse with stacking sats?
I’m less interested in whether Bitcoin goes up or down and more interested in whether this kind of habit substitution actually changes behavior over the long run.

Or buy bitcoin instead? Can’t buy bitcoin etf in my 401k or Roth account. If I max out these accounts the rest of the money will go to bitcoin regardless after expenses.

I want the price of bitcoin to go up so i can use stepped bitcoin to repay fiat loan, Whilst also wanting the price of bitcoin to go down so I can acquire more bitcoin.

I want to hear what's everyone else saw or heard that made them buy into Bitcoin

Hi everyone,

I'm a graduate student writing my master's thesis on how artificial intelligence tools (trading bots, robo-advisors, predictive models, signal systems) are influencing investment decision-making in the cryptocurrency market.

If you invest in crypto — whether or not you currently use any AI-based tools — I'd really appreciate 5–7 minutes of your time to fill out this short, anonymous survey:

https://docs.google.com/forms/d/e/1FAIpQLSfDBQGQyAx1uM91dLwcN_EmMPnvdj3XO9WzsBYfmtFuQfkgHw/viewform

A few notes:

• Fully anonymous, no personal data collected beyond age range
• Results will be used exclusively for academic research (master's thesis)
• Takes about 5–7 minutes
• Open to anyone with crypto investing experience, regardless of whether you use AI tools or not

Thank you so much in advance — happy to share a summary of the findings here once the thesis is done, if there's interest!

Hi all. I'm not sure if this is the right place, but there are people here who have watched Bitcoin for years. I've been buying small amounts here and there for a year, and I currently own around 0.11 BTC, which is also a little more than half of my life savings. My other half, like $7k, is just sitting in my USD account.

I'm 22 and live in a country where crypto is not allowed, Ethiopia. They're getting stricter by the day, and soon there will come a day when I can't sell or buy more. I get this sudden temptation to sell it all and just invest in stocks, the safe option, but the other half of me wants to hold for life, you know.

And the market is not helping. It's been going down and down like crazy. Just when I think it will go higher, it just comes back down. I'm young, and I don't need the money for now, so I can just invest all my life savings and forget about it, and by the time I'm 40, it will be like 100x.

It's a painful dilemma. I feel like this community will be biased toward Bitcoin, but I still want to hear y'all's opinions.

Hey all. I’ve got some BTC in an IRA with Choice. I just got an email that they are shutting down their Blinko game (it was basically a fun version of a BTC faucet). Being in crypto for so long I see this as a red flag of their health especially seeing exchanges going under already. I know I should have it in cold storage but I parked it here for tax purposes. Should I be concerned about email and any suggestions to limit a tax hit? Just roll it to another IRA?

I’ve been in Bitcoin since the 2017 run (GBTC). Turned a decent profit relatively quickly, then sold on family advice and watched it keep running. That regret still sits with me.
More recently I had a position in IBIT and sold a meaningful chunk when it dipped under $64k after hearing someone on YouTube say it was going lower. I know the long-term thesis, yet I still keep making the same short-term emotional decisions.
I’m seriously considering taking a chunk of money out of my Roth IRA, buying actual Bitcoin, and putting it on a hardware wallet (or even a paper wallet) that I can just put away and not look at. The goal is simply to own a full coin and remove the easy sell button.
Two questions for people who’ve been through this:
1. Has anyone successfully used the friction of self-custody (hardware wallet, offline storage, etc.) to finally stop selling during drawdowns?
2. I once had coins stolen from a software wallet on my computer. How paranoid should I be about the security of holding a larger amount of Bitcoin in self-custody? What are the real failure modes people have actually experienced?
Not looking for price predictions or “just HODL” one-liners — genuinely curious how others have handled the psychological side and the practical security side once the coins are offline.

- I’m using exodus, I didn’t start so I can still decide to swap the app.

- I also want to know how to trade and invest, a good place to learn and start

- best places to hide my password, I won’t say which one I’ll do but advice is helpful for me to build a guide

- lastly the daily 5 emojis : ????????????????????

Once wealthy citizens from one country start moving to or visiting another country people start to stereotype that entire nationalities citizens as "wealthy".

The wealthy americans, the wealthy chinese, the wealthy koreans, the wealthy singaporeans, the wealthy dubai residents etc etc.

This is generally due to a fast and dramatic rise in living standards driven by a strong economy, strong currency, and an environment of opportunity.

This same phenomenon will happen with bitcoiners with bitcoiners being their own demographic. At some point as fiat continues to lose value and remote work along with AI unleashes opportunity for everyone everywhere, the only measure that will make a certain demographic appear wealthy won't be the country they come from, it will be the currency they denominate their life in.

People will stop stereotyping a certain countries citizens as wealthy, and they will start stereotyping bitcoiners as wealthy.

In the same way as today when people view a certain countries citizens as wealthy they want to move to or visit that country, and they start to respect and almost idolise their wealth, it will be this same dynamic that drives the masses to want to become bitcoiners.

It will be a very stereotype driven dynamic where if people start discovering all of the wealthiest tourists in their country are bitcoiners they will finally understand the power of sound money and a strong currency because they will be seeing it with their own eyes in their own businesses and workplaces, and that will drive them to want to start earning and saving in bitcoin.

In the future we won't stereotype a persons relative wealth by the country the come from, we will stereotype a persons wealth by the currency they denominate their life in.

Buried in the EU's 21st Russia sanctions package (adopted July 23) is something worth every Bitcoiner's attention.

Alongside the usual exchange blacklisting (a transaction ban on HTX and a handful of others kicks in Aug. 23) the EU created a new mechanism: it can now prohibit dealing with crypto service providers based in any country it decides has "systematically and persistently" failed to stop sanctions evasion. The list of targeted countries is empty today. The point is that the switch now exists, wired and ready.

And here's the part that should make the argument for you. The EU action also comes two days after blockchain intelligence firm TRM Labs alleged that HTX had been rotating hot wallets and funding addresses across four chains following the UK sanctions. That's the permissioned model in a nutshell: a custodian playing whack-a-mole with a blacklist, an administration writing rules slower than the addresses change, and users whose access depends entirely on which side of a legal document their platform lands on.

None of that is a Bitcoin problem. You cannot sanction a UTXO. You cannot serve a transaction ban on twelve words written down in a safe. A government can erase an exchange's ability to operate overnight — it did, effective next month — but it has no lever on coins you hold yourself. Every custodial chokepoint that gets flipped off is just another expensive advertisement for self-custody.

The takeaway isn't "sanctions bad." It's that the entire apparatus being built here only works on permissioned rails. The instant you're your own bank, the kill-switch has nothing to switch off.

Sources: EU Official Journal (Reg. under the 21st package), Reuters, and TRM Labs' wallet-rotation analysis, The Block.

How many custodial "off switches" like this do you think get built before self-custody stops being a niche opinion and becomes the default? ????

Why I am Anti-BIP110?

I thought, I had a solution and was wrong twice.

What happened, I proposed a Priority Oracle (v1). The Bitcoin community on Reddit correctly identified that it doesn't survive contact with miner incentive structures. We pivoted to an Externality Fee concept (v2). Same result.

Both failures taught me the question is genuinely open.

Does Bitcoin's fee market price the lifetime cost of permanent data storage? Has someone figured it out?

The SegWit discount was designed for malleability, not state economics. CashTokens eliminated the classification problem but requires a hard fork. Three directions under discussion: relay fee multiplier, BIP, tiered market.

What am I missing? Where should I look next?

Just a warning to not use Crypto.com . I have been using bitcoin since it was at $50 in 2013 and I have never had a problem buying, selling, sending or receiving until 2 days ago with Crypto.com . A loved one needed money for emergency surgery so I instantly transferred $6,500 from my Chase bank account to my Coinbase account, bought $6,000 of bitcoin, and transferred it to my loved one's Crypto.com bitcoin account. In order to release the funds Crypto.com required a test send from the address the bitcoin was just sent from to prove ownership of the address (the Coinbase address). The amount they required to send was lower than Coinbase's minimum send allowed so it was not possible.

She opened a support ticket on Crypto.com and support first said just try again using any bitcoin address to send from. So I sent the tiny amount required from my Electrum. Which of course didn't work (not sure why it would since the purpose was to establish ownership of original address). Then they said send it again but from a legacy wallet. So I opened my 12 year old legacy Electrum wallet and sent from a legacy address. That of course did not work either as it is not the Coinbase account Then for the next 2 days support just sends (every 7 hours) some random irrelevant copy and paste generic suggestion (restart app, explanation of how bitcoin works and other such BS). I then hopped on Crypto_com reddit account which appears to be active but the mods will not approve my post nor reply to my message.

Fortunately I just barely had another $6,000 I was able to get to her another way but the original $6,000 is still stuck on Crypto.com which their support is doing absolutely nothing but sending irrelevant generic copy and paste replies. I know many crypto sites fall under the "works fine until needs support" framework and Crypto.com is definitely on that list.

EDIT: If anyone from Crypto.com sees this and wants to actually resolve the issue then I will edit this post stating that the solution was resolved.

A while back I posted how I thought we had more to drop. Looking at the price action bitcoin absolutely refuses to break below 60k for a lengthy period of time. I don’t think it’s going to go any lower then it has, or if it does it will only be very slightly. All the bears like myself who were expecting it to plummet were wrong. Trump will continue to TACO out of anything that negatively affects stocks/crypto. I do not think a bear market is legitimately possible at this point while he is president. It’s clear the market is terrified of dipping. Every dip is bought up instantly. I can say I was wrong previously.

People will say the four year cycle etc; and it was true and false. It did dip lower this year, especially all the bulls who were calling for 200k and 300k last year look ridiculous. But it clearly is not going to go below 50k. At the worst we might see a small wick to 55-56k marking the bottom before the bull market restarts again. I was wrong. Bitcoin is a lot stronger than I thought.

I did not mean to buy much bitcoin. I just bought bitcoin every month for the last few years and did not really think about it. I checked my accounts this week, and my bitcoin position is now larger than my entire retirement portfolio.

This is not what I wanted when I started buying bitcoin. Now I am looking at my portfolio, and I am wondering if I am making a good decision by letting my bitcoin investment grow, or a bad one by not changing my portfolio.

I want to know what people who have invested in bitcoin for some time do in this situation. Do you sell some of your bitcoin, rebalance your portfolio from time to time, or just let your bitcoin investment grow? How do you handle your bitcoin?

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

U want this to moon to $1,000,000 but expect to HODL forever and never sell or use for any purchases?

U expect this to moon while a $10 dollar transaction has a $4 fee for a "quick" (10 - 60 minute) delivery. Let me just sit here awkwardly while my payment is being processed. Have you people been to a McDonalds drive-thru? Imagine holding up the line for some nuggets because this thing needs to verify terabytes of transactions and then add it to the same huge blockchain by finding a nonce that takes billions of computers to solve?

Also a huge transaction fee for a small purchase on top of McDonald's overpriced dog meat.

Not to mention memory is being consumed by AI and will cost an arm and a leg in the future. Just to download the entire blockchain will be petabytes. Who knows how much memory will keep skyrocketing to.

Wake up and smell the overpriced McMuffins and Coffee. People want speed and small memory footprint and this thing is bulky and slow. Sorry to burst your bubble.

Tldr, just have more money. More capital = more gains too, without these world shenaningans, broke, being poor, overtime work, damn such a hassle.

I managed to save up around $325 from my paycheck and got my first BTC today, i feel like i bought at the right time but hey i'm happy with it, any advice for long term buying?

used wallet of satoshi to send a lightning transaction and it has been stuck on queued for 24 hours now, what can i do to resolve this? how long does it take to get fixed? i contacted their support but havent gotten an answer

How many people have at least 0.1 BTC out of the total number of Bitcoin holders?

Have you ever done fourier analysis on any BTC metric? If you do, have you found something interesting? Do you think is not worth it? Why?

With the assumption that Republicans are highly unlikely to change the bill to leave room for future prosecution of POTUS via State AGs (a core Democrat demand); the only way forward for this current version seems to be Republicans to hold both chambers.

What alternative version might be introduced in the 2027-2028 Congress that can get passed and signed by Trump in the next two years? Will Democrats continue to assert prosecution rights forever or is there a compromise Democrats are willing to accept that could still protect Trump from potential prosecution?

why trying so hard to convince an old man that has been wrong about bitcoin for the last 10 years? what interests do bitcoiners have to get Peter S approval opinion ? i don't get it

am i missing something?

why is he important in a space he "hates"? I know some of you don't care, but i keep seeing people SO worried about "he said this.. he said that.."

why tf matters??

not hate, im genuinely curious

Hi all, I am looking to buy BTC p2p, but before I do, is there a way in which I can check if the coins I purchase in advance are tainted? Is there a website or something this can be verified on?

I want to check this to avoid any problems in utilising the coin/s once purchased.

Thanks

Is this against your firm's rules? Did your firm make you sell your shares?

Just curious because I'm thinking about applying to a financial rep role (Series 7), but I'm down 50% on portfolio holdings of 100% FBTC.

I wonder if this concentrated holding is allowed at most firms? I also hold BTC in actual cold storage. Am I blocked from even applying since this isn't what most representatives should hold?

I am so proud! As of today, I now own 0.1 BTC with a average prive of 68,527.36 €. I started in September 2025, was there for the ATH and the fall afterwards. My next goal are 0.2 BTC ☺️

Just wanted to share that with someone!

How much of your savings are you keeping in BTC? Are waiting for the price to drop before you by BTC?

Newer to this and trying to understand the psychology before I'm tested by it. Everyone says "just hold" but I want to hear from people who were actually down bad at the worst point. Did you know it was the bottom, or did it just feel like it was going to zero like everyone said?

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

I’m 14 Trying to find out if it’s worth it or not btws

I used wallet of satoshi and when i send some funds out it is stuck on queued, has anyone else experienced this? and what can i do about it?

I have a lightning wallet for spending and sending small amounts. I haven't used it in quite some time but today I have received multiple payments of a few sats a few $4 amounts, and even a $9 payment, in 24 hours.

Is this something to be concerned with? Why am I receiving so many sats out of no where?

I am going to just hold it for awhile before moving it but what is this all about?

For a long time, I thought Bitcoin was only about price—buy low, sell high, hope it goes to the moon.

The more I learned, the more I realised that's actually the least interesting part.

Bitcoin is the first form of money that no government, bank, or company controls. It's open 24/7, borderless, and anyone with an internet connection can participate. Whether you're sending value across the world or simply holding an asset with a fixed supply of 21 million coins, it's a fascinating experiment in financial freedom.

Will it replace traditional money? Maybe, maybe not.

Is it volatile? Absolutely.

But the idea that money can exist without a central authority is one of the most revolutionary concepts of our time.

Whether you're a Bitcoin believer or a sceptic, it's hard to deny that it has changed the conversation about money forever.

What's the biggest thing Bitcoin has taught you? I'm genuinely curious to hear different perspectives.

So I have tried a few platforms like Crypto.com, Kraken, and Wealthsimple but the reality is that I prefer the idea of having stocks. This being the case, can anyone suggest what stock best duplicates the movement of Bitcoin as a percentage? I've looked at MSTR, IBIT, and BTCX.B, but it is hard to see which one seems to move closest to the price of the crypto itself. Does anyone have any suggestions here? Any other stock that seems to move with Bitcoin the closest?

I started buying £100 of BTC every week 3 months ago. I’m 53 so will work till I retire on my 68th birthday. What do you recon it will be worth.

These are based on my personal experience running a Bitcoin technology company, working with accountants in the EU and the US, and many conversations I had with businesses recently.

1. Account blocks:

This, of course, is the most common problem, especially for businesses. If you are making transfers to exchanges to buy or sell bitcoin, you can expect a series of questions from your banks, or, worse, they may suspect you of providing crypto exchange services for your clients and may block your account.

This is a nightmare we as a bitcoin company were not spared with - we could not get an account on Revolut since we had bitcoin on our website and could not produce license documents. No way to communicate that we rely on our partners to provide services - of course, they won't spend time to read your terms and conditions or chat with you - they are too big to bother about small coffee shop owners or risky crypto apps.

1. Accepting is just unclear.

Businesses want to accept bitcoin and have a cleaner accounting trail- auto-offramp to Euro in some cases.

But they are confronted with setting up a BTCPay instance or dropping an NWC string or a lightning address to a payment tool.

Lightning address or NWC string is not as common as a bank's IBAN - still, they need to get one reliable Lightning setup.

But a business wallet is not a WOS you spin up for your friend to have their first sat. It should support Lightning, have liquidity, support good statement exports, be able to plug into existing account tools, and be either self-custody or compliant.

Even if you have an easy custodial wallet for your business, you are confronted with adding additional details to all the deposits from clients as part of the travel rule, which makes it a nightmare to accept bitcoin in a coffee shop for 10 euros.

1. Accounting breaks

Even if you manage to accept bitcoin, your account finds it incredibly hard to account for this, and also accounting for capital gains/loss comes with rate changes from the time of accepting and using this bitcoin.

Obviously you'll be using tools that will either not give a great export that you could use or plug into accounting software.

You'd need to hire crypto-expert accountants!

1. Taxes

You accept bitcoin - not sure about how this is treated from a tax perspective - if you auto-sell this incoming bitcoin to Euro - would the capital gain be 0 as you earned and instantly converted, or the first-in, first-out logic applied where you'd need to worry when you bought bitcoin to your wallet first time in ages.

It is not the willingness to pay taxes; it is knowledge of how to declare capital gains that comes with the bitcoin payments compliantly.

1. Business custody is not personal custody.

When you have multiple operators in an organization or a bigger company who have access to funds to spend on materials and services, you'd need governance and access to the funds.

Which gets way complicated with a self-custody wallet for business.

Bitcoin works - a free network - so cheaper payments, instant settlements and global acceptability.

All of these factors are a win for a business - but the banking, tooling, and process around it doesn't work. It does not make sense with all this friction.

Working on something interesting - but would love to get your thoughts on above.

Here's why I ask this. In the past when crypto was relatively new and you had small exchanges/companies handling stuff, yes if you kept your crypto on their platform and they went belly up or did a rug pull, you were stuck. Made total sense.

However today we have huge companies getting involved like Robinhood and I just saw Etrade is now offering crypto trading via Zero Hash. I get it, the same thing could happen on these platforms and if you don't own your keys, you're still stuck. But then I start to think about it in relation to owning stocks on these platforms. It's not like we own paper stock certificates that we can rely on if an exchange goes belly up. We are at the mercy of the SEC or FINRA or courts in that case.

So sure, owning your keys is still the best bet but is it so bad to invest in crypto on these platforms where we don't own our keys since we've been doing basically the same thing with stocks forever?

So yeah… I finally did it.

After years of working, saving, overthinking, and pretending I was waiting for the “perfect entry,” I moved about $48,000 of my savings into Bitcoin.

That’s basically most of what I’ve built from my job over the last few years.

Not some lottery money. Not daddy money. Just paychecks, side gigs, skipping dumb expenses, and trying not to blow it all on random stuff xD

I’m not saying this is smart. I’m not telling anyone to copy me. I know BTC can still drop 20–30% and make me look like a clown by next week.

But I’m 31, no major family responsibilities yet, and I’d rather take a real shot now than sit around for another 10 years saying “I should’ve bought more.”

I’m still keeping a small mining angle with oneminers too, so I’m not only relying on staring at candles like a stressed goblin. Plan is simple: hold long term, survive the ugly dips, ignore the noise, and see where this thing is in 10 years. Could be genius. Could be cope. Either way, I picked my lane.

Hi guys, I’m from the UK & I’ve only ever bought my bitcoin through Binance. As I understand it we can no longer do that. What’s your recommended platform for someone from the UK?

Edit: Thanks for the replies all, much appreciated

I am all in btc, and currently have 0.03(all my networth), and I make 2900 usd a month before tax and spending. Is there any way for me to reach 1 coin1-10 coins in a foreseeable future. (Let’s say 5 years) I just don’t know how there are so many people have a lot of money just to invest. I can barely break even sometimes, the rent is my highest spending, I was thinking maybe just living in my car. But I do need some advice, I can pull out probably $200 max every two weeks. Can you guys share your stories of how you have a whole coin or accumulate aggressively. Thank you

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

BTC gains could be a great way to tap into this hot market

Would like to invest. Where would you recommend I start?

Context: I’m 35M and I wanna escape the matrix and get rich quick and easy. Bitcoins at an all time low and based upon the charts in October it will skyrocket. I’m considering selling my car to just dump the cash in bitcoin.

... for gambling addicts. Because it is a 'meme' asset (or store of value or whatever you believe it to be), "if we all believe in it, it can only go up, right?" Unlike tulips, racehorses, equities, or any other speculative investment -- bitcoin has absolutely no fundamentals underlying it. It's just pure belief, maybe pure Nietzschean will to power.

The only limit to liquidity is when people (retail investors) need the money for something else, like rent. So the swings in value you see are nothing much more than the ebb and flow of disposable income among gamblers.

One branch of behavioral economics has speculated that money has a "drug" value, where the investment is more about the internal emotional reward that you are getting from the process (just like in going to a casino) than the convertible value of the asset itself. What you are really HODLing on to is the process addiction of anticipating gains, and the thrill of the risk, and the emotional rollercoaster of checking your portfolio, etc etc. The "bitcoin investment" is just what Alfred Hitchcock would call a MacGuffin.

Anyhoo, hope you guys are having fun at the track.

I am very much confident of a bottom within a few weeks. Bitcoin isn't going helow 60k.

Hey guys I started the my dca 2 weeks ago, but I’m getting a lot of people advising to sell the last few days, saying we are going to do another 20-30% dump.. essentially the argument is that we are entering a no more cheap money period, and we aren’t getting rate cuts any time soon, there’s no halving in the next few years so there are no bullish catalysts.. and the technical setup isn’t great. Whats everyone doing rn? We adding, holding or trimming?

I was on the fence but now I'm starting to think it might be the only way.

What are you guy's thoughts?

In other words, in order to withdraw my own money, they are asking me to prove where the money I earned throughout my life came from, how I acquired the assets I own, and to document all of them. It is unacceptable for a financial institution to make it this difficult and almost impossible for a user to access their own money.

If you own real estate, they ask for the title deed, sales documents, and the source of the money you earned before purchasing that property; for example, how you acquired a property you bought 20 years ago, official documents if it was inherited, documents proving your gold holdings if you own gold, records related to your vehicle if you own one... In short, they are asking me for official documents regarding all my assets and proof of the sources through which I acquired those assets.

They are asking me to provide documents that even the Ministry of Treasury and Finance does not require from you. Under what authority?

The worst part is that I do not have any assets or wealth at all. Despite telling u/okx this repeatedly, they continue to request the same documents from me over and over again. They keep repeating the same things like a parrot. They are refusing to give me my own money. This is a completely bad-faith approach and a way of victimizing users. Additionally, when I shared my situation in the u/okx Telegram chat group, they deleted my message and immediately banned me. I know that u/okx may respond to this message by asking me to send my information through private messages and promising to solve my problem. However, I have already done this at least 5 times, and every time I received the same response without any solution. I should also mention that I do not have a significant amount of money on u/okx , only a small amount, but I wanted to point out how bad-faith this platform's approach is.

I know that they have victimized thousands of users in this way. When you add up small amounts such as 100 USD or 200 USD from thousands of people's accounts, it becomes a significant amount of money. You can imagine what u/okx is doing with these funds by taking small amounts of money from thousands of users in this way.

This is clearly a method of fraud. It is unjustly taking people's money. This could happen to you at any time. Your money is never safe. I absolutely do not accept this bad-faith approach of u/okx towards its users. Therefore, always keep your funds in your personal wallets or store them on large and reliable exchanges such as Binance.

What happened to me has also happened to thousands of people on u/okx , and users have been victimized. I make small transactions with small amounts on exchanges. I send small amounts to my hot wallet in order to participate in airdrops and buy newly launched meme tokens on DEXs, trying to earn some profit. Despite these being the only activities I perform, u/okx is deliberately delaying the process and constantly avoiding returning my money.

PLEASE BE CAREFUL AND IF YOU HAVE MONEY ON u/okx , DO NOT KEEP YOUR FUNDS THERE.

Today my account was suspended; tomorrow it could be yours. You may be forced to prove your assets and sources of income from years ago just to withdraw your own money. If you are willing to take such a risk, the decision is yours.

What would happen to my dca strategy in strike if a hard fork came to happen with BIP 110 and stuff. Would it halt because there is no definition of what bitcion actually is at that time?

I do not like the idea of government and Bitcoin getting cozy with each other. But I wonder if politically there was a push to have more Bitcoin mining done in that specific country so that the country was more on a Bitcoin standard as a whole.

I'm just spit balling here.

I’m trying to separate the hype from the reality.

Did David Sacks actually accomplish anything meaningful for Bitcoin while serving as the White House AI & Crypto Czar, or was he mostly a symbolic appointment and political payback from DJT?

Specifically:

• What concrete policies, executive actions, or regulatory changes can be directly attributed to Sacks?
• Did he have any real influence over Bitcoin adoption or crypto regulation?
• Were there any promises that never materialized?
• If he had never been appointed, would anything have played out differently?

I’m not looking for partisan takes. I’m looking for evidence. What did he actually do versus what he got credit for?

Interested in hearing from people who’ve followed the policy side closely.

I have it on paper in my house hiding inside a wall???? but my mind thinks what happenss if i get flooded or my house gets on fire, so i replaced with a metal note but i still think that is not safe enough? What do you guys do?

There's a few "facts" that should be stated:

1. Fiat Currencies (USD, Euro, etc...) are controlled by GOVERNMENTS and these governments continue to spend MORE than they take in (aka "deficit spending"). This has invariably led to printing extra currency and creating the inflation that comes with it. It also means that if you choose to save in Fiat Currency you have the very real problem of ensuring that your savings growth EXCEEDS whatever the printing/inflation rate is. Otherwise, the purchasing power of your savings can decline.
2. Bitcoin is controlled by NO ONE (or "everyone") and, has a fixed limited supply (21 million BTC) and CANNOT be printed whenever some central power feels like doing so. This means that Bitcoin CANNOT experience inflation. It also means that if you choose to save in Bitcoin, NO ONE can erode your purchasing power (of course, this does require that Bitcoin become accepted/adopted as a viable commodity - something that is happening, but perhaps more slowly than we would like).
3. Central Banks (like the US Federal Reserve) are NOT thrilled about Bitcoin. If people choose to move their savings OUT of Fiat Currency (like USD) and INTO Bitcoin, that means that those banks (and the currencies they control) LOSE power. Obviously, they do NOT want to lose power. Thus, central banks, throughout the world, have taken significant action to destroy, restrict and control Bitcoin. They are NOT winning that battle, but they DO continue to fight.
4. Bitcoin adoption/acceptance continues to increase. Each year, more and more people own Bitcoin. This trend is rather overt. As adoption/acceptance increases, so has more mainstream involvement in Bitcoin. In 2024 Bitcoin ETFs were (finally) approved by the SEC and the influx of USD into Bitcoin ETFs on Wallstreet was enormous. In 2025, Bitcoin Treasury companies started emerging regularly. In 2026, Bitcoin products/investment vehicles popped up (Bitcoin loans, STRC/SATA, etc...).

So what does this mean, in terms of Bitcoin's future?

1. As our world continues to adopt/accept Bitcoin more and more, the price of Bitcoin in Fiat Currency will go up, simply because more and more people will want/need Bitcoin. A secondary feature is that Bitcoin's price increases (in Fiat Currency denominations) because Bitcoin does NOT have inflation - that is, Bitcoin's price increase simply because Fiat Currencies devalue - a $1 today buys LESS than a $1 10 years ago, etc....
2. The timeline for Bitcoin adoption/acceptance is more difficult to assure. Governments and Central Banks continue to try to protect their Fiat Currency by curtailing Bitcoin, but it is a losing battle. Some Governments and Central Banks are adopting the "If you can't beat them, then join them" attitude when it comes to Bitcoin.
3. In the longer term, Bitcoin is a superior form of savings/currency and, IMO, it will prevail over Fiat Currency. Yes, it might be a bumpy ride along the way, but, in general, superior products win out (consider Uber/Lyft vs. Taxi's, GPS vs. Paper maps, Cellphones vs. Land lines, TV vs. Radio, Internet vs. Libraries/Phonebooks, etc...).

Okay, okay. So what about the actual future price of Bitcoin?

1. Currently, about 15% of the world's wealth is "stored" in Gold and about 1% is stored in Bitcoin. Over time, we are seeing that "storage" shift (from Gold and into more Bitcoin). If Bitcoin captures even 5% of that world "wealth storage" the price of Bitcoin will exceed $500k per coin (or more). I like to refer to this as the "Gold Replacement Theory." Bitcoin has significant advantages over gold (easier to store, easier to divide, easier to transport, etc...). Again, as adoption/acceptance increases, Bitcoin becomes more of an obvious improvement over Gold.
2. The current adoption of Bitcoin is increasing rapidly. Most analysts agree that Bitcoin is advancing at a faster rate than the Internet advanced. This is great news for Bitcoin. IMO, I believe that we will only see more and more adoption (despite setbacks) and that in the next 5 years (or less) much of the price increase that I describe above will be experienced. Am I being too optimistic? I don't think so. Logic and history speak loudly here. People often have a hard time realizing when something obvious is changing their world. I remember so many people saying, "the Internet is a teen fad." It seems silly to say that NOW, but back then that's how it was perceived - they just could NOT see the implications of where it was going. I believe that, currently, many people have a similar "blindness".

On July 13, US government-linked wallets moved 3,940 Bitcoin and 30,014 Ether, roughly 297 million dollars combined, into Coinbase Prime custody. Sale speculation followed immediately.

The detail almost nobody is explaining clearly: Executive Order 14233, which created the Strategic Bitcoin Reserve, only protects Bitcoin from sale. Ether and other seized digital assets fall under a separate framework where Treasury has discretion. So the 244 million in Bitcoin here is protected on paper, the 53 million in Ether is not.

The Bitcoin traces to two forfeiture cases, roughly 2,875 BTC from a dark web dealer known as Xanaxman and about 925.5 BTC linked to the old BTC-e exchange. The Ether comes from a former Oracle employee's money laundering case.

Worth noting too that a deposit to Coinbase Prime is not proof of an impending sale. The Marshals Service has an active custody contract with Coinbase Prime specifically for managing seized assets, and similar transfers in January, May, and June this year did not result in confirmed liquidations.

The bigger structural point is that Executive Order 14233 is policy, not statute. Congress introduced a bill in May to codify the reserve with a 20 year holding requirement, but it has not moved out of committee. Until it does, Bitcoin's protected status here rests on one administration's choice, reversible by the next.

Full writeup with sourcing:

https://davidebtc186.substack.com/p/the-us-government-just-moved-297m

Is bitcoin finally starting to bottom out? I know that this has been one of the significant drops in bitcoin in recent history but when is it finally gonna bottom out into we enter into the bullish trends.

What's everyone's plans in when they are going to be investing and doubling down?

I’m starting to think BTC has alerts for my bad decisions.

Sold some around 58k thinking I was being smart.

Then BTC said “bet” and started pumping right after xD

Now I’m coping like:

“profit is profit”
“still holding most of it”
“totally planned this”

Spoiler: I did not plan this.

Good thing I still have some mining exposure through OneMiners, so at least my BTC brainrot has a backup lane lol.

Maybe I didn’t sell BTC. Maybe I just unlocked the pump for everyone else.

The lightning network is a second-layer solution on top of the Bitcoin blockchain that enables quick, cheap and scalable Bitcoin payments.

Here is the place to discuss and learn more about lightning!

Ask your questions about lightning

Provide reviews, feedback, comparisons of LN apps, services, websites etc

Learn about new LN features, development, apps

Link to good quality resources (articles, wikis etc)

Resources:

• Here is an awesome list of resources: https://bitcoinfo.org/lightning.html

• Want to test out your lightning fire power? tip the Bitcoin devs! https://bitcoindevlist.com/

• Previous threads: Search

• Lnbook getting closer towards being finished and can already be seen at: https://github.com/lnbook/lnbook

• Lightning Dedicated YouTube Channel: https://youtube.com/renepickhardt

• Also there is the playlist by chaincode labs: https://youtube.com/playlist?list=PLpLH33TRghT17_U3as2P3vHfAGL8pSOOY

• Lightning stores: https://www.lightningnetworkstores.com/

• Learn more and talk about lightning right here in r/Bitcoin, r/bitcoinbeginners and r/thelightningnetwork

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

That'd be sweet.

Warning to scammers: Don't waste your time DMing me. These are completely blank, zero-balance wallets generated locally strictly for testing bulk import scripts. There are zero funds involved, so save your breath and do not bother me.

I used a bash script to bulk import hundreds of extended private keys (xprv) into a Legacy Bitcoin Core wallet. The import was executed using the "importmulti" RPC command, utilizing output script descriptors with checksums (example format: wpkh(xprv...)#checksum).

Problem:

I need an efficient way to verify that Bitcoin Core successfully digested these keys and that the wallet holds the spendable rights ("ismine": true) for the generated addresses.

What I have tried (and why it failed):

Command tried: bitcoin-cli listdescriptors

esult: Threw error "Method not found (code -32601)".

Issue: If the flag is missing (as it is in Legacy wallets), it seems to instantly throw the method not found error

Command tried: bitcoin-cli listreceivedbyaddress 0 true

Result: Did not output the newly imported keys.

Source: In the Bitcoin Core source code (src/wallet/rpc/transactions.cpp), the listreceivedbyaddress function iterates over CWalletTx (transactions) and mapAddressBook (labels). Because the imported addresses have zero transactions and were imported without a specific "label" string, they do not exist in either map and are completely ignored by the output???

Command tried: bitcoin-cli getaddressinfo [address]

Result: This works individually to confirm "ismine": true.

However, because legacy wallets don't store the xprv natively, this requires first running the "deriveaddresses" RPC on every single xprv descriptor to find the anchor address before checking it. Doing this for hundreds of keys in a bash loop is highly inefficient.

Command tried: bitcoin-cli dumpwallet [file]

Thought process: Dumps the entire keypool to disk, allowing me to count total keys using grep.

Result: did not work. Also very stupid fix.

Source: https://developer.bitcoin.org/reference/rpc/dumpwallet.html. Also this is slow as heck.

Warning to scammers: Don't waste your time DMing me. These are completely blank, zero-balance wallets generated locally strictly for testing bulk import scripts. There are zero funds involved, so save your breath and do not bother me.

26 y/o. My significant other & I pretend we don’t have them, don’t touch it, we’ve never sold.

But just out of curiosity, does everyone in it for the long haul (20-30 years) ever think about selling?

I think the Bitcoin narrative should switch from "you are going to be rich" to "you may be more free".
Even if all the countries in the world would ban Bitcoin it would mean nothing, because the network it's going to work anyway. It's not a thing you can choose to ban in one day.

The extreme scenario is that every state would coordinate an operation to steal all the Bitcoin nodes in the world, even the small ones inside the houses of ordinary people. But how possible is this to happen?

As long as the world is going in the "right" direction (prosperity, cooperation, innovation), is fair to say the price should remain low. And now a question: could the increase of Bitcoin price show how much people put trust in the governments? Could the price of Bitcoin indicate the median "value" of the freedom in the world? (higher value/price = high chance we are going toward a dictatorship regime).

If there were a data leak from your exchange, or if the tax filings your government requires got exposed, would you still feel safe?

I went to buy bitcoin today, like I always do once a month and found out my state banned them. I always took cash and bought bitcoin. What options do I have now that dont involve using a credit card/bank card ? Can you buy bitcoin with a gift card/vanilla card ?

Edit: I do not want to link my credit card/debit card or my bank to bitcoin. This is what I am trying to avoid.

I am going to use Coinbase and purchase bitcoin with vanilla card. Seems to be the easiest.

2025 marked the first time in over 50 years that the U.S. experienced net-negative migration—or at least a near-zero drop. That alone is a macro shock. But it’s showing up in an odd place: crypto narratives.abcnews+2

A lot of commentators now act as if influencers must straddle two worlds: the old 4-year crypto cycle and whatever new cycle is forming around AI, compute, and agent-driven internet activity.

Take Charles Hoskinson’s forecasts:

• By 2029, a $50B/year market for confidential compute, with ~75% of AI inference running in trusted execution environments.
• By 2035, most searches, commerce, and online activity driven by AI agents, not humans. Humans end up in a “human internet” zoo while the “real” economy runs agent-to-agent on the global internet.

Those are strong claims about compute becoming the scarce, valuable asset. And yet, we’re also seeing a historic contraction in net migration—something that should, in theory, reshape labor, consumption, and tech adoption.finance-commerce+2

From a social-science lens, that tension is awkward. Psychology usually models behavior with bidirectional strategies (stimulus ↔ response, belief ↔ action), not a clean triarchy of “migration–compute–crypto.” There’s no obvious law of conditioning that says Hoskinson’s math should map neatly onto net migration trends. If anything, the “conditioning” for his followers already ran its course; now it’s more about status, narrative control, and who gets to keep commentating while Trump dominates the immigration/“job board” narrative.

My working theory:

• Compute became exclusive through cryptocurrency (mining, GPUs, data centers, tokenized access).
• That exclusivity started affecting offline behavior—hiring, migration choices, even which metros grow or shrink.whitehouse+1
• People who arrived “late” to Bitcoin still caught up if they had access to compute. In that sense, buying compute may matter more than timing your coin entry.
• A lot of shitcoins might actually work against the long-term compute economy by fragmenting capital and attention.

That doesn’t fully explain the loss in net migration. But it raises a question: if there were enough compute (and data) to model it properly, would we see a clearer link between crypto/compute dynamics and migration flows—or is this just a convenient narrative overlay on a policy-driven shock?

I’d rather not make money on shitcoins. There are legitimate people who came to Bitcoin late but leveraged compute to catch up. Maybe the real trade isn’t “which coin,” but “who owns the compute.”

Had a reflection while I was printing some statements for tax purposes, that I was doing the exact opposite of what Bitcoin stands for. So what do you think of the future?

Do you HODL expecting to eventually sell at a profit, or do you believe that in the future it will be used as a relevant currency?

Time for a wallet upgrade. What are you’re thoughts on Passport Prime?

Bitcoin buyers appear to be absorbing sell pressure more effectively around the $65,000 area, according to analysis tied to exchange flow data. The signal comes after Binance posted its largest single-day net outflow in nearly two years, with more BTC leaving the platform than entering. Onchain analytics firm CryptoQuant highlighted that Binance withdrawals have recently been running ahead of deposits—an environment traders often watch for because it can indicate reduced immediate supply on the exchange order book. Still, analysts caution that exchange outflows alone do not confirm a fresh, sustainable uptrend. Key takeaways CryptoQuant data shows Binance daily netflows have oscillated

When I first explored crypto wallets, I thought every wallet app created a completely separate account.Later I learned that what really matters is the recovery phrase.Different wallet apps can access the same wallet as long as they're compatible and you have the correct recovery phrase.That small realization made the whole idea of self-custody much easier to understand.

Was there any beginner misconception that took you a while to figure out?

Sharing this month's work, leading with the Bitcoin Core part since that's the most relevant here.

Bitcoin Core mining over IPC

Bitcoin Core's multiprocess build exposes a mining interface over Cap'n Proto IPC. mkpool now has an optional path that uses it instead of polling getblocktemplate over JSON-RPC:

• Templates come straight from the node's Mining interface (createNewBlock / waitNext), so a new template arrives as soon as the node has one, with no GBT poll loop.
• Solved blocks go back through submitSolution, and I keep the classic submitblock path as a redundant, bounded fallback so a found block is never lost.

Lower template latency and a cleaner block-submit path than scraping JSON-RPC, and it lines up with where Core's mining interface is heading. This combined with Stratum V2 gives you the fastest possible low latency way to mine Bitcoin. You can try it out today on mkpool.

Also shipped this month

• Bidirectional Stratum V2 <-> V1 translator: point a Noise-encrypted SV2 ASIC like a Bitaxe at any plain V1 pool, or point plain V1 rigs at an SV2-only pool. Tested end to end on a real Bitaxe over Noise.
• Scale-out roles (proxy / redirector / passthrough / clustering node) for multi-region and HA setups.

It stays genuinely solo: your payout address is your username, the coinbase is rebuilt per session, and a found block pays straight to your wallet. No pool custody.

Public pool: https://mkpool.com/

Repo (GPLv3): https://github.com/Mecanik/mkpool

Benchmark writeup: https://mkpool.com/blog/mkpool-vs-ckpool-benchmark

Happy to answer technical questions, especially on the IPC side. Not selling anything; the engine is open source.

What happens on that block for nodes and miner who don't support BIP-110 ?

My node does not support BIP-110 and will stay that way. What are the consequences?

There was a time when I honestly had no idea what to do next.

I lost the job I had been at for 5 years. The first few days were a complete shock. The only thoughts in my head were: "What now? What am I supposed to do?"

The hardest part wasn't even losing the job. The hardest part was feeling completely lost. It felt like everyone around me was moving forward while I was stuck in the same place.

Honestly, if it wasn't for my family, it would have been much harder. Instead of blaming me, they simply said, "We'll figure it out." That support gave me the strength not to give up.

After a while, I realized there was no point in sitting around waiting. I started looking for different ways to make money. I watched videos, tried different things, made mistakes, and wasted time. Then one day I accidentally came across crypto testnets.

At first, I had absolutely no idea what I was doing. But little by little, I started figuring things out.

And honestly, it wasn't even about crypto. For the first time in a long time, I felt like I was in control of my life again. Small steps, but moving forward.

If you're interested in how crypto testnets work, I already have a post about them. If you can't find the information you're looking for online, feel free to message me. If I can help, I'd be happy to. And just to be clear, I'm not selling anything.

I'm sharing this because I know what it's like to be in a place where it feels like there's no way out. If you're going through a tough period right now, just know that it won't last forever.

I'm genuinely curious. Have you ever had a moment when life suddenly didn't go according to plan? What helped you get through it?

Passed by the State Duma yesterday (July 21). Not a rumor, not someone's translation of a Telegram post, the actual bill. Here's what's in it:

• New licensing registry for exchanges, custodians, and brokers. Existing platforms get roughly a year to register.
• Retail investors can buy the most liquid crypto assets (bitcoin is the obvious flagship candidate, the report doesn't name the full list) through a registered intermediary, after passing a knowledge test.
• Cap for retail: 300,000 rubles (~$3,900) per year, per intermediary.
• Qualified investors also have to pass a test, but face no purchase cap. Prior trading history can count toward qualifying.
• Owning ≠ spending. This bill legalizes buying and holding bitcoin, it does not legalize using it as money. Paying for groceries in bitcoin is still banned domestically, so the ruble keeps its monopoly on everyday transactions.
• Carve-outs: foreign-trade settlement, mined crypto, and some securities transactions are exempt from that ban.
• Banks are required to block transfers to anyone they suspect of running an unregistered exchange.

Timeline: first reading was back in April. Most provisions are set to take effect Sept. 1. It still needs to clear the Federation Council and get signed into law, expected, but not done yet.

The part worth sitting with: a government that's spent years treating bitcoin as a threat to its monetary sovereignty just built a formal, licensed path for its own citizens to buy it. Gated by an exam and a spending cap, but a path. That's the move a state eventually makes once it accepts it can't kill the protocol, it regulates the door instead.

Source: The Block / The Bitcoin Act

I track moves like this across dozens of jurisdictions, if anyone wants the source link or a country-by-country comparison, ask below and I'll drop it.

Genuine question for the sub: does "exam + cap to start, uncapped once you qualify" count as a country actually opening the door to bitcoin, or is it just a more polite capital control? Where's the line for you?

Hello im trying to buy btc trough binance but the app says they are nit avilable methods for me? Why is that i always buy 200 dollar everymonth being doing this 4 years and now i cant buy anymore

I just logged onto my Coldcard Q for the first time since late last month and discovered all my bitcoin is gone. I haven’t done anything to compromise my security that I’m aware of.
Is anyone aware if any type of issues going around with coldcard’s security?
I’m at a loss as to how this could have happened.

I just bought Bitcoins for the first time yesterday from Kraken but so it's tied to my identity. I do not wish to have bitcoins publicly tied to my name as the privacy is the fundamental of the cryptos, so i would like to anonymize it, I saw what happened to Samurai/Tornadocash getting persecuted and it's sad so unusable protocol now.

Where do you make your bitcoins private? (It's not a tax evasion if you're asking, i already paid while buying and will pay if i do profits to my bank account obviously, i just want to hold freely).

Please utilize this sticky thread for all general Bitcoin discussions! If you see posts on the front page or /r/Bitcoin/new which are better suited for this daily discussion thread, please help out by directing the OP to this thread instead. Thank you!

If you don't get an answer to your question, you can try phrasing it differently or commenting again tomorrow.

Please check the previous discussion thread for unanswered questions.

https://btc.rottenwheel.com/

- Repository: https://github.com/rottenwheel/bitcoin-only-hugo

Upstream repository is in Vue/Nuxt, it's been ported from that, to hugo and it's live in my btc subdomain.

Upstream: https://github.com/bitcoin-only/bitcoin-only

Add, modify, or remove anything on bitcoin-only? Please open an issue.

* https://x.com/rottenwheel1/status/2079639316771324104

* https://xcancel.com/rottenwheel1/status/2079639316771324104

* https://stacker.news/items/1529736