My take on Clarity Act:
- doesn't matter much for BTC or ZEC
- matters more for ETH and SOL, but still not tons (given below points)
- SEC is gonna release favorable rule-making that will do most of what Clarity would've done anyway
- tradfi will have ~2.5yrs to launch products & gain enough traction such that some future hostile admin won't bother attacking crypto too hard
- Crypto haters like Warren will probably have fully moved on to AI hate by the time a new admin could be in place anyway
Brooke⚡️ retweeted
🚨Scam Alert🚨
Threat actors may have compromised the email provider(s) used by Trezor and BitBox; malicious emails claiming both have bad RNGs that require security updates are being sent and the emails don't appear to be spoofed. No such security advisory has been issued!
Brooke⚡️ retweeted
There are 3 really simple things you can do to protect yourself against 90% of social engineering attempts. Most of these operations are casting a big net and just trying to scoop up unsuspecting fish. So make yourself a slightly harder target and they will pass right over you.
1. Don’t ever answer the phone for unknown numbers. Even when the location says Mountain View, CA, or the caller ID says Google. It’s fake! To ensure you don’t get tricked, set your phone setting to Silence unknown numbers automatically. On iPhone it’s Settings ➡️ Phone ➡️ Screen Unknown Callers ➡️ Silence (see screenshot). Many times, bad actors are using fear over the phone to get you to do things you shouldn't - like give them control of your email.
2. Add 2FA to your main email account, and make sure it uses a unique, strong password. Use either an authenticator app or a Yubikey (better) as your 2FA. Accounts.google.com ➡️ Security & sign-in ➡️ Turn on 2-step verification. Then make sure your password is a unique password that isn't used anywhere else. If you are using the same password in more than one place, it's highly likely that it's been leaked. Just go to haveibeenpwned.com, put in your email address, and look at how many leaks its been in.
3. If you use Google Authenticator, turn off the cloud sync. When you have cloud sync on, if someone compromises your Google account, they can steal your 2FA. It makes 2FA ➡️ 1FA, and that is bad.
These are the basics that you can do to protect yourself against a huge amount of social engineering. And then if you want extra protection for your BTC, check out the next post 👇
Brooke⚡️ retweeted
🚨CRYPTO INVESTORS: DO NOT SCAN THIS QR CODE
A fake IRS notice is being mailed to crypto holders directing them to a bogus “Digital Asset Compliance Portal.”
It looks very convincing. It isn’t real.
Please spread the word.
Strike is proud to stand with @bitcoinpolicy and this coalition.
Attackers already use AI without limits. The people defending against them shouldn't be the ones held back. Give defenders access to the best tools, and frontier AI becomes one of the strongest defenses we have.
It's time to give defenders the tools they deserve.
Today, Bitcoin Policy Institute and a broad coalition from across the digital-asset ecosystem are publishing an open letter calling on the world’s leading AI labs to provide qualified open-source defenders with trusted access to frontier AI models.
The past several weeks have made the need for this abundantly clear. The people defending digital-asset infrastructure and open-source software need access to the latest AI capabilities to perform comprehensive security reviews and stay ahead of increasingly sophisticated adversaries.
The coalition includes open-source development organizations, major custodians, treasury companies, payment services, security firms, capital allocators, and others whose businesses and customers depend on the integrity of open-source infrastructure and libraries.
Open-source defenders often occupy the least privileged position in the AI security landscape. They have limited access to the strongest internal cyber models and are frequently blocked by guardrails when using publicly available frontier systems for legitimate security research. As a result, they often resort to less capable open-weight alternatives.
We are urging frontier AI labs to establish a clear, trusted pathway for qualified open-source and digital asset defenders to access their strongest capabilities, with sufficient compute and secure environments to conduct meaningful security reviews. Frontier AI could become one of the most powerful defensive technologies ever developed, but only if defenders get fair access to those systems.
It’s time to give defenders the tools they deserve.
Read the open letter, add your organization, or sign as an individual on our website at btcpolicy.org/ailetter
We're seeing an increase in phishing websites impersonating Trezor, including fake sites appearing in sponsored search results.
These sites can look extremely convincing. Entering your wallet backup on one of them could result in your funds being stolen.
Never enter your wallet backup on a website or share it with anyone.
Don't assume a sponsored search result is legitimate. Always verify that you're using the official Trezor website: trezor.io/
Many kind people in my DMs asking how they can donate.
Thank you for being generous and offering your help.
The best thing you can do to help us is to donate to @OpenSats.
They stepped up to pay our massive AI bill.
Whatever you donate there, converts directly into AI tokens hunting for bugs in Bitcoin. The rest becomes a donation to the broadest open source fund in the Bitcoin ecosystem. Plus, they're a 501c3.
opensats.org <-- it takes 30s
Bitcoin Red Team update: we've grown to 16 globally distributed people working 24/7
We're running a large-scale ecosystem security audit across bitcoin code bases.
27.5 hours in, we've filed 4,962 findings across 390 projects. 85 critical and 635 high severity issues.
We're at 2.31 h+c findings per person per hour
Brooke⚡️ retweeted
The cleanest repo is Libsecp256k1, the foundational library which handles all Bitcoin signatures.
Thank you Jonas and the entire Bitcoin Core libsecp256k1 team for your service, you are all heroes 🫡
Thank you & the team! I’ve had similar experience where a good prompt or question would change the assessment of the agent significantly. That seems to imply that there’s still quite a lot of room for agents to improve in this task and we’ll see new waves of vulnerabilities with each new, more powerful generation.
Brooke⚡️ retweeted
This week’s episode is not about markets or macro.
Today Jack breaks down private keys, randomness, the Coldcard incident, seed migration, multisig, and what Bitcoin custody actually means for Main Street.
Back to first principles.
LIVE with @jackmallers today at 6pm ET 👇
Brooke⚡️ retweeted
Yes.
At @Strike, we built an agentic system that reviews our codebase daily with frontier AI models, including @Kimi_Moonshot K3, searching for vulnerabilities alongside our security team.
We’ll share more soon and share what we can with the broader Bitcoin community.
I am urging engineers who are in the Bitcoin ecosystem, use @OpenRouter or @opencode to use @Kimi_Moonshot K3 on any software you run which interacts with bitcoin in any way internally and any public repos you use.
Other models CAN find issues, but K3 will one shot full vulnerability reports to get an extra set of eyes for security checks.
Some of it will be slop/overstated/wrong, but I've been scanning open source repos and finding things I'll be passing along to maintainers.
Kimi K3 came out as open weights on Monday, and I don't think that is a coincidence as it relates to the COLDCARD issues unfolding.
Brooke⚡️ retweeted
The last 24 hours of Bitcoin posts on 𝕏 discussing the hack of ColdCard wallets has been the largest open source technical support initiative ever undertaken by an organic community of educators, organizers, developers, and ordinary well-meaning people in history.
Brooke⚡️ retweeted
We’ve seen a lot of people moving bitcoin to @Strike while they rebuild their cold storage setup.
If you need somewhere safe in the meantime, we’re here.
More importantly, if you need help, whether you’re a Strike customer or not, DM me or @Strike.
Questions about onboarding, limits, withdrawals, security, or your custody setup, we’ll do everything we can to help.
Bitcoiners take care of Bitcoiners.
Brooke⚡️ retweeted
Firmware fix released. coldcard.com/docs/upgrade/
If you are affected you MUST generate a new seed and transfer funds.
Brooke⚡️ retweeted
If you have bitcoin residing under a single key that was generated on a Coldcard Mk3 between 2021-2023, and you
- did not incorporate dice rolls
- do not use a passphrase
- do not use multi-sig
I would advise moving funds as soon as possible.
I was compromised yesterday by this hack and thinking I was catching up with @Willwaukee over a call.
It’s the most sophisticated social engineering hack I’ve ever seen and I get spammed with every phishing attack daily.
I haven’t seen Will in a few years, but it looked like him. Genuinely.
I’m sharing this so it doesn’t happen to you.
🧵 thread
🚨 PSA 🚨
My old telegram account has been hacked, attacker is preying on my contacts to set meetings. They use Microsoft Teams & deep fakes. Victims are prompted w/ a Teams update (malware!). I WILL NEVER REQUEST A MEETING WITH ANYONE USING MICROSOFT TEAMS! Please spread the word. @tayvano_
Brooke⚡️ retweeted
We’re surprised @in3rsha couldn’t think of educators and advocates who have publicly praised his work, but maybe that’s exactly the problem: many of us took it for granted.
We’ve run multiple educational programs, host 900+ bitcoin tech learners in our Discord, and Learn Me A Bitcoin has always been an obvious go-to resource.
And we’re not alone. We’ve collaborated with, or had visibility into, programs and communities run by @ChaincodeLabs, @btrust_builders, @libdesatoshi, @bitshala_org, @Bitcoin_Devs, and @summerofbitcoin, and Learn Me A Bitcoin is so complete, unique, and thoughtful that people naturally find it, share it, and bring it into their own study paths, often before we even need to recommend it ourselves.
So here’s the urge: if Greg’s awesome explainers and diagrams helped you or your community, say it publicly. Work like this deserves more appreciation.
learnmeabitcoin .com is goated amongst educational bitcoin resources
it's got the best explainers and it's packed with utilities
was a pleasure chatting with @in3rsha diving into everything: from the genesis story to how Tachyons is his preferred CSS framework, and much more




































