Onwards and Upward! 🕊 Don't trust, verify! Time for plan B, ∞/21M 100 push-up per day till 100k team. Opsec and bitcoin that's generational wealth
Geneva, Switzerland
Joined January 2012
- Tweets3.1K
- Following2.4K
- Followers1.1K
- Likes32.2K
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
To those responsible for the theft of bitcoin from the Liquid Network:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.
We have engaged in good faith in an effort to secure the return of stolen user funds and protect the broader Bitcoin community. That effort should not be mistaken for acceptance of the actions taken nor of the terms being demanded.
We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation.
Bitcoin is hard money and can’t be minted without costs, Bitcoin doesn’t haircut users to pay a ransom.
To the Bitcoin community:
We are fighting for what we believe in, for the users whose funds were taken, and for the principles on which Bitcoin was built.
The community has demonstrated incredible resolve with teams of people dedicating their time in support of each other to identify and patch vulnerabilities in each other's products and systems. We are all driven by the mission that Bitcoin is the single best asset, for every person, company, and institution on the planet to invest, use, and build on. The world is a different place with the advancements of AI, and the Bitcoin community has responded with force to combat that threat.
Damage has been done, battles have been lost, but on the whole the Bitcoin community is gaining ground in the war with bad actors.
We want to thank the community for those efforts, for your support in hardening the network, helping users recover funds, and for your support in our assertion that crime does not deserve rewards.
To those holding the stolen bitcoin:
There is still an opportunity to resolve this responsibly. The bitcoin can be returned and we can revert to the standard of white-hat principals.
However, if the funds are not returned, we will pursue every lawful avenue available to us. We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.
More importantly, Bitcoin is transparent by design and the community is made up of the most sophisticated engineers, cryptographers, and white-hat hackers globally. Transactions do not disappear, and neither does the evidence they leave behind.
We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds.
Return the bitcoin.
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
Bitcoin’s most profound breakthrough is the ability to convert economic energy into digital form and bind it securely to a person, family, company, machine, or nation.
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
73% of women on the titanic survived.
Only 19% of men did.
Read that again.
Even the richest men alive, class, power, status, all useless when the ship started sinking.
Hierarchy collapsed.
Gender didn’t.
“Women and children first”
Not a suggestion.
A rule men didn’t break.
Men stood there.
No panic
No begging.
Just accepted it.
They didn’t ask:
“Do I know her?”
“Is she worth it?”
“Will she remember me?”
No one asked if it was fair.
No camera.
No applause.
No second chances.
Zero return.
Full cost.
Understand this:
When survival gets limited, a man’s life becomes negotiable.
Men like that built the world.
And today?
Masculinity gets mocked.
Call it whatever you want.
But when everything collapsed, men paid first.
This isn’t opinion.
This is history.
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
Unpopular Bitcoin opinion:
Multisig is NOT automatically safer.
Lately, Bitcoiners are recommending 2-of-3 multisig to everyone like they’re telling them to turn on Face ID.
“Just create three seeds, secure three signing devices, geographically separate the backups, preserve the wallet configuration and make sure everything can still be recovered if you die.”
Bro. 😂
Explain it to a five-year-old:
Mom, Dad and Grandma each hide a key to your Halloween candy. You need any two keys to get the candy.
Great security.
Until Dad loses his key, Grandma moves across the country, Mom forgets where she hid hers, and now nobody gets the f’king candy.
And yes, replace Mom, Dad and Grandma with professional custodians, vaults, banks, safety deposit boxes or locations around the world.
You haven’t eliminated risk.
You’ve changed which risks you’re exposed to.
And here’s the bigger problem:
Bitcoin is MONEY.
It should be easy to securely access and use without turning every transaction into a treasure hunt where you need an old map and have to track down enough pieces to unlock the chest.
A properly generated 256-bit secret isn’t something an attacker is realistically going to brute-force. The real battle is protecting that secret and the device that uses it.
Multisig reduces certain single points of failure.
But complexity creates its own points of failure.
For an experienced Bitcoiner with the right circumstances, multisig can be phenomenal.
But a properly secured single-signature hardware wallet with a strong passphrase is simple, sovereign, accessible and recoverable.
The best Bitcoin security isn’t necessarily the most complicated setup.
It’s the strongest setup you can execute correctly for the rest of your life.
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
Complete Summary of all findings:
Mk3 seed phrase = swept instantly
Mk3 seed phrase with random account = swept in 2d 2h
Mk3 seed + 1 word passphrase = swept in 6d 9h
Mk3 seed + 2 word passphrase = swept in 6d 9h
Mk3 seed + 3 word passphrase = swept in 6d 11h
Mk4 seed phrase = not swept after 6 days
In this video, I send bitcoin to a compromised Coldcard mk3 to see how fast the funds are wiped.
I created 5 wallets:
1. Standard Seed Phrase using the insecure RNG.
2. The same seed phrase with 3 different passphrases (1 word, 2 words, 3 words)
3. The same compromised seed phrase but with random account number.
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
My heart breaks for everyone affected by the COLDCARD exploit. Over 1,700 BTC confirmed stolen. For some, this was everything. A lifetime of work, sacrifice and dreams for their families, gone in moments.
If that’s you, please don’t do anything irreversible. Bitcoin can be earned again. You cannot be replaced. Call someone you love. Don’t be alone tonight.
Report it to the police. Document everything. Keep your hardware untouched. Save every transaction, address, screenshot and log.
And to everyone else, please show compassion. No lectures. No ridicule. No “I told you so.”
There are real human beings behind these losses, and right now some of them may be living through the darkest day of their lives.
Be there for them.
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
If anyone has contact with @zachxbt, other security researchers or security teams at exchanges, please share this post with them.
I am already reaching out to the people I know, but I would appreciate additional intros and sharing information on the @BtcpayServer exploit.
Thank you in advance 🙏
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.
Daniel 丹尼爾 🐂🌋⚡🟠🎲 retweeted
Satoshi’s wallets were generated with enough entropy & are still secure
But the coldcard wasn’t.
Sorry, but it’s hard to believe this is just negligence
