RustyRubby retweeted
The ICC strongly rejects US sanctions against the institution:
🎥 Video Statement by the President of the #ICC, Tomoko Akane
Learn more ➡️ icc-cpi.pulse.ly/kyrbe2l43a
RustyRubby retweeted
Revolut has restricted access to around $28,000 of my money since 25 August. I cannot make outbound transfers, use my card, withdraw cash or withdraw crypto.
The restriction began without a clear explanation or any request for documents. Revolut later asked for information, which I provided. More than a month on, I still have no clear timeline for restoring access.
Revolut upheld my complaint and offered £75, but the restrictions remain. I have escalated the case to the Financial Ombudsman Service.
I want to know what justified the restriction, why the review has taken this long, and whether the communication and support I received meet the FCA’s Consumer Duty and the Payment Services Regulations 2017.
Journalists covering banking, fintech or consumer rights are welcome to contact me. I can share the correspondence and timeline.
RustyRubby retweeted
Customer: I lost 3 BTC. Five years of DCA. What are you doing for the people this happened to?
Coldcard: A new firmware release is available. 5.6.1 for Mk4 and Mk5.
Customer: I’m asking about the victims.
Coldcard: This release follows three weeks of sustained review.
Customer: Are you sorry?
Coldcard: We continue to acknowledge the customers who suffered severe financial losses.
Customer: Is acknowledging the same as sorry?
Coldcard: It is an acknowledgement.
Customer: Who wrote the code that emptied me?
Coldcard: It was the seed-generation attack.
Customer: Who wrote the code?
Coldcard: The attack.
Customer: Is anyone being compensated?
Coldcard: Updating does not repair an existing seed.
Customer: Is that a no?
Coldcard: Users should generate a new seed and move their funds.
Customer: There are no funds. That’s why I’m here.
Coldcard: We strongly recommend verifying the signed firmware download.
Customer: Have you spoken to a single one of us?
Coldcard: The release includes many additional security and correctness improvements.
Customer: Have you spoken to a single one of us?
Coldcard: Thank you for helping make this release stronger.
Customer: Do you understand what you’ve done to us?
Coldcard: The firmware is available now.
🚨 New COLDCARD firmware is available: 5.6.1 for Mk4/Mk5 and 1.5.1Q for Q.
This release follows three weeks of sustained review since our July 31 hotfix. We continue to acknowledge the customers who suffered severe financial losses from the seed-generation attack.
Every newly generated seed now requires one source of user entropy: at least 65 key presses with unpredictable timing, 50 physical dice rolls, or 128 physical coin flips. This input is combined with fresh entropy from the STM32 TRNG, SE1, and SE2.
The release also adds staged-PSBT verification immediately before signing, stronger USB and firmware-update boundaries, improved Delta Mode isolation, active-wallet backup fixes, stronger RNG initialization and fault checks, safer SIGHASH defaults, and many additional security and correctness improvements.
Important: Updating does not repair an existing seed generated on affected firmware. If the advisory applies to your seed, update your device, generate and verify a new seed, then move your funds.
We strongly recommend that all Mk4, Mk5, and Q users update and verify the signed firmware download.
Thank you to every researcher who reported issues, reproduced edge cases, reviewed fixes, and helped make this release stronger.
blog.coinkite.com/coldcard-s…
Can you not hijack my attention by training your prediction model on my brains cheap taste for bs videos? Thanks X.
RustyRubby retweeted
Self-custody has only gotten better over the years, and this nightmare will strengthen and harden the industry when we come out of the other side of it.
Don't give in and shift to ETFs or custodians, we're not dead yet 😉
RustyRubby retweeted
I haven't told the full story yet, but I came to the same conclusion back in May 2025 when I started doing an audit of `coldcard/firmware`.
I wanted to figure out conclusively where the CC RNG was getting sourced from, and found that it backed up to some shady library called libngu (github.com/switck/libngu) that had literally 6 stars on github and was maintained solely by a pseudoanon tranny.
I knew from past experience that linking to libsecp256k1 from Python was pretty easy, which seemed to be the stated purpose of the library use, and so I was confused about why it was there.
I sent a report to the CC team that I had doubts about whether the true RNG was actually in use, and pointed out that the hardcoded yasmarang constants in libngu were sloppy. I advised they rip the whole thing out and link against libsecp256k1 directly.
I was told that if something was wrong "we'd already know about it by now" and that everything was properly configured for the real boards.
I didn't follow up rigorously, which was a horrible mistake on my part.
RustyRubby retweeted
Sometimes, trust your guts. Even when you are told it's FUD. Turns out I was right, and that instinct saved so many fucking people. 5 days later, I think I'm not needed anymore, thank you everyone who trusted me and spread the word so quickly.
I'll write a "post mortem" as I lived it, as I think it's probably going to stay as my most valuable contribution to Bitcoin. Good night people, I hope you are safe.
RustyRubby retweeted
NVK used open-source code from Trezor to build Coldcard.
Then Foundation forked Coldcard’s code to create Passport.
NVK got mad and switched Coldcard to a Commons Clause license so competitors could no longer use their code.
But because he couldn’t simply relicense the GPL code he took from Trezor, he had to remove and replace it.
And during that rewrite, he introduced the RNG flaw.
That flaw stayed unnoticed for 5 years because nobody had an economic incentive to spend weeks auditing code they were no longer allowed to build on.
His greed caused his downfall.
Do I get this right?
#coldcard advice. If you have still not moved your bitcoin and it's only protected by a weak passphrase - use a miner to directly include your transaction instead of broadcasting it on the network. Current transactions could be monitored and cracked.
On their website #coldcard plainly say that passphrased wallets are at low risk but that's not true. Many people generate a passphrase for their main wallet but put some btc on non-passphrase wallets as a decoy. So attackers get a hint to brute force on those.
Why was there no independent security audit on coldcard mk3 v4+ ? The last one that I can find is on the mk2 by the ledger security team. So coinkite guys didn't even try to see if they have issues.
