Roy retweeted
The West is fighting three issues:
1. Socialism
2. Doomerism
3. Radicalism
More often than not, people are infected with all three at the same time.
The future of the West will be defined by how successful these ideologies are in influencing young people.
Roy retweeted
so much timesless wisdom compressed in 3,5h.
My 3.5-hour conversation with @naval.
Fresh takes on every idea from The Almanack of Naval: happiness, judgment, knowledge, leverage.
Now in one episode, available on Spotify, Youtube, etc.
Roy retweeted
This has been Saylors best speech so far, I think. I always get goosebumps when I watch this one.
Bitcoin is the union against the failing monetary system.
When I gave this speech in October 2022, Bitcoin traded near $20,000, Strategy held 130,000 BTC worth about $2.6 billion, and $MSTR was ~$24 split-adjusted. Weeks later, after Bitcoin fell below $16,000, our debt exceeded the combined value of our BTC and cash reserves by ~$300 million, and $MSTR fell into the $13 range by year-end.
We stayed focused, strengthened the company, and executed our strategy. Since then, Strategy has raised over $60 billion of additional capital and invested it in Bitcoin, adding more than 716,000 BTC. Today, our BTC and USD reserves exceed debt by ~$48 billion. Thank you to everyone who believed, endured, and took the long view.
Roy retweeted
We asked filmmakers around the world to show us an optimistic vision of the future that’s worth living for everyone (not a Terminator saga).
2,500 of them answered, and now this Friday in Los Angeles, the top 5 will pitch their visions to Neil deGrasse Tyson, Neal Stephenson, Rod Roddenberry, and Mira Lane.
If Bitcoin were so boring, Jason wouldn't write about it regularly. But he has a point: Bitcoin has become somewhat boring; it's matured.
Uninteresting for VS Money because it's very difficult to influence and control.
The dead cat continues to bounce.
What is Bitcoin, 17 years later?
It’s not great for transactions or smart contracts; the user experience is still intimidating for most, and it’s no longer capturing the public’s imagination.
If it comes up at the dinner party, it's followed by a hearty “remember that!”
It’s a boring store of value, trusted as that—which is its biggest value.
It's boring.
Folks expect bitcoin to be stable and that it’s no longer a way to get rich quick.
Institutions embracing and accumulating it took $btc from punk rock to Muzak.
Advocates went from pirates to suits in orange ties, awkwardly sharing cringe memes — just like the cool kids do!
If Bitcoin were going to reach mass adoption and an important use case, it does better than anyone else, it would have by now.
Bitcoin feels like the CD in the age of Spotify, the DVD in the age of Netflix — a bridge technology that folks who invested in “their collection” keep saying is the better experience.
Perhaps bitcoin is vinyl, cool memories and fun to drag out and put on display, but a technology that served us to get to where we are now.
Roy retweeted
gained a ton of new insights working in bitcoin red team 🟥 that i wish i could share without vague posting. but this is what i got anon.
- we’re experiencing a massive collision between decades of human open source slop against 2 weeks of kimi k3 (not good)
- everything is broken, bitcoin is burning
- bitcoin is becoming stronger through this
- bitcoin is the obvious first target but the rest of the world will follow shortly
- sometimes old things need to burn so new things can grow on healthy soil
- humans should never code in c (just stop)
- lightning is complicated and is more broken than the average (sorry)
- verification is free. we used to complain about slop PRs. then about slop security audits. if you can’t handle the information overload, stop complaining and use AI to sort through it.
- those projects that started AI audits months ago are in a completely different position than those who didn’t
- projects need their own AI audit pipeline going into the future
- the burden for a developer to keep software safe and secure is pretty stressful and not for everyone. it has become a lot more stressful now.
- unmaintained projects are most probably broken, don’t rely on them. i’d rather one-shot it myself with a modern AI
- multiple concurrent, diverse human approaches have proven to be the best vulnerability search method
- external red teaming will probably have to continue forever
- we’ve basically completed a basic scan of virtually the entirety of bitcoin open source. the low hanging fruit is done.
- we’ve reported a ton of real critical and high vulnerabilities. project maintainers across the board have validated our findings.
- response speed is very different across projects and shows how healthy each project is. i recommend acting fast these days.
- red team etiquette matters. if you don’t disclose responsibly, boast on twitter about your findings on a particular project, or make indications about the nature of particular findings, you’ve disqualified yourself as a serious security researcher. trust is the most important factor in this game. if you lose it, it’s very hard to win it back.
- did i mention that humans should not code in c?
love you all.
BIP-110 is done. The fork happened. Now, the Bitcoin community can move on and stop talking about it.
Why is it even worth engaging with this topic anymore?
Remember, where intention goes, energy flows.
The overreaching attempt to change Bitcoin's consensus rules no longer deserves any energy.
more heroes
red teaming bitcoin:
- we’ve written multiple harnesses and we’re launching a huge wave of reviews against many core bitcoin projects: crypto libs, wallets, infra, …
- situation is extremely bad.
- we’re averaging on the order of 1 critical exploit per hour per person.
- we’ve reported critical vulnerabilities to several projects in the last 12 hrs.
- thankfully this is a very expensive exercise, we’re burning through 10k per day.
- you can donate tokens or accounts. send me a dm.
- thank you to @OpenSats for covering the bill.
- thank you to @Kimi_Moonshot and Kimi K3 for providing us with accounts and uncensored intelligence
Roy retweeted
I have spent over $10,000 scanning 100+ bitcoin ecosystem related libraries looking for vulnerabilities with Kimi K3 running as quarterback.
Myself and a small "Red Team" have found multiple serious vulnerabilities impacting the ecosystem. They vary in scope severity, but this is a call to action.
For any critical tier vulnerability that was identified if I was able to immediately demonstrate a POC (proof of concept), I have already responsibly disclosed to the maintainers.
HERE IS HOW YOU CAN HELP ME
IF YOU ARE NOT TECHNICAL:
- please share with me any repository that is on github that I can scan, we want to cast a wide net. It takes a few moments for you to link github accounts, we'll take it from there
- if that project does not have a SECURITY.md make an issue asking the dev to list one
IF YOU ARE TECHNICAL:
- If you are a maintainer or contributor to a project, I may have already scanned your repo, hit me up I'll share the results, if not I'll add your project to the list.
- If I can trust you to do larger review to start looking through this stuff to give me more eyes let me know.
AI Has forever changed software development. Tomorrow marks 1 week of Kimi k3 being live in open weights.
We are going to accelerate.
Roy retweeted
I'm taking a moment here in between one-on-one calls to give praise to someone I've had the pleasure of working alongside for a while now.
Nathan @theBTCmentor has barely gotten a wink of sleep since this whole debacle began. As we speak he's coordinating a private group chat of 9 people on our team, sending those in need to the next available Mentor and then jumping on more himself.
He is neglecting his eating, his sleep, his well being and working until he can't keep his eyes open, then passing out and returning to the fray when he wakes again.
Every Mentor is volunteering their time for free to tackle this.
The stories I've heard (and experienced in my one on ones) as we sort through this mess have been harrowing. Many ending in sobs and tears of relief... while others with deep sadness and regret.
He won't publicly announce this or ever expect credit for it, but the work of Nathan and the rest of the mentors over the past few days have managed to migrate and save people's fortunes to the tune of tens of millions of dollars. Nathan and the rest of the people on this team are fucking saints. I'm lucky to have ever met him, lucky to have every other incredible Mentor we've got over here, and proud to call them all my friends.
More work to do, but I wanted to shine a light on the people I'm admiring most right now.
In times of crisis and doubt, real heroes emerge.
“I have spent close to $5k on LLM tokens over the past 24 hours scanning over a hundred bitcoin related repositories. As of now, I have seen no vulnerability that has me concerned about any hardware device outside of the Cold Cards.”
Amazing work from Rob and sound advice here
Roy retweeted
Take what’s happening with Coldcard and Kimi’s open-weight model, then extrapolate it across America’s critical infrastructure. Malicious actors will use increasingly powerful open models to relentlessly probe our power grid, financial systems, telecommunications, defense hardware, and transportation networks for vulnerabilities.
They may not attack solely to cause disruption. They could quietly identify a critical weakness, take short positions against the affected companies or industries, then exploit or expose the vulnerability and profit from the resulting panic and market collapse.
That is the future we need to prepare for.
Roy retweeted
Should you lose faith in self custody due to recent events? I think not.
Third party custodians are also susceptible to weak RNGs. Interestingly enough, COLDCARD is one of the few devices that support dice rolls (along with seedsigner and krux.)
blog.lopp.net/how-to-securel…
Bitcoin product manufacturers need more hackers to regularly test their products for security vulnerabilities.
Bitcoin influencers have a responsibility to test the products they promote and to regularly question their security and integrity.
It saddens me to see people lose their Bitcoin, especially since they had hoped to gain more freedom, independence, and sovereignty through it.
Roy retweeted
I am urging engineers who are in the Bitcoin ecosystem, use @OpenRouter or @opencode to use @Kimi_Moonshot K3 on any software you run which interacts with bitcoin in any way internally and any public repos you use.
Other models CAN find issues, but K3 will one shot full vulnerability reports to get an extra set of eyes for security checks.
Some of it will be slop/overstated/wrong, but I've been scanning open source repos and finding things I'll be passing along to maintainers.
Kimi K3 came out as open weights on Monday, and I don't think that is a coincidence as it relates to the COLDCARD issues unfolding.
Roy retweeted
I'd like to see more unity around incidents like this. When hundreds of wallets are being swept and the root cause remains unknown, it shouldn't become an opportunity for competing manufacturers to dunk on one another or score marketing points.
We should treat this more like aviation treats a crash: competitors come together, investigate what went wrong, share what they learn, and use it to make the entire ecosystem safer.
Because if retirement attacks are genuinely possible, this isn't one manufacturer's problem. It strikes at the premise of Bitcoin self-custody itself. This is a moment for collective investigation, not competitive victory laps.
With the rapid development of AI, this is just the beginning. More security holes will be found everywhere. In the future every software will be measured whether it is unbreakable by AI and Quantum.
developing situation, but if you are currently using coldcard move your funds out of an abundance of caution
bugs have been found and exploited using ai
if you used dice rolls to generate your seed, you should be fine
if you use a passphrase, you should be fine
if you use multisig, you should be fine
would still move funds out of an abundance of caution
this sucks, coinkite team should release more info soon