Miami, Florida
Joined July 2011
All these attacks/failures were known point of failures, and will probably always be. The Ledger implant isn't a surprise, it's the same as having anyone access your computer or phone, when you aren't around. Implants are real issues, often hard to detect (sometimes invisible, in a similar looking chip or at software/firmware level). An implant during the supply chain is a known risk in the threat model. An implant while you aren't at home, left your computer behind at the hotel, etc, are targeted but also possible. The Coldcard bug was harder to deal with. It should NOT have been undetected for so long, it shows how even in open source, most people rely on others and don't take the steps to check an external audit was funded and delivered. Still, having all these coming at the same time act as a very good immune system booster, everyone is improving their setup, processes, and most importantly knowledge. We'll lose a few people to custodians and paper bitcoin, but freedom isn't free.
10
13
96
5,346
W. Aaron Daniel retweeted
New HBO show Band of Brothers airs its fifth episode, “Crossroads,” about WWII combat in the Netherlands and Major Richard Winters’s moral dilemma.
17
56
4
2,061
92,962
W. Aaron Daniel retweeted
Why do you love data centers? I asked partygoers what they thought tonight 👇
740
176
783
1,966
2,432,085
Quick thread of buildings of university architecture departments. 🧵 Harvard 1/
215
204
173
1,107
625,734
W. Aaron Daniel retweeted
Jugendstil punch bowl from c. 1905 by WMF, Germany.
3
62
4
475
9,918
W. Aaron Daniel retweeted
French Art Nouveau inkwell from 1900 by Paul Follot.
1
27
1
264
7,711
W. Aaron Daniel retweeted
America is the land of the free. We are founded on principles of liberty and free speech. Government powers must be scoped to the smallest set of powers possible. Your proposal to regulate directly removes liberty and endangers free speech. You falsely claim that your technology is too powerful to be left unregulated yet provide zero evidence of this alleged danger. A principled approach is to start with liberty and freedom, not fear of the unproven. My 100 Bitcoin are still safe...
1/2 Thanks Gavin for an especially thoughtful exchange. I don't usually spend much time on social media but I wanted to engage here because it really brings out the heart of an important conversation. First, on regulation, I think that “either concentrate it in the hands of a chosen few companies and politicians via regulation or distribute it widely” is a false choice.  I know that there’s a sort of Silicon Valley shorthand where regulation = regulatory capture = concentration of power, but I’ve always found this to be an overly simplified picture of the world.  Many people outside this bubble think of regulation as something that constrains corporate power and benefits ordinary people.  I don’t necessarily agree with that perspective either, rather I think it’s complicated and really depends on what the “regulation” consists of.  But in particular I think that those in the “regulation = regulatory capture = concentration of power” frame often underrate the decentralizing power of objective and fair institutional processes.  A crude analogy is that the formal court system can sometimes feel stuffy and elitist, but it does a much better job of defending the rights of vulnerable individuals than the alternative, mob justice.  At their best, institutions can vest power in ideas rather than people, and thereby decentralize that power. This is why Anthropic has always made its policy proposals very carefully.  We try very hard to make proposals that disadvantage (slow down) frontier AI companies while *advantaging* smaller competitors.  California’s SB53 (which we supported), and even the much-maligned SB 1047 (which we were ambivalent on), completely exempt any company below a certain amount of revenue or model training costs from being covered at all (it was $500M for SB 53, lower for 1047 but we objected to that).  More recently the testing process we’ve advocated for at CAISI and the White House involves more rigorous tests for frontier models than off-frontier models — something that differentially advantages challengers.  Similarly, the “Pacing the Frontier” letter envisions (or at least Anthropic’s preferred implementation of it envisions) modulating the pace of the very best models while not constraining those who are catching up.  This hurts the business interests of the frontier labs and helps challengers, including open-weights! Overall my view is that AI is *structurally* a technology that tends to concentrate power, for reasons that have nothing to do with regulation (more to do with the extreme implications of the scaling laws).  Open-weights do help some with this but are nowhere near a sufficient solution because they simply shift the concentration somewhat to those with the most compute and chips (which are roughly the frontier labs plus maybe hardware providers).  By contrast I think the right “rules of the road” can simultaneously (a) address AI’s cyber/bio/alignment risks, (b) institutionally constrain the power of the frontier AI companies, and (c) leave room for open-weights models while also addressing the specific risks that they bring. BTW I do not think that the events of the last few months have “failed to result in [my] preferred regulatory path”.  The approach that the Trump administration is reported to be taking — pre-deployment testing for frontier models, and also testing of open-weights models when they get closer to the frontier — is one that I am very supportive of, though of course I have to see the details to be sure.  I am also supportive of Demis Hassabis’ ideas around a FINRA-like entity.  This contrasts with six months ago when most of the industry was still pushing for preemption of all state regulation and no apparent federal approach either.
4
5
35
4,340
W. Aaron Daniel retweeted
The onchain metrics around the Coldcard incident reinforce how important self custody is to the resilience of Bitcoin as an asset class. In the couple of days around the hack: - 2.1k BTC was stolen - 22k moved to exchanges - 233k moved out of long term holder wallets in on chain transactions We at Casa know (based on actual customer conversations) some of the 233k was people moving from non-Coldcard single sig (ie Ledger, Trezor) to multisig wallets, because they realized single sig wasn’t secure enough for their needs. And other coins were moved from multisig->multisig as people removed Coldcard from their keyset. So somewhere between ~10x-100x the amount of bitcoin stolen was moved to safety as people sounded the alarm. This is a giant flashing neon sign showcasing the resilience that self custody adds to the network. If all that BTC was held at a custodian and the custodian was hacked instead, those numbers would have been flipped. A little bit might have gotten out the door to safety, and most would be stolen. As it was, the thieves had to crack one wallet at a time (and are still going), earning a little BTC each wallet, instead of cracking one wallet and getting a massive payday. And the asset price (and confidence) would have certainly taken a much bigger hit. Self custody is not just good for Bitcoiners, it is good for Bitcoin. H/t to @_Checkmatey_, @intangiblecoins, @SaniExp for the data
10
32
6
193
14,853
W. Aaron Daniel retweeted
America is trying one arm behind its back with "safety" for AI. We realized long ago at BitGo that we can't rely on US models to protect our clients. The worst thing is the sandboxing- where AI companies pick and choose who is allowed access, who wins and who doesn't.
Yesterday I began fully integrating the @OpenAI trust cyber program into my Bitcoin Red Team efforts. This morning I woke up to see this. I am now being blocked from doing additional analysis on a codebase which I've already responsibly disclosed to, and have received confirmation had legitimate findings. To be clear, this is after having already KYC'd and completed the onboarding process months ago to use the cyber capabilities OpenAI has to offer. I am now prevented from being able to continue the investigation in a further effort to make sure their code changes are sufficient, as well as understand if there are other issues that have yet to be discovered. It absolutely guts me as a patriotic American to have to do this, but I will be going back to using Chinese open source models to conduct my research to protect Bitcoin infrastructure. Black hats will not hit these issues. The white hats will. We've hit a local minima in policy. Intelligence is unrestricted for those who don't follow rules, and those who engadge in harm reduction are left on the sidelines. What are we doing in this country? How is this keeping people safe? Please do something @DavidSacks @sama @realDonaldTrump
9
18
1
99
12,892
W. Aaron Daniel retweeted
Yesterday I began fully integrating the @OpenAI trust cyber program into my Bitcoin Red Team efforts. This morning I woke up to see this. I am now being blocked from doing additional analysis on a codebase which I've already responsibly disclosed to, and have received confirmation had legitimate findings. To be clear, this is after having already KYC'd and completed the onboarding process months ago to use the cyber capabilities OpenAI has to offer. I am now prevented from being able to continue the investigation in a further effort to make sure their code changes are sufficient, as well as understand if there are other issues that have yet to be discovered. It absolutely guts me as a patriotic American to have to do this, but I will be going back to using Chinese open source models to conduct my research to protect Bitcoin infrastructure. Black hats will not hit these issues. The white hats will. We've hit a local minima in policy. Intelligence is unrestricted for those who don't follow rules, and those who engadge in harm reduction are left on the sidelines. What are we doing in this country? How is this keeping people safe? Please do something @DavidSacks @sama @realDonaldTrump
146
416
98
1,962
339,874
W. Aaron Daniel retweeted
Insane detail from the Roman Sterlingov @chainalysis case: the prosecutors introduced 100% fake evidence into the case. They claimed that a screenshot was a chat written by Roman. But they knew that it was actually from a ebook they Roman didn't write. Someone should have been executed for this absolute criminal fraud against the justice system. Of course, nothing happened at all.
7
41
2
204
13,711
W. Aaron Daniel retweeted
The @BlockstreamJade is one of the best hardware wallets on the market, bar none. I wonder how many people dismissed it due to the FUD that it lacked a secure element? Secure elements aren't a panacea but are often sold as such. A physical SE in the device means everything needed to extract the seed is sitting right there, and potentially in the hands of someone that steals it. It's a stationary target. An attacker can wreck a dozen units learning the technique before touching yours. Ledger's Donjon has done exactly this to Coldcard silicon twice, the Mk2 ATECC508A and later the SE2 on Mk4, and voltage-glitched the Trezor Safe 3's MCU. Jade moves the target instead. Your seed is encrypted with an AES-256 key that the device and a blind oracle build between them, and the oracle never holds more than a piece of it. The ESP32 only has ciphertext. You can't extract something that was never in there. The attack turns interactive, against a party who rate-limits you and wipes its half after three bad PINs. Coldcard split your secret across three chips from different SEs. That genuinely helps against one vendor's silicon getting broken. But the pitch lands as arithmetic, and security doesn't really work that way. As we've seen, bad entropy at setup meant none of the silicon even mattered. You could have 10 SEs in the CC and that wouldn't have saved you. But people ate that security theater up. My mind keeps circling back to what we could have done differently. I keep landing on the same conclusion: we should have pushed back on the SE FUD much harder, and promoted Jade far more aggressively. We'd never have attacked CC, but we should never have taken the unwarranted flak for Jade's security model. The FUD steered people away from Jade. If we'd fought it, maybe more of them would have avoided the CC tragedy. When we first launched the Jade, it sold for just $39.99. For that price you got such an incredible amount of value (at launch and later with subsequent updates). ➡️ Virtual secure element via blind oracle (@Blockstream's or self-hosted) ➡️ Can function as a stateless signing device (like SeedSigner) ➡️ Anti-Exfil protocol to protect against your seed being exfiltrated (Jade is one of only two HWWs that do this) ➡️ Genuine Check verification to prove the device is authentic and untampered with ➡️ Secure Boot ensuring only properly signed firmware runs ➡️ BIP39 passphrase and duress PIN ➡️ Air-gapped operations ➡️ Store Liquid assets like @tether USDT ➡️ Multisig support AND the ability to back up the multisig config (descriptors) for a setup involving ANY devices (or mixed hardware/software), as long as at least one Jade is part of the multisig - this makes multisig far less brittle since losing the config is catastrophic The best part of all of this? You don't even need to BUY a Jade. You can build your own with almost any ESP32 board. Pair it with your own self-hosted blind oracle and you have a completely sovereign stack with no HWW vendor supply chain risk. If you're looking for a new hardware wallet, take a serious look at @BlockstreamJade. It's built by a world-class team of engineers and cryptographers assembled by @adam3us. But don't take my word for it. The firmware is fully open source, so read it yourself. Don't Trust. Verify. blockstream.com/jade
26
78
13
622
69,422
W. Aaron Daniel retweeted
✅ BDIC by Resolvr is designed to integrate directly with wallets like @Bitkey to offer bitcoin-denominated insurance policies to Bitcoin holders from licensed insurers. We're here to make the Bitcoin economy more resilient.
1
2
2
59
W. Aaron Daniel retweeted
Welcoming Apogee to the ecosystem: a new self-custodial Liquid wallet in your browser. Pair it with @BlockstreamJade, or start with a 12-word seed you back up. From @Resolvr_io, one of Bitcoin's most impressive dev teams. Free and open source with self-custody as the standard.
We made a @Liquid_BTC web wallet extension for Chrome (Firefox coming), apogee.resolvr.io/ It's dapp-ready. Web apps can be built to connect to Apogee, read balances, and request transactions — with every approval signed inside the wallet. Keys never leave the device. That's self-custody from the web page all the way down. See your balances and execute transactions. Direct support for the @BlockstreamJade hardware wallet — including signing for dapp requests. Simplicity support on the way. Free and open source. Repo: github.com/Resolvr-io/apogee Special thanks to @Blockstream for all the support.
7
16
1
46
14,966
W. Aaron Daniel retweeted
The insights, mentorship, and support we’ve gotten through the @PurdueInnovates Accelerator have been invaluable as we build Resolvr. Our co-founder @TheSchwab recently demonstrated how we’re creating regulated infrastructure to bring digital assets into insurance and reinsurance as efficient collateral and capital. This is just the beginning of reimagining how risk moves through the global economy, and we’re glad to have such a strong team in our corner. stories.prf.org/purdue-innov…
2
5
212
W. Aaron Daniel retweeted
"There's nothing worse than trying to protect against quantum computing and then making Bitcoin insecure against regular computing." @adam3us on why hash-based signatures are the conservative post-quantum choice for Bitcoin. Based on a 1979 paper. Decades of analysis. SHRINCS is where @blksresearch landed.
10
24
3
96
18,170
W. Aaron Daniel retweeted
Why is #bitcoin an infinitely better asset to insure than a diamond ring? 💍
2
4
10
679
W. Aaron Daniel retweeted
Today we are launching a new BPI campaign at fixbasel.org to stop the shadow ban on Bitcoin — and we need your help 🇺🇸 Right now, Bitcoin financial services are severely limited due to guidance from central banks called “Basel” that treat bitcoin as a toxic, high risk asset. Basel serves as a backdoor way for global central banks to limit what Bitcoin products and services Americans have access to. US regulators are actively considering revising this guidance. They are accepting public comments on this issue until June 18th — We need your help to make this issue a priority for the administration. On our website below you can learn more about this issue and submit a comment. We’ve even provided a sample comment to help you get started. Check it out below.
US regulators have a rule on the books that effectively bans banks from holding Bitcoin — and the window to fight it closes June 18. We built FixBasel.org so you can submit a comment in *minutes*. This is your chance to stand for Bitcoin in the federal record. Make it count.
14
55
9
247
52,220
W. Aaron Daniel retweeted
Just published from @TheBitcoinConf 2026: Self-Custody Insurance: Protecting Your Bitcoin Without Giving It Up with @coinjoined @Rob1Ham @KLoaec moderated by @wadaniel youtube.com/watch?v=iyB7FwrI…
3
2
6
534