Opensource >>>> Unbranded - DIY
Unbranded Free Software is widespread
Software is commoditized --> 0 $
IP moat on software is destroyed
Opensource is still branded software and well packaged product where users invest their time, energy and feedback
Met @jperla at the @PresidioBitcoin Open Source AI Summit and really appreciated his commitment to privacy and open source. Cool to see he’s built a tool that lets you pay for AI requests with bitcoin over the Lightning Network!
Wiz Learner retweeted
Generating a seed with dice and importing it into a hardware wallet does not eliminate trust in the device.
Every time you sign, you trust it to show you the real transaction data and not leak the seed through an undetectable kleptographic channel.
Wiz Learner retweeted
what is happening now for the bitcoin industry is a preview of what will need to happen for every other industry in the upcoming months
it's starting with bitcoin because:
- this is where there is the most immediate and transferrable asset to steal from.
- the security posture of most repos/projects have not caught up with the open source model capability.
but when the low hanging fruits are gone (ie: k3 just doesn't find vulnerability anymore by simply pointing it out in a github repo), then the blackhats will mostly move elsewhere
Bitcoin Red Team Update:
We have been working around the clock, with ~$20,000 of spend up to this point across different services. Funding is secured, I appreciate all the gestures for donations but it is not necessary. The bill is taken care of.
We have done over a dozen disclosures up to this point, with 150 repos scanned. The hardest part is coordinating to get things to the right people (thank you @danielabrozzoni for the help)
I have a first pass on a bitcoin red team agent harness which only requires an @opencode zen api key, makes it easy for us to use K3 for the actual heavy lifting and then GPT Sol + Fable/Opus + GLM5.2 for supporting documentation.
While it is powerful, having found critical issues, I would view this as only version one. There is a lot of iteration I'm looking forward to improving on.
Our goal is to open source the harness so it can be pointed at internal repositories for insights so the hardening of defenses can go deeper than the code which is made public.
We also have been connected with OpenAi for some help so I could manage getting the @OpenAI Cyber Harness running as well (thank you @lylepratt ). Its a much more expensive scan, but well worth it for load bearing portions of the bitcoin ecosystem and has already yielded good results.
Goals for tomorrow are scale in processes and systems so we can do a better job and automating full end to end functionality to get humans out of the loop for the heavy lifting. The first mile (requests/staging) and last mile (handoff of reports) are the choke points right now.
Thank you @stutxo @callebtc @benthecarman @thesimplekid and so may more.
Wiz Learner retweeted
As you can see below, Kimi K3 is one of the main models Bitcoiners are using to patch their software and improve industry security.
GLM-5.2 was the model that HuggingFace used to patch its software when it was being hacked.
Bitcoiners and HuggingFace are not using OpenAI and Anthropic models to patch their software because those models are locked down in the name of cybersecurity.
The very policy that was designed to protect us is in fact holding us back.
I really hope that OpenAI and Anthropic reconsider their positions and provide a safe but accessible way for the broader populous to patch their software and contribute to the long tail of security and safety online.
red teaming bitcoin:
- we’ve written multiple harnesses and we’re launching a huge wave of reviews against many core bitcoin projects: crypto libs, wallets, infra, …
- situation is extremely bad.
- we’re averaging on the order of 1 critical exploit per hour per person.
- we’ve reported critical vulnerabilities to several projects in the last 12 hrs.
- thankfully this is a very expensive exercise, we’re burning through 10k per day.
- you can donate tokens or accounts. send me a dm.
- thank you to @OpenSats for covering the bill.
- thank you to @Kimi_Moonshot and Kimi K3 for providing us with accounts and uncensored intelligence
Wiz Learner retweeted
Kimi K3 unleashed is... terrifying.
It's one thing to scan codebase for security issues (which Claude and OpenAI block). It's another entirely to launch a fleet of AI to actually hack your service.
The normies and fiaters truly have no idea what is about to happen.
Wiz Learner retweeted
Coldcard Theft Phases & Timeline
We can expect an attacker to start by hunting for the weakest keys first which are the cheapest to find (in terms of the computational cost) and which require the least time to develop the tooling required.
We can then expect them to move on to the harder to steal coins (more cost, more tooling required) only once they have exhausted their search or detect that they have competition within a search space.
With what we now know I think that we can expect 3 phases of theft
Phase 1 (Fully offline single sig)
- Attacker can construct and broadcast a complete valid transaction immediately after cracking keys offline
- Fully automated, high throughput, no external dependencies
Likely theft order
- 1.1 single sig Mk2/3 no passphrase, no dice throws
- 1.2 single sig Mk2/3 with weak passphrase or small number of dice rolls
- 1.3 single sig Mk4 / Mk5 / Q no passphrase,
- 1.4 single sig Mk4 / Mk5 / Q with weak passphrase or small number of dice rolls
Phase 2 (Multisig via address/key reuse)
- Attacker scans their local UTXO set for multisigs with address reuse
- Searches redeem script / witness script for matches against indexed weak public keys
Likely theft order
- 2.1 multisig with threshold met by compromised Mk2 / Mk3 keys with address reuse
- 2.2 multisig with threshold met by compromised Mk2 / Mk3 / Mk4 / Mk5 / Q devices with address reuse
Phase 3 (Multisig via live mempool reaction)
- Attacker monitors the public mempool for spends involving known weak keys.
- Must react quickly (seconds to minutes) to construct and broadcast their replacment theft transaction.
Likely theft order
- 3.1 multisig with threshold met by compromised Mk2 / Mk3 / Mk4 / Mk5 / Q devices with public mempool RBF
So far I have only seen Phase 1 thefts.
Phase 1:
- July 30, ~01:10 UTC: The first wave of thefts from single sig Mk3 no passphrase wallets [1]
- Aug 1, 2026, ~ 05:44 UTC: A reported theft from a single sig Mk4 no passphrase wallets [2]
- Aug 2, 2026, ~04:00 UTC A reported theft from of a single sig Mk3 with a weak (2 word) passhrase. [3]
Phase 2:
- None reported AFAIK
Phase 3:
- None reported yet, possibly due to mitigation using slipstream [4] but also possible that attackers are focusing on prior phases.
WHAT TO DO NOW
Single Sig
If you have a single sig coldcard wallet which you are not absolutely sure used 100 dice rolls or has a very very long passphrase (e.g. 12 words) you need to migrate your funds ASAP. If you used the key teleport feature you need to migrate your funds ASAP. If you used the derive paper wallets feature you need to move those funds ASAP.
Multi Sig
If you have a multisig setup in which two devices were coldcards and you have spent from an address which holds funds you need to move them, this is urgent. However, for transactions spending from any addresses which have not been spent from previously you need to ensure your transaction is not broadcast publicly, currently the best way to do this is using mara's slipstream [4]
[1] mempool.space/tx/5abde335240…
[2] mempool.space/address/bc1qzm… from xitter.cf/TomerStrolight/status/…
[3] xitter.cf/BTCsessions/status/208…
[4] xitter.cf/OrangeSurfBTC/status/2…
[4] slipstream.mara.com
PSA to anyone with multisig where vulnerable seeds meet the threshold for spending. (Eg 2/3 multisig where 2 devices are default-setup coldcards)
DO NOT BROADCAST TO THE PUBLIC MEMPOOL
DO NOT MAKE A TEST SEND FROM YOUR MULTISIG WHEN MIGRATING YOUR WALLET (but DO make a test send from a different not-vulnerable wallet).
# Address Reuse
If you have previously spent from addresses which currently have a balance you need to move your funds ASAP - they are already vulnerable.
# No Address Reuse
If you have never reused addresses, you are vulnerable after broadcasting the transaction, before it confirms. While it’s in the public mempool it risks being replaced by an attacker.
# Private Broadcast
@MARAFoundation_ has opened up slipstream access, so that’s currently your best route to get these tx confirmed, without exposing them to the public mempool.
I’m monitoring and so far over 2500 BTC has been moved from 2/3 multisigs via slipstream.
# Current attack status
I am actively monitoring for multisig RBF battles which would suggest the attackers are primed to steal these funds, and fortunately so far I’m not seeing any evidence of it happening. That could be because nobody is broadcasting compromised tx, or more likely the attackers aren’t at that stage yet and are focused on the low hanging fruit of singlesig. That said, it’s only a matter of time. Take preparation now and prepare a transaction sweeping the funds to a setup with a very very high fee rate so you are ready to broadcast it when you need to.
Following the Coldcard vulnerability disclosure, we're already seeing an increase in phishing attempts.
Stay alert for scams ⚠️
• Never share your wallet backup, aka recovery seed (12/20/24 words)
• Only enter your wallet backup directly on your Trezor device during recovery
• Trezor will never contact you asking for your wallet backup
• Never follow wallet-migration instructions from unsolicited emails, messages or phone calls
Trezor devices are not affected by the Coldcard incident.
Wiz Learner retweeted
Replying to @Blockstream
@Blockstream @BlockstreamJade given the recent events do you plan to implement more character entry for passphrases on Jade. Just lowercase letters doesn't really cut it no more.
Wiz Learner retweeted
The Coldcard bug was not found by a hacker. It was found by someone reading code that had been public for years.
Insiders. Researchers. Anyone with time and motivation.
Closed source wallets are not safer from this. They are just harder to check - which means bugs live longer and hurt harder.
The scariest part of the Coldcard story: the code was open, and it STILL took years to find the bug. Imagine how long it takes with closed code.
Never closed. Never blind. Blockstream Jade is open source for a reason.
The more eyes, the faster the bugs die.
Coupon LOVEISBITCOIN.
Link:
⚡ Zap this if you self-custody:
Wiz Learner retweeted
BULL is immediately shifting our priorities to resume the ability of BULL wallet users send receive Bitcoin payments over Lightning, as well as move funds between Liquid and Bitcoin. We are evaluating multiple options and are beginning the work right now.
Ae have been in constant contact with our very good friends at Boltz for years. We have been, and are right now, collaborating closely with their team. They are my brothers in arms and I fully support their decision to suspend their service.
Let me be clear: Bull Bitcoin is a member of the Liquid federation and can convert LBTC to BTC without a 3rs party. No BULL wallet user will have funds "stuck" on Liquid, that I can guarantee.
Our immediate action plans are all targeting the same goal: BULL wallet users will carry on sending and receiving Lightning payments and perform swaps between Liquid and Bitcoin. The only question are implementation details. We will figure it out.
Until a solution is implemented, Lightning payments and Liquid <> Bitcoin swaps in the wallet will be fail without explanation.
I will not let this situation linger. I will fix it, no matter what it takes. I will be buying my grocies with Lightning over the BULL wallet as soon as possible.
I won't lie to you, the situation seems pretty bleak. First, the Coldcard exploit. Now, a critical piece of Lightning infrastructure goes offline. We are undoubtedly on the losing end of the Token War. Attackers have been scoring major victories.
We are going to fight back. We will never surrender. I apologize for not giving more details. I have work to do.
Update: Boltz will stay disabled until further notice.
Our API remains available to process refunds cooperatively. In any case, unilateral refunds will work, as they do not depend on our infrastructure.
Our support team stays reachable.
To be clear: this is not a response to a single incident. Over the past months we have seen a steady rise in automated, AI-assisted probing of our infrastructure, and we have dealt with several exploits. Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch. In the past few days alone we saw a drastic acceleration, and we do not believe this asymmetry will reverse. After reviewing the results of our own recent security scans, we cannot responsibly re-enable Boltz swaps, especially as we are being actively targeted by what appear to be multiple resourceful groups while we race to deploy fixes.
What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis. Do not expect swap services to resume shortly.
To be explicit: no user funds were ever at risk. Boltz is non-custodial by design. And as a fully bootstrapped company, the losses were ours alone.
We don't know yet how things will continue from here, but we'll keep you posted as soon as we have had the time to catch our breath and make a decision 🙏
Wiz Learner retweeted
The bug was seemingly written by Coinkite's Co-founder and CTO, Peter Gray @DocHex
Well after the attack was in full swing, he first reposted nunchuck, where it became clear that Mk4, Mk5 and Q were also affected, and that Coinkite had confirmed it.
Then, AFTER this, he reposts @TomerStrolight, saying it is not yet confirmed that MK4 entropy is breached.
Very interesting. Looks like strong possibility that `switck`, the account writing the buggy libngu library that caused all this, was actually Peter Gray (@DocHex), CTO of Coinkite.
This is the same guy that shrugged off my report of the possibility of the defect in May 2025.
Wiz Learner retweeted
Good Bitcoin security removes complexity.
It doesn’t create it.
We’ve spent the last decade helping people build resilient Bitcoin security designed to survive theft, mistakes and the unexpected.
For the next three months, we’ll help secure your Bitcoin free of charge.
No cost. No commitment.
Get secure first. Decide later.
thebitcoinadviser.com/contac…
🤖 Made with AI
Wiz Learner retweeted
Sometimes, trust your guts. Even when you are told it's FUD. Turns out I was right, and that instinct saved so many fucking people. 5 days later, I think I'm not needed anymore, thank you everyone who trusted me and spread the word so quickly.
I'll write a "post mortem" as I lived it, as I think it's probably going to stay as my most valuable contribution to Bitcoin. Good night people, I hope you are safe.
Wiz Learner retweeted
If you're moving your coins to a new setup, it's worth spreading them across signing device brands, so no single vendor can lose your coins for you.
Liana lets you combine several signing devices in one multisig wallet, with a timelocked recovery path if a key ever goes missing.
Lower risk of theft, lower risk of loss.
Full guide in the first reply ⬇️
Wiz Learner retweeted
Initial reflections on the Coldcard catastrophe, the bitcoin-only approach, and financial freedom:
1) Many people, me included, trusted and recommended Coldcard more than we should have. Especially after it became only source-viewable, and especially given the attitude of the Coldcard creator towards other similar projects. These were obviously red flags in retrospect. This was a huge lapse on my part and I pledge to learn from it
2) Coldcard operated for many years with shocking, betraying negligence that was hidden from the public by a) security theater driven by marketing (i.e. cypherpunks should use this sophisticated tool) and b) an “in circle” reputation and that people like me perpetuated. Another mistake that will stick with me, and guide my future actions
3) We will not be lectured by scammers and ETF promoters and former FTX cheerleaders. There are other Bitcoin-only products like Bitkey, Bitbox, Passport, and Seedsigner. Just because one Bitcoin hardware wallet company failed, doesn't mean the Bitcoin-only approach is bad. Far from it. It just means we need to learn and improve. It DOES NOT MEAN we need to "diversify" into random shitcoins, endorse or tolerate premines, give all our Bitcoin to corporations, or other such nonsense
4) FOSS should be the gold standard in general. And multi-vendor multi-sig or collaborative custody should be a goal for large amounts
5) Exchange hacks have been ~1,000x worse than even this disaster. The answer to challenges in self-custody is *not* to trust someone else with your money. It’s to learn and improve or upgrade your self-custody
6) Fiat currency must be defeated. Entire nations have lost 50% of their money overnight, 75% or even 99% in a matter of months or years. Accounts are regularly frozen and stolen every day. The global monetary system is immensely unjust and predatory and must be resisted. The mission must go on
7) AI makes bugs more exploitable, but it also can be used to secure codebases to an extraordinary degree. This is already happening (see Spiral's Loupe) and really shows the power of open weights. The lesson here is not that frontier AI should be gatekept by the elite, but that it should be open to all, so that we all have more eyes on everything
8) Financial freedom is not easy. And maybe never will be. The price of freedom is eternal vigilance. Self-custody is the pinnacle. Maybe not everyone reaches it, but we should strive to make it an option for anyone
9) I am sorry that HRF handed out Coldcards at two of our events over the past decade, and sorry that I mentioned Coldcards occasionally over the years as a good option. I am NOT sorry that HRF has a laser focus on self-custody and privacy. This approach is *the only option* for people under authoritarian societies. Maybe you want to choose to rely on the good graces of an American financial institution, but this option doesn't exist for billions of people worldwide
10) I am also proud that HRF over the past decade has handed out *many more units* of other devices such as Bitkeys and Seedsigners and Passports, and that we work to teach topics like privacy and multi-sig in our work. I am also proud that we have given out 100+ grants, invested more than $5M, and paid out more than a dozen bounties towards multi-sig, better self-custody, and privacy
11) I can’t say enough about how awesome Casa is and collaborative custody in general. I have heard good things about AnchorWatch and Unchained as well. I highly recommended the collaborative approach for non-profits. Liana is fully open source and superb for managing multi-sig. Casa and Liana have helped HRF sleep easy through the FTX crash, Silicon Valley banking system collapse, Coldcard catastrophe, and other crises
12) It is incredibly inspiring to see the Bitcoin community rally around helping people at a time of need. Many people have barely slept over the past four days as they have helped race to secure funds. It is truly awesome to see this
13) We are in a new age of "back to the basics" in thinking hard about self-custody. Bitcoin doesn't work as freedom money unless people can control it themselves. There is much work to do, but perhaps in 10 years we will look back at this crisis and see that the industry instead of giving up, evolved significantly as a result. Now is the time to make that dream a reality. Thankfully I am seeing a variety of Bitcoin companies and entrepreneurs ranging from Block to Bull iterate rapidly in that direction 🙏
The great hardware wallet hardening process is underway.
These events have hurt real people who lost their life savings, but it is not in vain. They are also forcing every self-custody wallet company to tighten systems, run deeper reviews and audits, and ask harder questions internally.
More AI systems are being reinforced and put to work on code checks and threat modelling in ways they never were before. Not only inside the companies, but also by independent researchers and the wider community as well.
You might not feel it right now, but self-custody is currently accelerating faster than any other part of this space. There is a light at the end of the tunnel.
Wiz Learner retweeted
The wildest thing about all this is that hardly anyone called out Coldcard’s sea of red flags, which are so obvious in hindsight: no FOSS license, no published independent audits, messy code, chaotic commit histories, and past criticism from security researchers over how the company handled vulnerability disclosures.
Somehow, most of the community was blinded by the halo effect. This was a security bug in the social layer.
You need to view everything Strategy are doing through the lens of getting into the S&P 500.
They are demonstrating complete optionality.
-Increased the USD reserve by $250M.
-Repurchased $81M of $STRC.
-Sold 1,638 Bitcoin to fund dividends and the repurchase.
This is a deliberate demonstration for S&P Global.
It shows they can access capital markets, monetise holdings and meet obligations in any environment, including a Bitcoin drawdown.
Every move addresses a box S&P asked them to tick back in October.
The wider context is everything.
Strategy increased its USD Reserve by $250M and repurchased $81M of $STRC. This increased USD Duration by 57 days to 2.3 years and tightened STRC’s BTC Credit by 5 bps. As of 8/2/26, we hold ₿842,138 in our BTC Reserve and $4.0B in our USD Reserve. $MSTR strategy.com/press/strategy-…
Wiz Learner retweeted
Update: Boltz will stay disabled until further notice.
Our API remains available to process refunds cooperatively. In any case, unilateral refunds will work, as they do not depend on our infrastructure.
Our support team stays reachable.
To be clear: this is not a response to a single incident. Over the past months we have seen a steady rise in automated, AI-assisted probing of our infrastructure, and we have dealt with several exploits. Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch. In the past few days alone we saw a drastic acceleration, and we do not believe this asymmetry will reverse. After reviewing the results of our own recent security scans, we cannot responsibly re-enable Boltz swaps, especially as we are being actively targeted by what appear to be multiple resourceful groups while we race to deploy fixes.
What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis. Do not expect swap services to resume shortly.
To be explicit: no user funds were ever at risk. Boltz is non-custodial by design. And as a fully bootstrapped company, the losses were ours alone.
We don't know yet how things will continue from here, but we'll keep you posted as soon as we have had the time to catch our breath and make a decision 🙏


































