TheFuzzStone

Spent 3 days and ~$300 on Kimi K3 to audit the code of my favorite crypto wallet: @nprofile…p96j (Android version).
Pleasantly surprised that I don't need to urgently move my funds to another wallet. 🤝🏻
Sent a responsible disclosure to the developers.

2026-08-03 12:10:06 UTC

Oj, that looks good.
#Linux #KDE
https://github.com/Alex-Bini/kwin-direktor

2026-08-03 11:40:44 UTC

- reply

OpenAI and Anthropic are just selfish bastards. They should save Coldcard users.

2026-08-03 11:19:28 UTC

The prize for the best delirium of the day goes to this gentleman.
https://blossom.primal.net/06caf3d8df11098592aff3c9d083fecefd45b62e08accf0feba25f4d70e4a247.png

2026-08-03 11:01:37 UTC

"Don't trust, verify" feels especially relevant in the modern world of LLMs.
It is cheaper to verify the code of the wallet you use yourself, than to lose money later.

2026-08-03 09:41:25 UTC

- reply

Yes, I understand, you can do some insane things, and they are clearly not for normies. :)

2026-08-03 02:12:02 UTC

He is partially right.
A cryptographic generator based on hardware noise provides more entropy, is faster, and is free from human errors like biased dice and/or uneven surfaces, etc.
The only scenario where manual entropy saves you is when the hardware RNG is compromised or weak (like the recent Coldcard incident).
In all other attacks firmware substitution, backdoors in the conversion code, side-channel leaks, or malicious signing logic - dice are useless because the device sees the final seed anyway.
To say "a passphrase is useless" is too categorical.
A written passphrase is not "just another seed", but a separate factor: it protects against the physical theft of a seed copy (an attacker with the seed phrase but without the passphrase will end up with an empty wallet) and allows for the use of decoy wallets.
Yes, it must be stored separately, and yes, human-generated passwords have low entropy.
But we have offline password managers like KeePassXC, so, "either memorize it or it's pointless" is a false dichotomy: nothing stops you from generating a decent passphrase using KeePassXC and storing it in a different location than the seed.
If someone says the problem is with the master password for KeePassXC itself, then I don't know what to say to people who can't come up with even one decent password of their head.
The idea of "multi-vendor multi-sig" sounds... interesting.
2-of-3 multisig:
key_1: hardware wallet from vendor A;
key_2: hardware wallet from vendor B;
key_3: either a third hardware wallet, a SeedSigner on an air-gapped device, or a paper backup;
What does this approach entail? -> You need to back up more things.
In addition to 3 seeds, you need to save the wallet descriptor (all three xpub keys, key order and derivation paths).
It is critical specifically when one key is lost. With all 3 seeds the coordinator will restore the wallet even without the descriptor, but with 2 seeds and no descriptor = it's impossible.
A copy of the descriptor is kept with each seed copy.
Its leakage does not steal money, but it does reveal all addresses and balances - it needs to be hidden just as carefully.
https://x.com/BitPaine/status/2084046152044007912

2026-08-02 19:10:48 UTC

Every Bitcoin wallet (especially hardware ones) now claims to be better than Coldcard and that everything is fine with them.
Start the timer until the next vulnerability.
In the current crypto community, the ratio of marketers to cypherpunks is clearly not in favor of the latter.

2026-08-02 18:11:04 UTC

You can support the 'KDE Connect' redesign using Monero.
https://invent.kde.org/network/kdeconnect-meta/-/work_items/29#note_1562091

2026-08-02 18:00:23 UTC

Has the use of passwords to offset mnemonic phrases become the standard in just 1 day?

2026-08-02 17:11:56 UTC

I'm amazed by the fact that some Bitcoiners still don't understand how to dump tainted BTC in 2026.
Oh, yes, fungibility... but perhaps I'll keep quiet on that.
https://blossom.primal.net/fa3044ed643b05abfbb13b2117624b999351bdfd9081c1ee3840526b1493c361.png

2026-08-02 15:05:14 UTC

- reply

1) Yes;
2) Games I didn't get to play because I grew up too early;
3) 😅

2026-08-02 14:59:43 UTC

The market for privacy-friendly laptops is screwed.
It's a choice between "sRGB 300 nits" or having Intel ME.

2026-08-02 13:17:23 UTC

Monero pump soon?
https://blossom.primal.net/efb0d10d169526794184a354fca85f0ef903beb8d0856f63f9724c8bdba80cd6.png

2026-08-01 18:06:23 UTC

For >10 years, hardware wallet manufacturers have marketed their products as "buy, send crypto to it, and forget about it."
And the naive believed them, bought the toys, sent their money to them, and... aren't keeping track of these trendy gadgets.
https://blossom.primal.net/d0e048d16cddeeec0bba2a061f87b41c571fff092478d8f6e346c87b26bd5815.png

2026-07-31 19:27:33 UTC

- reply

https://www.batimes.com.ar/news/argentina/milei-signs-decree-allowing-argentina-to-bar-or-expel-foreigners-over-hate-speech.phtml

2026-07-31 16:45:17 UTC

The circular crypto economy is taking place here: https://xmrbazaar.com

2026-07-31 14:03:42 UTC

If you don't check your code using a smart LLM, others will do it for you.

2026-07-31 09:19:07 UTC

Aged like fine wine.
#coinkite #coldcard
https://blossom.primal.net/d2c085a97a10fbb12d01a607cab81810dc5480d1b83cf340a339964f6aa7e432.png
https://blossom.primal.net/1046b4c4815b2c98bb304fc8fd00a5abbe611d73572eece45d590008e73c6bb6.png

2026-07-30 18:27:36 UTC

- reply

The price of having democracy.

2026-07-30 14:42:09 UTC

- reply

Thanks to this, 2 issues in Zeus will be fixed.
I didn't lose any funds, and had a nice chat with @nprofile…5k3w.
#nevent1q…wc4d

2026-07-29 21:17:15 UTC

- reply

Sounds gay.

2026-07-29 19:53:04 UTC

A lot of FOSS is, frankly, piece of shit with terrible UX/UI.
But many in the FOSS community won't admit it, simply because you're supposed to worship FOSS and say: "Well, at least it's FOSS".

2026-07-29 19:30:17 UTC

- reply

I'm fucking furious.
I just can't imagine how they could release such shitty software into production - software that handles users' money.
#nevent1q…36sm

2026-07-29 19:26:31 UTC

I just got a dose of great UX from Zeus.
I installed Duress Pin, and now, no matter what password I enter, I'm always redirected to the start screen. Great. 😒

2026-07-29 09:36:30 UTC

- reply

They were nerfing links.

2026-07-28 22:18:50 UTC

Oh, look, the "free speech" platform finally let you post links in your first post.
That's it, Nostr is no longer needed.
The goyim are satisfied.
https://image.nostr.build/ebea27c87d115c9e2a8dd0620aa85d50954f05644d9fd039ede0c5f6259d25f9.png

2026-07-28 16:00:18 UTC

I'm sick of the bullshit they feed American goyim about the fantastic quality of European "free" healthcare.
1) Europoors pay for it through taxes;
The & is often progressive based on your gross income;
2) Even if you have insurance, in countries like Germany, Sweden, or Norway, you’ll wait months for an appointment with the doctor you need; you’ll also have to... pay extra for some visits.
That’s right: you have insurance for which you’re already paying a % of your gross income in taxes, yet you still have to pay extra for certain procedures and wait months for an appointment, only for the doctor to tell you that you’re stressed and that you need to drink some mint tea and go for a walk in the woods.
If any of the Europoors want to tell me right now that "emergency aid in Europe will be provided for free," I would tell them to take a look at the statistics on waiting times by the hour in a hypothetical Lisbon.
The healthcare sector is a mess everywhere because the government is involved. Grow up (politically speaking) already.
https://blossom.primal.net/d09227fcd7b7f03b48d47099367255c859052140dac9062ce282f2afabeaa32a.png

2026-07-28 14:37:48 UTC

- reply

Yakihonne

2026-07-27 21:57:20 UTC

- reply

The same situation everywhere.

2026-07-27 16:20:16 UTC

- reply

I'll say it for the 123456th time - your "non-KYC" cryptocards should be used in "public restroom" mode.
If you need a card, it's best to buy a money mule card (traditional banking, nont fancy neobank) and use it in "public restroom" mode as well.
#nevent1q…pw64

2026-07-27 08:50:59 UTC

- reply

Oh, sounds super... revolutionary.

2026-07-26 14:40:10 UTC

Hey, Apple fanboys, tell me how safe your App Store is.
https://www.macrumors.com/2026/07/25/apple-app-store-fake-bitcoin-wallet-lawsuit/

2026-07-26 14:31:01 UTC

If you're vibing, vibe responsibly.

2026-07-26 13:03:42 UTC

- reply

> Если у тебя будет время, ты не мог бы помочь мне разобраться в текущей войне в биткоине с технической стороны?
Нет, сорри.
Почему? Потому что без меня разберутся. А если не разберутся - у меня всегда есть Монеро.

2026-07-25 22:24:47 UTC

Received my first donation for my mini-project.
I'll spend that sweet XMR to pay for the Kimi K3. 🙂
I have a 'Mudi 4g LTE', and I decided to tinker with it a bit. And it turns out, by chance, that someone else needed this too.
https://github.com/TheFuzzStone/blue-merle-fork

2026-07-25 18:12:48 UTC

- reply

https://www.androidauthority.com/grapheneos-duress-pin-us-prosecution-3691271/

2026-07-25 16:48:32 UTC

I can't remember the last time something was more addictive to me than playing with Kimi K3.
And so... due to the latest news about US border control and GrapheneOS (duress PIN)... an old thought surfaced in my mind that we still don't have good FOSS steganography tools...

2026-07-25 16:18:38 UTC

- reply

* this (https://x.com/thefuzzstone/status/2078115799735115808)
and...
much more: https://x.com/thefuzzstone/status/2078978639991890040

2026-07-25 16:13:01 UTC

Well, free Americans, how does it feel to live in the land of the free?
https://www.androidauthority.com/grapheneos-duress-pin-us-prosecution-3691271/

2026-07-25 16:03:59 UTC

- reply

Uninstalled 'Cake Wallet'. Tired of this wallet.

2026-07-25 12:03:40 UTC

- reply

Yakihonne (web + app) + Primal (web + app)

2026-07-25 07:31:27 UTC

- reply

Yep.
More people should read "Defending the Undefendable".

2026-07-25 07:29:29 UTC

- reply

Gm
https://blossom.primal.net/6e1203de76626438f15a6dd33301fc85dcfb7e4c0ba2587682506b93e98f4737.jpg
https://blossom.primal.net/d6c1b7701dc14664337832b5bfddb9daf8c4d3359f2fb5f1c878bb0ded45cac3.jpg

2026-07-24 19:49:25 UTC

- reply

Then, let the goyim enjoy that sexy democracy. Don't waste your time on the people who're lazy to install yet another app.

2026-07-24 19:48:18 UTC

- reply

Yes.
But for Cashu I prefer Cashu.me wallet.

2026-07-24 17:33:17 UTC

- reply

Zeus + Cashu.me

2026-07-24 16:55:21 UTC

I stopped using Spark in favor of a non-custodial LN (with an LSP) + a Cashu/ecash wallet.
Yeah, it's a workaround, but it works.

2026-07-24 14:59:29 UTC

- reply

yep

2026-07-24 13:05:40 UTC

- reply

For example, the fact that if you haven't opened your Monero wallet for a few days, you have to wait for it to sync with a remote node so that the wallet can scan the blockchain with your private-view-key to check if you've received any new transactions.
Or, the fact that if you don't manage your UTXOs, then after you pay for a purchase, you have to wait for 10 confirmations (~20 minutes) until your change is unlocked and you can send XMR again.
After I explain the advantages of Monero to normies (money that is private by default and cannot be blocked by anyone) and then tell them about the two points mentioned above, they usually say that the benefits outweigh these minor inconveniences.
In other words, my point is this... Everything depends on the person onboarding a newcomer to Monero, and with the right onboarding, even normies understand that these minor inconveniences are a tiny price to pay for censorship resistance and privacy by default.

2026-07-24 12:52:44 UTC

The things that even experienced Monero users usually complain about aren't something the normies I've onboarded to Monero complain about - after I told them about the benefits of XMR.

2026-07-24 12:33:07 UTC

There's no greater psychopath in the world than a politician or banker.
But still, there's a certain % of goyim who actually submit their own designs to "improve" fiat currency - which politicians will use to rob the Euro-goyim.
Yeah, there are some good memes.
https://blossom.primal.net/af3842d2226a384087b7b385f8d228c49255e87b1750f1ea078076e40734c41f.png

2026-07-23 22:53:09 UTC

#Claude
https://blossom.primal.net/4f3bf35caa3598ada7af12009aeb2c8def0d18d8b7584ef01e2b40f8b08976e3.png

2026-07-23 20:09:20 UTC

Who did this?
https://blossom.primal.net/86dcb34f92a20ca4c80dcf8afef65ee93145b68461e25f597f85945e2e4089b7.jpg

2026-07-23 20:00:44 UTC

Hellyeah!
#ArchLinux
https://www.collabora.com/news-and-blog/news-and-events/building-an-arch-linux-aarch64-port-for-holo-core.html

2026-07-23 18:53:43 UTC

- reply

I don't have one :).

2026-07-23 10:11:22 UTC

I have a few friends who urged me to support Codeberg financially. But I had "that" feeling that my values probably didn't align with Codeberg's.
And I'm glad I was right again.
https://blossom.primal.net/ba9c2c9351863d154ffcc43ea3cbcae4532bd921b2ded33d522b5370dcffaca3.png

2026-07-23 09:29:27 UTC

European gay-commies don't like crypto.
https://blossom.primal.net/e7a08fad81c4624e30d9fe1a7918b5910cb3edb11271a2f171209a12300a46ce.png

2026-07-22 19:08:18 UTC

- reply

Yes.

2026-07-22 19:07:03 UTC

- reply

I've done it.
I double-checked a few things manually to confirm the results I found using Kimi K3.
The report was sent to @nprofile…wh3a.
#nevent1q…y500

2026-07-22 15:01:25 UTC

- reply

I don't know if you have been outside your own country, or what you have seen, but there are places in this world where the state is weak and where it is easier to ignore it.
> That just translates to "I'm so smart that I just let them take everything they want and run away".
If you're one of those naive people who thinks you can protect yourself by voting and with the Constitution (lol)... Okay.

2026-07-22 14:27:08 UTC

- reply

> Or that you'll have a choice in 20 years?
There will always be a choice - for example, to stop being a patriotic cuck and leave Country X for Country Y, where there won't be such totalitarian control.

2026-07-22 12:52:32 UTC

- reply

I won't buy the modern piece of shit that is mistakenly called a car.
If goyim are stupid enough to buy this, I'm happy for them.
>>> Even if they did, they would likely not be legally allowed to drive it.
And here is the beautiful part, where goyim have to ask for permission to drive a 25-year-old, perfectly functional car instead of buying disposable crap.

2026-07-22 10:20:49 UTC

- reply

wow... that's cool

2026-07-22 08:54:14 UTC

I've been a GrapheneOS user ever since the Pixel 6.
And I'm surprised by people who are outraged that Volkswagen has blocked its app from running on GrapheneOS.
Why don't people “vote” with their actions?
For example, maybe you shouldn't buy modern crap - mistakenly called a car - that requires a proprietary app to track you?

2026-07-21 19:57:26 UTC

- reply

👊🏻
https://blossom.primal.net/eed7579c01c3c29bf320969e7a735e4393a5c46575e25dee48b5d1dd302b7501.png

2026-07-21 19:56:45 UTC

- reply

SteamOS

2026-07-21 19:14:17 UTC

The best Monero hardware wallet.
https://blossom.primal.net/dd97df35217f25b6b974329a20332e1b83b28d77461a09364dd7910568f4d376.jpg

2026-07-21 18:49:16 UTC

I had a terrible experience using Zeus (LND) in the past.
I decided to give it a second chance with LDK.

2026-07-21 18:09:22 UTC

Instead of wasting money on alcohol, drugs and prostitutes, it's better to spend it on open-source/open-weight LLM tokens.

2026-07-21 15:46:31 UTC

- reply

I'm not a fan of Signal...

2026-07-21 15:10:33 UTC

- reply

> What is better out of Zcash and Monero?
That XMR is used as digital cash to purchase goods and services:
- monerica.com
- XMRbazaar.com

2026-07-21 14:54:15 UTC

- reply

Cmon, make a new post

2026-07-21 14:49:46 UTC

- reply

that's the price of having democracy and civilized society

2026-07-21 12:53:25 UTC

Checking crypto wallets for vulnerabilities using Kimi K3 is a rather addictive activity...
I've gotten back into it...
This time, I decided to check nprofile1qqs0y3tvskgs9gpgxxu5ahgz3fmms3rzmxt504qceqtz4a6pdgfwlkghwl6j8 / Cashu[.]me

2026-07-21 09:38:02 UTC

- reply

Given the current capabilities (and the price) of Kimi K3, integrating automatic code verification into the development pipeline, so that no commit/release goes into production without being analyzed, is simply a must for critical applications (wallets, signers, etc).
#nevent1q…z6gh

2026-07-21 08:22:49 UTC

- reply

It's not there. Tell the dev to publish it.
https://blossom.primal.net/691ae5bcc9bf93792f6f1426646fc75681d009e38d09eda75fe9f0913e7fb449.png

2026-07-20 20:13:46 UTC

So, another day, and another audit of yet another open-source crypto wallet.
Once again, Kimi K3 found vulnerabilities and bugs.
And once again, I manually reproduced the vulnerabilities.
The cost? ~25 USD and about 8 hours of my time.
And once again, I'll make a responsible disclosure to the developers of this wallet.

2026-07-20 17:54:26 UTC

- reply

This audit took the whole day, but it was worth it. I'll put together a report and send it to the lead developer.

2026-07-20 12:28:24 UTC

I usually talk to LLMs as if they were a child, gradually interacting with them and introducing them to the code.
Then, once it's familiar with the project's code, I ask: How would the LLM advise me to conduct an audit? How many parts should I break the audit down into to better review the code, and to ensure it doesn't prioritize saving money or tokens, because accuracy is more important than money.
The LLM breaks the audit down into several parts for me. For example, right now I'm auditing Monfluo (a cool Monero wallet).
The LLM (Kimi K3) split the audit into 9 parts, and after it finishes Part_1, I then ask it to double-check the logic it documented in a separate file, and it re-examines what it found during the first check.
I also tell the LLM to create its own .md memory file, to refer to that memory file whenever it needs to document something (make changes), and to always refer to the memory file whenever it needs to recall something. This memory file is also useful across different sessions.
After completing the audit using the LLM, I manually verify the findings to double-check that the bug actually exists.
And yes, Kimi K3 is impressive.
https://blossom.primal.net/1a0fcce9f8e1631c7ae87880737d06c3b2cf02253c33bf0c75de33a6d4f8aae0.png

2026-07-20 11:33:24 UTC

I hope these are just temporary difficulties with Kimi and not censorship.
https://blossom.primal.net/25b5cb3fba3470ded2fa652865e9ed3622c4209c041cb112d3af7d82b433add3.png

2026-07-20 09:08:03 UTC

It's July 2026, and I'm still surprised by people who say that LMMs are bad and that all they do is cause hallucinations.

2026-07-19 20:51:56 UTC

Do you think that responsible disclosure of bugs and vulnerabilities applies to a project whose company hasn't even bothered to check its own code using an LLM?

2026-07-19 12:03:56 UTC

- reply

Good :).

2026-07-19 11:27:23 UTC

- reply

It's fixed in the repo, users didn't get the update. But, I don't care, because I don't use Cake Wallet.

2026-07-19 09:44:27 UTC

There are some things that no amount of marketing can overcome.
The wallet has a good goal - to be UX/UI-friendly. But a goal alone isn't enough.
#CakeWallet
https://blossom.primal.net/72960eca2423ea86fe840df777f4ca76cd83e43fb56cfe4bcefd296e186e0e56.png
https://blossom.primal.net/c8f20f1d5a2375e626135e676097cd4873543ae120d328c37b0798fc51e44bf9.png
https://blossom.primal.net/b7437bc2c0e7471d3e0d34f0ba3acd28fa35acac695f496503022302982b5a4a.png
Thread: https://xcancel.com/originalexbrou/status/2078562078780997903

2026-07-19 09:38:33 UTC

- reply

the best Monero mobile wallet

2026-07-17 22:35:09 UTC

- reply

💪🏻

2026-07-17 20:20:07 UTC

- reply

I uninstalled Cake.
My new friend: https://codeberg.org/Monfluo/monfluo-android

2026-07-17 20:06:52 UTC

For advanced Monero users only.
Fast AF.
Cool UX/UI.
Fast AF.
This wallet is simply fantastic.
https://codeberg.org/Monfluo/monfluo-android

2026-07-17 15:57:07 UTC

- reply

It's cool to have XMR as an option to pay for your services.

2026-07-17 14:44:59 UTC

- reply

No, I haven't. Thanks.

2026-07-17 14:44:10 UTC

- reply

Thank you for your reply :)

2026-07-17 13:18:26 UTC

Hey, @nprofile…etsy, is all ok?
https://blossom.primal.net/870b54291b6add31adc47ad4e65ec9993107ef95a372e08d02daab2ea3b92a90.png

2026-07-17 13:00:52 UTC

- reply

1) Monero One - for iOS only;
2) Monerujo - waiting for the new release of Monerujo_2; the old one has it's own bugs;
3) Stack Wallet - kinda works, but has issues;

2026-07-17 12:51:19 UTC

- reply

Oh, so I'm the one lacking critical thinking? Okay, bye.

2026-07-17 12:50:34 UTC

- reply

Because every government is a psychopath. That's why.

2026-07-17 12:00:10 UTC

I'm uninstalling Cake Wallet.
I'm tired of all the bugs in the wallet. And that was just the last straw - I couldn't send any XMR.
I restarted the app and cleared the cache (which usually helps), but this time even that didn't work.
I've been switching between different Monero nodes. Didn't work.
I’ll be restoring access to my funds through the Monero Feather Wallet. And that’s not what I planned to be doing this morning.
https://blossom.primal.net/37df93ab203d2f790b380edf1f065b6399a08f4beaec3325588a3a11f36066e0.png

2026-07-17 11:10:12 UTC

- reply

emphatise? are you fucking kidding me? They do it purely for the financial incentives, nothing more. nobody gives a shit about the war, money laundering and dead bodies.