Nunyabidness
Nunya Bidness

Large companies may be able to pay professional firms to perform deep audits every time something important changes.
Smaller companies and open-source projects do not and . . . 👇
https://www.bitcoinandshow.com/we-crossed-the-rubicon-coldcard-and-the-case-for-swarm-audits/

2026-08-03 20:28:16 UTC

https://image.nostr.build/596046ddcff8316e0128bcbcc56df082d7aea7204048450b56af6150df9f2656.jpg

2026-08-03 19:56:33 UTC

- reply

WTF is a downzap? Is that new?
I need to get back on SN

2026-08-03 19:38:03 UTC

- reply

I still do that.

2026-08-03 19:37:53 UTC

- reply

lol!

2026-08-03 19:30:51 UTC

- reply

The report I saw was mk 4 and a Q. I DO NOT KNOW if the report is correct but I’d assume it is just to be safe.

2026-08-03 19:19:34 UTC

Not Cold Enough | Bitcoin News
Episode 1364 of Bitcoin And . . . is LIVE!
Topics for today:
- Coldcard Wallet Sweeps Begin July 30
- Coldcard Firmware 4.x Reduced Seed Entropy
- Replacement Firmware Reportedly Bricks Devices
- Coldcard Phishing and Fake Wallet Audits
- Community Led Rescues
- AI Code Audits Set New Standard
https://fountain.fm/episode/PGTGDJiXF6rzMGskzuoz

2026-08-03 15:27:57 UTC

- reply

There are reports of the device getting bricked upon firmware update. I’ve seen 2 instances but I can’t verify that. I assume it’s true

2026-08-02 23:44:57 UTC

- reply

Now I have to read it

2026-08-02 23:13:06 UTC

- reply

“Kimi, go through all of NVK’s nostr posts and Coldcard’s git hub repository and collate to find the most hilariously ironic matchups.”

2026-08-02 22:12:05 UTC

Coldcard only! This is for Coldcards only!
Simple passphrases on top of the shitty entropy now getting savaged.
https://blossom.ditto.pub/4570f5b58d1055dcea3cb78c05e47b486442e58af86b8b61bb620d70ce25b39d.png

2026-08-02 20:55:04 UTC

- reply

Wow! Now that is ironic.

2026-08-02 18:23:43 UTC

- reply

On other platforms?

2026-08-02 18:18:44 UTC

- reply

Probably not but it might have something to do with it.

2026-08-02 18:16:49 UTC

- reply

I guess bad people only hack good people. Good people don’t hack anything because they’re good people.

2026-08-02 18:14:47 UTC

- reply

🔥

2026-08-02 18:10:46 UTC

- reply

That too and a whole host of others. I mean, why tf hack municipal water systems? Dude . . . hack Blackrock.

2026-08-02 18:07:13 UTC

Coldcard MK 666
#note1z62…g0ae

2026-08-02 18:05:15 UTC

I just wonder why a shit ton of people don’t use these tools to destroy the IRS.

2026-08-02 17:56:19 UTC

Ask grok to review the code for entropy creation and give it th GitHub repository address. If you don’t know the address (URL) then just tell it to find the repository and audit the repository
#note1zgs…0z0g

2026-08-02 17:44:16 UTC

👇
#note1rxc…y8g6

2026-08-02 17:34:05 UTC

- reply

That last one . . . OMG

2026-08-02 17:09:33 UTC

- reply

God! That would be hilarious.

2026-08-02 16:37:12 UTC

- reply

https://blossom.ditto.pub/07e6ecc70f3b30356584bc4f10e16969660d1bc9fb39b7694a41b76ce6993abd.jpeg

2026-08-02 16:36:14 UTC

Coinkite is done.
https://blossom.ditto.pub/07e6ecc70f3b30356584bc4f10e16969660d1bc9fb39b7694a41b76ce6993abd.jpeg

2026-08-02 16:25:39 UTC

Another way of understanding what just happened is Caesar crossing the Rubicon.
He crossed the Rubicon River with his army and went to Rome to essentially take over the Roman Empire through force. We call it "Crossing the Rubicon" because once he crossed there was no turning back; Caesar was committed and everything changed.
The world changed.
Coldcard was AI's Rubicon moment. Not just for Bitcoin . . . for everything. From now on, if you are not using tools like Kimi for ongoing, continuous code review, circuit review, business practices and SOP creation etc. you will not survive. This goes far beyond bitcoin. Banks, colleges, governments, war machines, businesses of any size making anything or providing any service are now forever at risk.
Some will think this is terrible, Some will not. Those who do want to operate under the legacy lies that we've been told for centuries. Those who do not will feel a sense of questioning rise from within: What is wealth?
People laugh at the Amish and Quakers etc. for being backwards and unsophisticated yet they are almost entirely unaffected by modern complications. They believe wealth is something more primal, more connected to the land. Wealth is measured in head of cattle, family size and health, land, soil, neighborly relationships, tools, skills, and craftsmanship.
There is no going back to the world that was for me. I have been thinking along these lines for a long time now. This just crystalized everything. Pensions, 401Ks, bank accounts, "get rich or die tryin'" mentalities, corporate ladder climbs, expensive restaurants, wearable symbols of fiat wealth. No. All that shit is over.
As far as Bitcoin is concerned, I'm not fucking leaving.
Bitcoin, beans, bibles, bovines, bullets, land, love, and family.
#nevent1q…mj2v

2026-08-02 15:55:06 UTC

"Token War"
You can read this as a form of "regulatory moating"
Only projects with enough cash on hand now and future revenue of a certain size will survive.
"I lost my company in a moating accident."
https://blossom.ditto.pub/508943533c736842688d442c294257473d891d6cc234f0da32db4c3a29766d87.png

2026-08-02 15:15:08 UTC

- reply

Chicken and dumplings is one of my favorites

2026-08-02 05:12:23 UTC

- reply

I did. I used it until yesterday and thought it was great.

2026-08-02 04:17:58 UTC

👀
#note1ylu…t9yz

2026-08-02 01:01:30 UTC

From Scott Marmoll.
(He's just one dude on twitter so don't take it as gospel)
https://blossom.ditto.pub/6b31c3263baed94574203b706c70b76c6da68349089bb5e9a865829f239465f7.jpeg

2026-08-01 23:41:36 UTC

- reply

Not you. You’re fine.

2026-08-01 23:13:25 UTC

“What you believe isn’t true”
“Prove it”
“Not my job”
The fall back position of the intellectually disabled.

2026-08-01 23:10:24 UTC

- reply

Then fuck off.

2026-08-01 22:58:33 UTC

- reply

Prove God doesn’t exist.

2026-08-01 22:13:19 UTC

Something feels very wrong and not just the shooting below. I mean everything feels wrong and has (to me) for a long time. Now it feels like something is starting to surface.
The last two times I talked with my sister we talked about a war in Heaven spilling over to Earth. Many people she knows have said this to her. I know. It sounds loopy af but the more I think about it them more I'm looking at it.
It's the only thing that explains how I feel about the weird torrent of bad macro shit going on. Hopefully, none of what I just said is true and I'm just ready for the psych ward and a bathtub of Thorazine.
https://blossom.ditto.pub/8abcc785c4255ee281f4de20606944619cb63f1e16628741bc2f521f572c2103.png

2026-08-01 21:57:41 UTC

- reply

I shouldn’t be surprised but I was.

2026-08-01 21:43:39 UTC

Swan just sent an email reminding customers who were auto-withdrawing to coldcard addresses to change that to a different addy generated with a HWW from a competent company.
This holds true for any company you have auto-withdrawal set up with.
Go change that now.
https://blossom.ditto.pub/e9fc0a13e527f8ef72a0d339d7837939c0992cb5a18e66a1882b657f7dc235b6.png

2026-08-01 15:54:40 UTC

Be aware.
🚨 🚨 !!DO NOT throw your coldcard away!! 🚨 🚨
https://blossom.ditto.pub/5755382ffac7af2da9039069c645699bc2303dc2fa46ef8d5a5d8d16e07db951.png

2026-08-01 15:26:19 UTC

- reply

Not that I trust Grok's assessment which is why I'm putting it here for humans to view.

2026-08-01 15:25:25 UTC

I didn't expect Grok to find the repository for BitBox and actually to the thing but it did. It one shotted the report.
https://blossom.ditto.pub/950f7fc9e3e7334e0f0e0e1ede66ebf59a256ae658c30e7e9dde039ec8441eb6.png
https://blossom.ditto.pub/4f80b3e026c986d168a512e75af71fcb06dd5626395e7de6a1b21398edc92ad2.png

2026-08-01 05:35:53 UTC

- reply

The retort was hilarious though.

2026-08-01 02:14:05 UTC

Moving to Tennessee to vote for this guy.
#note1kxa…xy5g

2026-08-01 02:05:44 UTC

- reply

Glad I saw your note so I could follow again.

2026-08-01 02:04:29 UTC

- reply

I rather like this idea.

2026-08-01 02:02:52 UTC

https://blossom.ditto.pub/0ad291c5fbe721c1fcc7b949a97adf6ee6bc07adb62b066d7668057b4b05ed5d.png

2026-07-31 21:46:36 UTC

My "Become a Hermit" meter just ticked past 99.0%.
https://24242.io/fc6589df460bec7fbf81874240701ae962e9a29fc10d5bd1ce5145674aa473f8.jpg

2026-07-31 21:28:58 UTC

https://blossom.ditto.pub/6c8c4a0ec61f036d459ddbe56719334b90b9a721e71d861920abeb7052351b72.png

2026-07-31 21:28:16 UTC

- reply

I'm so sorry, Gigi. She raised a fine person.

2026-07-31 19:06:12 UTC

Instead of Greenland, Trump should consider annexing Japan.
#nevent1q…95ng

2026-07-31 18:42:51 UTC

- reply

It’s an emotional moment.

2026-07-31 18:23:51 UTC

- reply

Fuck! I loved ColdCards but no product from Coinkite can be trusted now. Multi-sig is my future. Probably have to store coins at @npub1xke…d0en to stash them so I can build one out of a couple or three HWWs.
Didn't want to spend the weekend doing this bullshit.

2026-07-31 18:19:52 UTC

I will never recommend a Coinkite product to anyone ever again.
#nevent1q…ynlj

2026-07-31 18:18:50 UTC

- reply

Yeah, at this point, reading the extent to which Coinkite was owned I wouldn't trust the Blockclock. It is true that the Opendimes generate entropy differently than the other products but the more I look at this thing the more convinced I am that Coinkite is simply unsafe.

2026-07-31 18:16:23 UTC

- reply

I don't even know what to think about Coinkite as a company anymore. I really liked my ColdCard and was convinced Novak was the most paranoid person on the planet about security. I don't think that company survives this.
As of last night I don't use ColdCards and will never recommend them to anyone ever again.
Nothing about this is right. Lives were destroyed and all Novak did was essentially say, "I'm sorry".

2026-07-31 16:24:56 UTC

- reply

Fug!

2026-07-31 16:23:35 UTC

- reply

And I didn’t find out about the ColdCard issue until after I published the episode. Like you said, it’s not helping.

2026-07-31 15:32:12 UTC

The question I have is WTF is going on in Morocco that is so bad that these people bailed en masse?
I suspect NOTHING at all is going on in Morocco that needs escaping from.
#note180v…zn25

2026-07-31 15:19:58 UTC

- reply

Wallet companies getting savaged on X for even mentioning their products right now.

2026-07-31 15:18:19 UTC

Good morning.
The struggle continues.

2026-07-31 13:46:24 UTC

- reply

BitBox.
Remember that this whole issue is about ColdCard not generating enough entropy after a certain firmware update.
I’ll be building a multi-sig wallet after all this which has an order of magnitude more security.

2026-07-31 13:39:36 UTC

- reply

I didn’t realize you were on nostr. Good to see you here, Frank.

2026-07-31 06:37:44 UTC

- reply

☹️

2026-07-31 06:07:20 UTC

My bitcoin was on a ColdCard Mk3.
Yes, I completely shit my pants.
None of my bitcoin was gone.
Turns out I never updated the firmware when I got my CC and generated the seed with version 3.0.something.
I migrated everything to another hardware wallet anyway.
I’m tired, boss.

2026-07-31 05:34:41 UTC

- reply

People don’t use fitted sheets?
Fuggin’ troglodytes.

2026-07-31 05:18:50 UTC

- reply

Nice! You were Circle P today.

2026-07-31 04:46:42 UTC

Why does it happen?
Because it happens
#note126x…avnd

2026-07-31 04:28:23 UTC

- reply

That’s impressive!

2026-07-31 04:25:19 UTC

- reply

Is that Diablo?

2026-07-31 04:23:44 UTC

- reply

We’re going to be pulling this whole thing apart for awhile.

2026-07-31 04:09:04 UTC

Fuuuuugggggggg . . .
#note1ec9…gue9

2026-07-31 02:19:08 UTC

Anymore coldcard hacks since the initial one this morning?

2026-07-31 00:06:40 UTC

COLDCARD
It seems clear that ColdCard Mk3 hardware wallets with firmware version 4.0.1 and ALL later firmware versions of the Mk3 are compromised.
It is advisable to CALMLY and CAREFULLY move your bitcoin to another wallet address that was NOT generated by a Mk3.
If you have a Mk3 with and earlier firmware version it is still advisable to move your funds to a fresh wallet generated by dice rolls etc.
Read the update from COLDCARD here -> https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

2026-07-30 21:21:09 UTC

- reply

I laughed pretty hard so, thank you.

2026-07-30 21:19:46 UTC

https://blossom.ditto.pub/c47148817495fa8ba56be66fa46a3016d9ff0963ca020d66c4e1c7c7f40923c4.jpeg

2026-07-30 20:29:03 UTC

- reply

WTF?

2026-07-30 20:18:30 UTC

Gives me plausible reason to disregard ANY future communication from IRS about digital assets.
#note16qt…mmyh

2026-07-30 15:03:38 UTC

- reply