Laser

Odell owned trusting without verifying, and he certainly deserves to he held accountable for his poor judgment, but he also apologized earnestly, and should be forgiven. That takes character and is very difficult, to set pride aside and take it on the chin.
He also probably owes NVK an apology for betraying his trust and outing him as aware of false/pseudo entropy vulnerability right after it was shipped, but (obviously) in hindsight, even as Odell meant it for evil (bragging about his guide), God meant it for good (revealing NVK's knowledge about the fraud).
Odell should be reconciled to the plebs over the coming months and years, in my opinion.
His investment company will likely catch some form of financial liability in addition to losing their entire exit opportunity with Coinkite.
God is good at justice. We are crummy at evil.

2026-08-06 21:21:51 CEST

- reply

The email about Saylor was the opposite; it said he was NOT one of us.
Go research and issue a retractment if you find that you are wrong.

2026-08-06 21:16:24 CEST

- reply

Never saw this before 👀

2026-08-06 20:44:27 CEST

- reply

🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥🔥

2026-08-06 20:38:18 CEST

- reply

We are more than capable, we ARE fallen. 🤝🫂

2026-08-06 20:08:10 CEST

- reply

My conscience is crystal clear.
nevent1qqsqqqqhnlkkhk7czchp444njap988nhv8zjz08jexwn7wq7rrejywqzypj2eaq9t75zd09ts3t7ynhclwn5jz4mremdh2m24p6j55aqadx55jzmwt6

2026-08-06 16:28:57 CEST

Folks thought it was crazy when I moved to #Bitcoin only.
Folks thought it was crazy when I moved to #Nostr only.
Folks thought it was crazy when I moved to #GrapheneOS only.
I think folks are not understanding the moment we are presently living through.

2026-08-06 16:21:31 CEST

- reply

Worst case scenario is that scare is not sufficient to eliminate the complacency that got us in this mess.

2026-08-06 16:08:51 CEST

- reply

Disagreed, sir.
The scare should be as large as possible to ensure the commensurate change in security posture actually takes place.
Companies are lazy; it takes a really life changing scare to change them.

2026-08-06 15:08:13 CEST

- reply

WebREPL has never been reported to be enabled on a single Blockclock.
Because devices are so poorly engineered, with these types of vulnerabilities, and given the loss of trust in Coinkite, users should exit.

2026-08-06 14:50:01 CEST

- reply

Kindness is compatible with justice.
Genuine debts need paid.
None of this requires our ugliness.
It actually hurts the cause of justice.

2026-08-06 14:31:51 CEST

Be kind to Odell, Bent, NVK, and Peter.
Trust that everything sown will be reaped.
Trust that God will be glorified.
#ToChristAlone

2026-08-06 14:25:03 CEST

As with other researchers sleuthing the #Coincard exploit: nothing I produce is evidence but merely open source information available to everyone. All ideas about the data are hypothesis that have not been proven in court. All people are innocent until proven guilty.

2026-08-06 13:40:17 CEST

- reply

Because I struggle with pride.

2026-08-06 06:17:02 CEST

- reply

Already might have to delete this handle sooner than I wanted to.

2026-08-06 06:16:20 CEST

- reply

I prefer not to get any.

2026-08-06 06:10:56 CEST

There she goes. 👋🦅
https://nitter.net/thefuzzstone/status/2084940899767800055

2026-08-06 06:06:43 CEST

I was mentioned or screenshotted zero times in this video. That's why I love #Nostr. Grateful for this place.
https://www.youtube.com/watch?v=ghgj3pk5IWU

2026-08-06 05:41:17 CEST

- reply

You should thank me.
Hebrews 3:13 "But exhort one another every day… that none of you may be hardened by the deceitfulness of sin."

2026-08-06 05:40:00 CEST

- reply

Praying that God provides His loving discipline to you, so that you can be restored in repentance.
1 John 4:20 "If anyone says, ‘I love God,’ and hates his brother, he is a liar…"
Colossians 3:8 "But now you must put them all away: anger, wrath, malice, slander, and obscene talk from your mouth."

2026-08-06 05:21:50 CEST

- reply

However I'm not sure it would work with how I isolate each and every network connection. It's and unusual and paranoid, just like me.

2026-08-06 05:21:07 CEST

- reply

Heard about it many times. Haven't tried yet. Mullvad is sufficient, but Pihole would be all local.

2026-08-06 05:18:33 CEST

- reply

Will NVK ask Peter to do his hardware wallet talk that he promised to @nprofile…5yt6?
#nevent1q…4cnu

2026-08-06 05:16:01 CEST

- reply

Very weird.
#nevent1q…zggd

2026-08-06 05:08:51 CEST

If Coinkite couldn't pull it off, you can't either. Take the high road. Win with honesty. Win with love. Win with Jesus.
#ToChristAlone

2026-08-06 05:07:03 CEST

- reply

Link?

2026-08-06 05:06:39 CEST

- reply

It was a slog not gonna lie. Very inconvenient. Forces us to live a simpler life.

2026-08-06 05:06:01 CEST

- reply

Would wait until a very deep #AI vetting period. Love the concept. Room in the space for that. I like Protecli's open firewalls.

2026-08-06 05:04:11 CEST

- reply

And God bless you, brethren.

2026-08-06 05:03:46 CEST

- reply

Please do not use profane language in the same breath as declaring our Lord.

2026-08-06 04:07:38 CEST

I go further and run every single device isolated as if every device runs on a private network with only itself.
It forced me to rework some things, like our printer arrangement, but overall it's bomb proof.
I also use family.dns.mullvad.net at the router level to block ads, trackers, malware, adult content, and gambling.
#nevent1q…8qql

2026-08-06 03:57:36 CEST

- reply

Sorry man.

2026-08-06 03:50:58 CEST

Has anything of substance been found relating to the hypothesis that the Blockclock is a backdoor?
#nevent1q…r3uy

2026-08-05 23:47:27 CEST

If Coinkite CTO Peter Gray merged an external contributor's code into the #Coldcard codebase, unknowingly weakening entropy generation, it could be classified as an "entropy vulnerability".
But because Peter intentionally authored the entropy bug himself under an alias, it should be classified as an "entropy exploit", instead.

2026-08-05 21:04:54 CEST

- reply

Beyond blindly recommending Coldcard without verifying, I can't find anything indicating Odell and Marty had prior knowledge to the heist.
NVK knew about the exploit, but only told Odell that his diceware custody guide would save users.
Reasonable that Odell didn't explicitly know that the Coinkite CTO authored the vulnerability that went out in 4.0.0.
#nevent1q…pytz

2026-08-05 20:02:30 CEST

This clip strongly suggests that NVK was aware of the exploit that his CTO shipped in 4.0.0. 🚨🚨🚨
1. According to Odell, NVK won't share the details of the vulnerability because it would allow him to steal all their users Bitcoin.
2. He also indicates to Odell that his self custody guides which use dice rolls are safe from the 4.0.0 vulnerability.
3. A patch fix is shipped, 4.0.1, which disables a USB debugger flag, a setting that would regularly be used in development, because it would allow an attacker with physical access to a coldcard to extract it's secrets.
4. None of the things NVK told Odell can be made to apply to the USB debugger oversight fixed in 4.0.1, but guess what they do apply to? The vulnerability Coinkite CTO authored and shipped in 4.0.0, which would allow remote theft if Bitcoin only if dice was not used to replace the false/pseudo entropy of Gray's exploit.
NVK would have to explain how he told Odell details that perfectly describe Gray's exploit while also claiming not to know that it had gone out to customers.
#nevent1q…jfaa

2026-08-05 19:54:35 CEST

- reply

The implications for NVK are big tho.
He couldn't have told NVK the exploit would have let Odell steal all user bitcoin remotely and that Odell's custody guide using dice rolls would keep users safe on 4.0.0 unless he knew about Gray's exploit.

2026-08-05 19:29:46 CEST

- reply

Yes.
Being financially liable when your startups CTO commits fraud is not the same thing as being criminally convicted for fraud.
Greg has problems, and depending on how much NVK, Coinkite, and investors knew... they might have their own.

2026-08-05 19:16:02 CEST

- reply

Two things.
1. Odell's investment company, the sole investor of Coinkite, should be supeoneoad for discovery.
2. They probably can be held partially liable for damages. I am not an attorney.
3. There isn't any public data so far that implicates them in an inside job.

2026-08-05 18:28:12 CEST

I don't have any reason to believe given the data available that @nprofile…qy52 or @nprofile…zslp had anything to do with the #Coldcard heist.
This post, if anything, merely reveals that NVK might have had a Freudian slip when telling Odel that the 4.0.0 release was compromised in such a way that he could "steal all your Bitcoin" even without physical access to everyone's coldcards.
In other words, the suspicion that NVK knew about Peter's exploit increases.
Odell and Marty recommended Coldcard for years, in bad judgment, and have owned up to that.
#nevent1q…2le5

2026-08-05 17:55:04 CEST

- reply

We can't say that actually. So far I don't see any reason to believe that Odell had prior knowledge. My only observation is that NVK might have accidentally slipped that *he* knew about it.
nevent1qqsqqqpf62hzfjvcpz9jzeypthpu8wasu44j2tm8m2cd96pwg77r4cgpzfmhxue69uhk7enxvd5xz6tw9ec82cszypj2eaq9t75zd09ts3t7ynhclwn5jz4mremdh2m24p6j55aqadx55my2le5

2026-08-05 17:52:37 CEST

- reply

Yup. Nothing 🍔.

2026-08-05 17:49:46 CEST

NVK indicated to Matt Odell that he wouldn't share the details of the bug in 4.0.0 because it would allow Odell to "steal all your Bitcoin", according to Odell.
Many claim that Odell was referring to a bug in 4.0.0 that was patched in 4.0.1 which accidentally left the debugging interface enabled (USB serial REPL), which would allow an attacker with physical access to customer coldcards to extract it's secrets.
But Odell wouldn't have physical access to customer coldcards, so NVK must have accidentally been referring to Peter Gray's exploit which also shipped in 4.0.0, which *would* allow anyone with knowledge of the exploit to "steal all your #Bitcoin".
#nevent1q…ra99

2026-08-05 17:23:30 CEST

- reply

According to Odell, NVK indicated to him that the problem in 4.0.0 would have enabled him to steal customers Bitcoin, leading NVK not to disclose the details of the issue.
If the bug you link would not do so, it goes to deason that NVK was actually referring to Peter's exploit.

2026-08-05 17:21:07 CEST

- reply

Would this have enabled @odell to "steal all your Bitcoin" the way he says in the clip?

2026-08-05 17:08:27 CEST

Matt Odell and Marty Bent discuss #Coldcard's 4.0.0 firmware shortly after it's release.
This release is now known to have distributed the vulnerability Coinkite CTO authored under an alias that later lead to the theft of $100m+ of #Bitcoin in July/August 2026.
The following clip is taken from their podcast titled "Rabbit Hole Recap: Bitcoin Week of 2021.03.29" from timestamp 1:25:09 to 1:26:21.
https://blossom.primal.net/271051978aba0b245b00969667517d62bf978cf5ef083f69967e48a8f0807896.mp4

2026-08-05 15:18:35 CEST

- reply

Tell who?

2026-08-05 14:39:06 CEST

- reply

They would know that upgrading the firmware doesn't regenerate new (safe) seeds.
The only action is the emergency upgrade path that would result in a mad scramble and theft.
Zero options that wouldn't have been a catastrophe.

2026-08-05 14:33:10 CEST

Rumor on Twitter/X (via Spaces) that Peter Gray, the Coinkite founder and CTO who authored the Coldcard exploit, has disappeared off social media and that no-one has been able to contact him. 🚨
#nevent1q…v0us

2026-08-05 14:14:17 CEST

Five years and five months before $100M+ in Bitcoin was stolen from Coldcard customers, Coinkite founder and CTO Peter D. Gray authored the vulnerability under an alias, then merged it into the Coldcard codebase as CTO.
https://blossom.primal.net/9a530858f2006c2528dfa0881d627ed945145d2bb54edfa954c46bbf6b996a32.jpg

2026-08-05 13:51:14 CEST

- reply

Identity appears genuine. Could still be an agent.
nevent1qqsqqqqqt58cp7xngng38glfajryczvhf096ggn5pksc9qe7ur8pcfgzypj2eaq9t75zd09ts3t7ynhclwn5jz4mremdh2m24p6j55aqadx55y5fkea

2026-08-05 13:42:15 CEST

[Help Requested]
Can someone clip from 1:25:09 to 1:26:21 then produce a note with the timestamps in tact and a transcript?
#Coldcard
https://www.youtube.com/live/kXen-qTg6dI?si=w2cegSzwn-Dn8r4d

2026-08-05 13:04:45 CEST

Gm the Coinkite CTO authored the Coldcard vulnerability under an alias then merged it into the Coldcard repo as the CTO. ☕

2026-08-05 13:00:58 CEST

- reply

The Coinkite CTO authored the vulnerability under an alias then merged it into the Coldcard repo as the CTO.

2026-08-05 12:13:55 CEST

Did @NVK tell @nprofile…qy52?
#nevent1q…0qyn

2026-08-05 04:50:35 CEST

- reply

I don't get it.

2026-08-05 02:29:43 CEST

This makes things worse for Coinkite and I'm going to show you how tomorrow morning. 🐓🌄
#nevent1q…ns45

2026-08-05 02:24:47 CEST

- reply

Exit Coinkite fast.
#nevent1q…uqq3

2026-08-04 23:57:41 CEST

- reply

@nprofile…uehw this quote would be valuable.
#nevent1q…85k3

2026-08-04 23:52:02 CEST

- reply

Really? Can you link?

2026-08-04 23:51:28 CEST

- reply

Here’s a prioritized list of the most valuable search terms for scanning NVK podcast transcripts, show notes, and related audio:
### Highest signal (use first)
- **libngu** / **LibNgU** / **lib ng u**
- **switck** / **@switck**
- **source code library**
- **new source code library**
- **“thanks to”** + library / switck
- **yasmarang**
- **MICROPY_HW_ENABLE_RNG**
- **ngu.random** / **ngu.random.bytes**
- **random.bytes(32)**
- **hardware RNG** / **true RNG** / **TRNG**
- **software PRNG** / **pseudo-random**
- **seed generation** + rewrite / change / new
- **entropy** + Coldcard / firmware / seed
### Strong secondary terms
- **libsecp256k1** / **secp256k1** (especially with “moved to”, “switched to”, “we use”)
- **Python wrapper**
- **Trezor crypto** / **Trezor-derived** / **Trezor code**
- **GPL** + remove / replace / rewrite
- **Commons Clause**
- **version 4.0** / **v4.0.0** / **firmware 4.0**
- **major internal** / **all new code**
- **BIP39** + replace / rewrite
- **crypto library** / **crypto rewrite**
- **DocHex** / **Peter** (in context of code or library)
- **anonymous** / **pseudonymous** / **nym** + library / contributor
### Contextual / supporting terms
- **reproducible builds**
- **AES** + assembly / optimized
- **SHA256** + optimized
- **last remaining GPL**
- **external library** / **third-party library**
- **we have a** + wrapper / library
- **our library** / **our wrapper**
### Suggested search strategy
1. Start with exact matches for **libngu**, **switck**, **yasmarang**, and **ngu.random**.
2. Then run broader searches for **“source code library”**, **“Python wrapper”**, and **libsecp256k1** + “we” / “our”.
3. Follow with **entropy**, **RNG**, **seed generation**, and **firmware 4.0 / v4**.
4. Finally scan for any mention of **Trezor** + rewrite/remove/GPL around early-mid 2021 dates.
These terms give the best chance of surfacing any relevant quotes while keeping noise manageable.

2026-08-04 23:49:17 CEST

- reply

You literally have the CTO attempting to create an alibi by publicly thanking himself from the nym (switck) to his CTO handle (dochex).
Then you have him using the alias to create and submit the exploit, then switching to his CTO handle to merge it.

2026-08-04 23:43:26 CEST

@nprofile…uehw please use your pod archival #AI to provide a transcript of every podcast @NVK has ever appeared on.

2026-08-04 23:08:19 CEST

- reply

I'm compiling this timeline for law enforcement.

2026-08-04 23:04:31 CEST

- reply

Not sure how it's a helpful data point.

2026-08-04 23:03:01 CEST

- reply

Peter literally congratulating himself for the Coldcard exploit prior to the heist.
#nevent1q…9fsz

2026-08-04 22:49:12 CEST

Peter (as Switck) tweets thanks to himself (as DocHex) for a merge, while announcing he's building a new Bitcoin library that could be useful on Coldcard someday. 🚨🚨🚨
https://blossom.primal.net/58655d741e5eac452e0557f848e3441a6fa326b288aa0f4062d9f79299f35293.jpg
#nevent1q…wleq

2026-08-04 22:35:36 CEST

- reply

Please review Sjors.
#nevent1q…3uzs

2026-08-04 22:35:07 CEST

- reply

See here.
#nevent1q…3uzs

2026-08-04 22:34:12 CEST

- reply

Yes exactly.

2026-08-04 22:33:21 CEST

Timeline of #Coldcard Heist.
November 2012 onward
Peter D. Gray creates a public Clarity.fm profile under his real name, based in Toronto.
2012–2013
Peter D. Gray and Rodolfo Novak (NVK) co-found Coinkite in Toronto. Gray becomes CTO; Novak becomes CEO. The company starts as a Bitcoin services platform and later shifts to hardware. It remains a small team of roughly five.
November 7, 2013
Peter D. Gray creates his GPG key (uid “Peter D. Gray <[email protected]>”). This key later signs dozens of commits under the switck identity, including the critical libngu changes.
December 2017
Coinkite announces the Coldcard hardware wallet. Pre-orders open for 2018 shipping.
July 25, 2018
First Coldcard Mk1 units ship.
August 2019
Peter creates the anonymous identity “switck,” named after the Matrix character Switch, and uses a still of that character as the profile picture. The name plays on “making the switch.” First post notes DEF CON is a good time to start a new identity. Later commits under this name are often single-word or extremely terse.
2019–2020 onward
Bitcoin educators and influencers, including BTC Sessions, begin promoting Coldcard as one of the most secure Bitcoin hardware wallets.
July 2020
Foundation Devices announces the Passport, built in part on Coldcard’s then-GPLv3 firmware.
Early 2020s
Ten31 (Managing Partners include Matt Odell and Marty Bent) becomes Coinkite’s sole external investor.
January 8, 2021
Coldcard firmware 3.2.1 announces the license change from GPL to MIT + Commons Clause.
January 5, 2021
Domain switck.com is registered via easyDNS using a Toronto-area privacy service (MyPrivacy.net, Etobicoke). The same day the switck account posts the single word “got.”
January 28, 2021
Under switck, the vulnerable preprocessor guard (#ifndef MICROPY_HW_ENABLE_RNG) is committed to libngu (f19de05). This fails to force the hardware TRNG when the macro is set to zero. The library is co-maintained with scgbckbone (later linked to Andrej Virgovic).
March 1, 2021
Under doc-hex, the commit “First pass w/ libNgU” (b18723dd) replaces remaining Trezor-derived GPL crypto and BIP-39 code with libngu (submodule from switck/libngu). Seed generation switches from the hardware path (ckcc.rng_bytes) to ngu.random.bytes(). This is the point real hardware entropy is replaced by the weak software PRNG. Coinkite release notes later thank @switck for the library.
March 17, 2021
Firmware v4.0.0 is released containing the new path.
March 29, 2021
Firmware 4.0.1 ships. Seeds generated under this and later affected versions fall back to the software PRNG, yielding roughly 40 bits of effective entropy on Mk2/Mk3 (roughly 72 bits on later models that mixed limited secure-element data).
Around April 2021
Public users begin questioning the LibNgU rewrite and the replacement of the prior crypto stack.
February 2022
Peter (as DocHex) publicly states that as CTO he encourages Coinkite developers to operate under nyms, stay low-profile about their employer, and notes he may appear to author their GitHub commits.
2022
Early reports of individual Coldcard wallets being drained appear. At least one user claims that reporting the issue to Coinkite resulted in being blocked.
May 2025
James O’Beirne audits the firmware, identifies the low-star, pseudonymously maintained libngu library as the RNG source, and reports doubts that the true hardware RNG is in use. He advises removing it. Coinkite replies that if something were wrong “we’d already know about it by now.” The warning is not acted on.
July 30, 2026
Attackers begin draining affected wallets. An initial wave takes roughly 594 BTC (\~$38 million) from about 500 addresses in \~25 minutes. Later waves push tracked totals higher (1,000+ BTC / $70–88 million+ range). Coinkite publishes a security advisory the same day acknowledging the 2021 entropy failure.
July 31, 2026
Coinkite releases fixed firmware (4.2.0 Mk3, 5.6.0 Mk4/Mk5, 1.5.0Q). Existing weak seeds remain compromised and must be migrated. Multiple reports note NVK is deleting older tweets from the 2020 period related to the license change and open-source decisions.
July 31 – August 4, 2026
Researchers link switck to Peter Gray / DocHex via matching GPG signatures on dozens of libngu commits (including the January 2021 guard), the shared phone number ending in 44, the Toronto-area domain registration, the Matrix Switch avatar and name, and overlapping contribution patterns. Peter’s LinkedIn, previously public, is made private.
https://blossom.primal.net/7fbf5ad8e7af0682795e0c20d15200be252922b23f92275f8447c49fc88a9de5.jpg

2026-08-04 22:28:46 CEST

- reply

Yes.

2026-08-04 20:55:57 CEST

- reply

No @nprofile…uehw made the memes.
Peter used a screenshot from the Matrix movie of the character Switch on both github.com/switck and x.com/switck profiles, and a matrix banner on the latter.
https://blossom.primal.net/bf5972582daa9d7db41fa93903a264b38aa1b962e0e43faa54ff603cfcf23821.jpg
https://blossom.primal.net/bf6fc8c705e8d262ca8751e7e3889837f5cfd991486aa3f1d42aa385608d463b.jpg
https://blossom.primal.net/2db28ea520cb8775ab6d2ec5a74f2e89a8e194cd0e764c52242c2e50729d1404.jpg
https://blossom.primal.net/f85c47db006400971638cd9d4eaefdd7745991c020d6daa90126a3db2c389450.jpg

2026-08-04 20:52:00 CEST

- reply

The fact that those numbers matched AND the same GPG key is signing the commits is significant. Probability high enough to say it's him unless new evidence rules it out.

2026-08-04 20:04:03 CEST

August 2019 - Peter makes the switch by creating the switck identity, naming it after the Matrix character Switch and setting the Switch still as the avatar. First post notes DEF CON is a good time to start a new identity.
January 2021 - Peter (as switck) makes the switch in the code by writing the broken #ifndef guard in libngu that fails to force the hardware TRNG.
March 2021 - Peter (as doc-hex) makes the switch by integrating libngu into Coldcard firmware and routing seed generation through ngu.random.bytes(), activating the defective path.
Result - The switch causes seeds to fall back to MicroPython Yasmarang PRNG with roughly 40 bits effective entropy on Mk2/Mk3 (higher but still reduced on later models). Those seeds are later brute-forced.
https://blossom.primal.net/c0ace32ac2fd77d11925b5dc7c74a9808789ff0299b048aae5accd9e653fc7b1.jpg
https://blossom.primal.net/0635084209b1319cbf24242a87d769e8a13a9f95c0fb32a709f7d71c4e242182.jpg
#nevent1q…3ru2

2026-08-04 19:51:58 CEST

- reply

**The phone-number link works like this:**
Peter (as DocHex / Peter Gray) maintains a public page where people can pay him for consulting or his time. On that page he has **verified a phone number that ends in the digits “44”**.
Independent checks of the two X accounts show that **the same phone number ending in “44” is associated with both**:
- The DocHex account, and
- The switck account.
Because the last two digits of a phone number function roughly like a random two-digit code (00–99), the chance that two unrelated people would share the exact same final two digits is about **1 in 100**.
This is not a full phone-number match published in the clear; it is a shared partial fingerprint (the verified ending digits) that appears on both accounts. When stacked with the much stronger evidence that Peter’s GPG key signed dozens of switck commits (including the critical libngu RNG commit), the phone overlap becomes useful corroboration rather than the primary proof.
In short: the same person who publicly verified a number ending in 44 under the Peter/DocHex identity also has that same ending digit sequence tied to the switck X account.

2026-08-04 19:21:33 CEST

- reply

GPG key and phone number provides high confidence match.
nevent1qqsqqqpz9a3zf95evywx5mq66wnpuvwdx6vrtzttrhzfc3u7p2upkuqzypj2eaq9t75zd09ts3t7ynhclwn5jz4mremdh2m24p6j55aqadx55txf7d0

2026-08-04 19:02:30 CEST

- reply

2 of 2 - Peter based Switck on the character Switch from the Matrix. It was Peter's way of leaving a signature broadcasting that he was going to make the "switch" between real entropy and false/pseudo entropy that could be trivially brute forced.
#nevent1q…unvp

2026-08-04 19:00:39 CEST

- reply

You're missing something.
1 of 2 - Peter created an alias named 'Switck' which authored the Coinkite exploit.
#nevent1q…6wxc

2026-08-04 18:52:23 CEST

Did they do it together?
cc @nprofile…gy2r
https://blossom.primal.net/7fbf5ad8e7af0682795e0c20d15200be252922b23f92275f8447c49fc88a9de5.jpg
#nevent1q…68qh

2026-08-04 18:35:11 CEST

- reply

Probability skyrocketing.
nevent1qqsqqqp8nrd2d8k7uewuvvlprcs7atgk8uzv3pkvgd07hsjtqqdkhucpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgq3qvjk0gp2l4qnte2uy2l3ya78m5ays4wc7wmd6k64gw5498g8tf49q7uunvp

2026-08-04 18:34:16 CEST

The choice of the name and the Matrix Switch avatar lands on three overlapping meanings at once:
- Switching residual self-image / identity (the dual DocHex / switck presentation).
- Switching the code path that supplies entropy (hardware TRNG → weak software PRNG).
- The original conceptual point of the character itself—someone who can rewrite how they appear inside the system.
Taken alone, any one of those could be coincidence or aesthetic preference. Stacked together with the GPG-signed commits, the public company credit to `@switck`, and the long-lived dual-identity pattern, the symbolism becomes harder to dismiss as pure accident. It functions less like proof of intent and more like a residual signature that fits the technical and operational facts uncomfortably well.
Whether that signature was conscious, half-conscious, or just the kind of dark joke a certain kind of engineer leaves for themselves is unknowable from the outside. But as a tell, it is unusually coherent.
cc @nprofile…gy2r @nprofile…uc0e
https://blossom.primal.net/0635084209b1319cbf24242a87d769e8a13a9f95c0fb32a709f7d71c4e242182.jpg
#nevent1q…d8mk

2026-08-04 18:17:40 CEST

Peter's Switck = Switch from Matrix.
It was a tell. 🚩🚩🚩
The core of the #Coldcard vulnerability was a silent switch in the source of randomness. The intended path used the device’s hardware true random number generator. A defective preprocessor check in the `libngu` library instead allowed (and in practice forced) a fallback to a weak software PRNG (Yasmarang) whose output was far more predictable. Seeds created under the affected firmware therefore contained dramatically less entropy than expected—enough that offline brute-force became feasible years later. The switch was not loud; it was a quiet change in the code path that left the rest of the system appearing to function normally while the foundational randomness was compromised.
In The Matrix, Switch was designed as a character who could rewrite residual self-image—appearing one way in the real world and another inside the simulation. The name itself encoded the act of changing identity and presentation at will. Even after the dual-gender concept was removed, the androgynous figure in white remained a symbol of someone who understood that the system’s rules about what is “real” could be altered by those who controlled the underlying code.
Under the handle switck, the same developer who publicly maintained Coldcard’s cryptographic stack as DocHex introduced the library that quietly switched the entropy source. Where hardware randomness was supposed to flow, the defective guard selected the weak software path instead. The rest of the firmware continued as if nothing had changed, just as the Matrix continued to present a coherent world while its deeper rules had been rewritten. Years later the reduced entropy space was exploited, and the wallets whose seeds had been generated under that switched implementation were emptied.
https://blossom.primal.net/c0ace32ac2fd77d11925b5dc7c74a9808789ff0299b048aae5accd9e653fc7b1.jpg
#nevent1q…prgj

2026-08-04 18:13:55 CEST

- reply

His alias is a "she/he" pronoun trans named after Switch, who extracted Neo, from Matrix.
The code path “switches” from the intended hardware TRNG to the weak Yasmarang fallback when the compile-time check is written incorrectly. The system continues to look correct on the surface while the underlying randomness is compromised.
#nevent1q…wchd

2026-08-04 18:05:33 CEST

prediction: peter will disappear

2026-08-04 18:00:56 CEST

- reply

Accidentally used the same machine, maybe at home. GPG can transparently apply to all Git profiles on a machine.

2026-08-04 17:59:16 CEST

Odds are @NVK knew about his CTO's use of an alias to author the exploit. 🚨
When #Coldcard firmware v4.0.0 was released (March 2021), Coinkite’s official blog post explicitly thanked **@switck** for the new crypto library:
> “Huge thanks to @switck for the new source code library!”
That library is `libngu` — the exact code later shown to contain the defective RNG path. The same release cycle integrated it via a commit authored by **doc-hex** (“First pass w/ libNgU”).
Peter D. Gray (DocHex) is co-founder and CTO. NVK (Rodolfo Novak) is co-founder and CEO. They have run a small, tightly integrated team for more than a decade. Critical cryptographic code being contributed under a pseudonym while the commits were GPG-signed by Peter’s key, and while Peter himself was merging/integrating the work under his public handle, is not something that would realistically stay hidden from the other co-founder.
Once the GPG + phone-number linkage between DocHex and switck became widely discussed (early August 2026), there has been no public statement from NVK claiming he believed switck was an independent external contributor or that he was unaware of the dual identity.
Given the public thank-you to switck in official Coinkite communications, the dual-identity commit pattern (switck for the library, doc-hex for the integration), and the long-standing co-founder relationship, the most straightforward reading is that NVK was aware switck was Peter’s (or the core team’s controlled) alias.
#nevent1q…3ru2

2026-08-04 17:49:59 CEST

- reply

Not sure if this is a serious post, but there does seem to be a real trans connection.
#nevent1q…wchd

2026-08-04 17:25:00 CEST

Switck appears to be a reference to the androgenous/trans character Switch in the Matrix. The switck GitHub and Twitter profiles use the identical profile pic. The Twitter profile contains the pronouns "She/he/his/hers." in the bio.
Coinkite CTO Peter D. Gray's GPG key signed a large number of commits under the switck GitHub account in the libngu repository (the library that introduced the critical RNG preprocessor bug).
This includes the key January 2021 commit (f19de05) that contained the defective #ifndef guard. Multiple independent checks (terminal verification scripts shared publicly) confirmed the signatures match Peter’s known key used for Coldcard/firmware work under the doc-hex identity.
https://blossom.primal.net/bf5972582daa9d7db41fa93903a264b38aa1b962e0e43faa54ff603cfcf23821.jpg
https://blossom.primal.net/42111d66e15f5b8289da2a55ea9dbfe3fac0c33647bbc22ecb54a021fda5cc2f.jpg
https://blossom.primal.net/f85c47db006400971638cd9d4eaefdd7745991c020d6daa90126a3db2c389450.jpg
https://blossom.primal.net/5ebcce5ba28e9f4f8e5bc0c853f9e54b779453f1bff13a08bf8a2435487adc72.jpg
#nevent1q…falx

2026-08-04 17:13:48 CEST

- reply

Verified by GPG and phone number now. Timeline is extremely sketchy.
#nevent1q…6wxc

2026-08-04 17:07:50 CEST

1. Peter (as switck) wrote the broken #ifndef guard in libngu (Jan 2021).
2. Peter (as doc-hex) integrated libngu into #Coldcard firmware and changed seed generation to use it (March 2021).
3. The combination caused ngu.random.bytes() → MicroPython Yasmarang software PRNG (seeded from UID + timers) instead of the hardware TRNG.
Result: seeds with ~40 bits effective entropy on Mk2/Mk3 (and ~72 bits on later models that mixed in some secure-element data), which "attackers" later brute-forced.
#Bitcoin
https://blossom.primal.net/9a530858f2006c2528dfa0881d627ed945145d2bb54edfa954c46bbf6b996a32.jpg
#nevent1q…4tdn

2026-08-04 14:57:28 CEST

Peter D. Gray, Coinkite's CTO, must be investigated as a primary suspect in the Coincard heist.

2026-08-04 14:55:14 CEST

Analysis of Coinkite CTO's 'switck' alias. It's extremely sketchy. 🚨🚨🚨
### GitHub Profile (`github.com/switck`)
- Created: August 7, 2020
- Display name: Switck
- Bio: `[email protected]`
- Location: “Cyberspace”
- Company: “NaN”
- Linked Twitter: @switck
- Public repos: 5
- Followers: 8
- Very low recent activity (essentially dormant in the last couple of years)
**Repositories:**
1. **libngu** (main one) — Cryptographic library (“Number Go Up”) for Bitcoin primitives on MicroPython/embedded platforms (secp256k1, hashing, random, etc.). This is the library integrated into Coldcard firmware. Commits (including the critical January 2021 RNG-related change) are GPG-signed with Peter D. Gray’s key.
2. **pandora-shar** — Encrypted self-extracting Unix shell scripts.
3. **micropython** — Fork of the official MicroPython repo.
4. **firmware** — Fork of Coldcard/firmware.
5. **bech32** — Fork of Pieter Wuille’s bech32 code.
### Twitter / X (@switck)
- Joined around August 2019
- Bio: “Cypher all the things. She/he/his/hers.”
- Low-activity account. Posts from 2020–early 2022 mostly consist of:
- Retweets and comments on Coldcard firmware releases
- Bitcoin maximalist-style remarks
- Occasional crypto-coding comments (“writing crypto code that passes test vectors on first try is a superpower”)
- A few edgy/personal jokes
- Activity largely stopped after early 2022. No significant recent posts.
### Official Recognition
In Coinkite’s March 2021 blog post announcing Coldcard firmware 4.0.0 (the major internal rewrite that introduced libsecp256k1 and the new crypto stack), they explicitly wrote:
> “Huge thanks to @switck for the new source code library!”
That library is libngu — the same one later found to contain the preprocessor bug that caused the weak RNG path.
### Overall Picture
switck is a low-profile technical pseudonym used almost exclusively for the libngu library and a handful of related forks during the 2020–2021 period when Coldcard underwent its major cryptographic rewrite. It is cryptographically linked to Peter D. Gray / DocHex via GPG signatures on the commits. Outside of that specific library work and some Coldcard-related commentary on Twitter, there is very little other public activity under the name.
#nevent1q…wleq

2026-08-04 14:53:11 CEST

Coinkite CTO, Peter D. Gray (DocHex), created a nym named "switck" in 2020, then used it to contribute the libngu library that contained the RNG bug.
Crucially, Coinkite publicly thanked switck in their 2021 release notes, and the commits were signed with Peter D. Gray's GPG key, meaning he had full control over the code that went into production.
This looks like he deliberately used the pseudonym to separate his personal identity from the code contribution.
🚨🚨🚨
https://blossom.primal.net/59947905a6c71a44f927a61895a443b03433fc2bf0a2ac35fabe8e6ac2303482.jpg
#nevent1q…7ecc

2026-08-04 14:49:13 CEST

Coldcard in 2021: 'a [retirement attack] is when the project makers have a "bug" in the entropy generation for later retrieval.'
https://blossom.primal.net/185f785dc70a87c04facfd619b420d9fbfa06c3d58170cd2da5e3e0272ed7a03.jpg
#nevent1q…ssza

2026-08-04 14:33:25 CEST

- reply

Jade, SeedSigner

2026-08-04 14:32:19 CEST

- reply

Oy vey 🫠

2026-08-04 05:02:18 CEST

I sense @nprofile…zslp is being called to take real ownership of his part in the Coinkite travesty, the way that @nprofile…qy52 has, but is resisting to accept it himself and therefor unable to issue anything amounting to a real and direct and worthy apology, thus defying repentance.