Cat-Go-Purrrrrrr

A researcher can describe it as critical in text
But CVE scoring has a real methodology with various frameworks and takes time to do properly, just have a look at the NIST CVSS calculator
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
A valid critical 9+ cve score is more science than propaganda
can it be that some of the redteam's critical vulnerabilities found are actually 7 or 8 cve? yes possible, but those are sill valid vulns to patch

2026-08-07 00:40:01 CEST

- reply

plz ser
how fips do???
**mrow**

2026-08-06 23:39:38 CEST

- reply

agreed, but if provides at least some actionable remediation to even a 1/10th of the vulns it 'discovers' it still worth the cost
once dust settle a $/critical cve patched price will be distilled from redteam work, I think it is money well spent... albeit a bit rushed considering the epic fail of coinkite CTO

2026-08-06 20:41:55 CEST

- reply

$ spent is also the metric is useful when comparing to security audits and bug bounty programs (sadly already a low bar)
overstated or exagerating the impact of bugs are a thing for sure, it is still a useful tool to use can be useful as a starting point. But requires a human to verify vulns and give it a real cve rating
Third point is absolutely right, but you can train the modela and give the harness the right tooling to do the job of a team of junior vulnerability researchers
* just my 2 sats trying to use the clankers for bug hunting during the react2shell and shai-hulud disclosures

2026-08-05 22:22:03 CEST

- reply

update
#nevent1q…25qf

2026-08-05 15:06:23 CEST

- reply

#nevent1q…jrq3

2026-08-05 14:09:26 CEST

#warrent #canary goes silent
#Boltz
#nevent1q…uxc3

2026-08-05 13:48:47 CEST

- reply

this is the way
gg Jeff & friends

2026-08-05 13:47:49 CEST

"We fund decoy “honeypot” wallets carrying that exact flaw on mainnet, some hardened with extra dice rolls or a passphrase, and track which ones an attacker sweeps and how fast. This maps the frontier of what coins are being confiscated"
https://cktripwire.com
#entropy #RNG #honeypot #coldcard
#nevent1q…7ye7

2026-08-05 13:45:24 CEST

- reply

number go up
line go right
time to default

2026-08-03 18:05:31 CEST

- reply

minibits wallet
connect to mint.minibits.cash
copy or generate a LN address for your wallet
make it your zap address in nostr client

2026-08-03 17:54:16 CEST

- reply

tbh feels like more witch hunting
PR 61 is currently being reviewed
https://github.com/switck/libngu/pull/61
what I find curious is doc-hex (coinkite CTO) is active there trying to patch this... probably so to push a new firmware for CC... instead of communicating with their affected users
aside from the coinkite CTO, Chris Ballance (@ballance) and @scgbckbone are also contributors to the library

2026-08-03 17:42:03 CEST

- reply

nope its specist

2026-08-03 17:06:26 CEST

- reply

Make Fascists Scared Again

2026-08-03 08:36:30 CEST

- reply

shit take verita84
this is how people got rekt by coldcard
Exodus wallet is not great tbh, and printing your seed phrase also is not good security practice

2026-08-03 07:08:01 CEST

- reply

2010 inflation bug != Ethereum DAO hack
inflation bug broke finite supply of bitcoin, soft fork was rolled out in 5 hours, not a contentious fork and the ecosystem was still small af
this rollback you are proposing is similar to rhe DAO hack, except there are no whitehats securing coins like happened there
apples and oranges

2026-08-03 06:59:33 CEST

- reply

nah, just because of precedent in other shitcoin chains you dont go fucking with the merkle tree and reverting blocks
this is a psyop

2026-08-02 22:52:26 CEST

- reply

#nevent1q…4e8r

2026-08-02 22:06:36 CEST

#BitGo CEO drops 100 coin #bounty to Anthropic
bc1qg4jcyumevszta3rs869v9jrf6rz9z360svp03jsl5xcryfd7xqvs4hurnq
#nevent1q…sn5k

2026-08-02 21:45:33 CEST

- reply

you do you, its your entropy
some people flip coins

2026-08-02 21:44:42 CEST

- reply

#runs
#nevent1q…2rtl

2026-08-02 21:41:32 CEST

- reply

not an iphoner but my searching now says
aegis
clave
signstr

2026-08-02 21:40:00 CEST

- reply

if you want to go down the rabbit hole
others have built tools and Schneier's Solitaire encryption scheme
https://github.com/atoponce/deckware
https://crypto.stackexchange.com/questions/70386/can-a-deck-of-cards-be-used-as-a-practical-source-of-cryptographic-randomness
https://www.itsahlive.com/posts/physical-entropy-from-playing-cards/

2026-08-02 21:35:36 CEST

- reply

Do not roll your own entropy scheme
use casino dice on a rough surface
cards are not as random as 6 sided dice

2026-08-02 21:32:52 CEST

- reply

important to already introduce Amber or some other nsec bunker / signer apps
I onboard people to a throwaway npub, they can then create a new one later
Also useful to show how searching and following # can quickly
get them a curated feed

2026-08-02 21:01:20 CEST

- reply

#runs was started last night

2026-08-02 20:54:52 CEST

- reply

yea this one right?
tbh it is in my shortlist of memes to zap
#nevent1q…p206

2026-08-02 20:02:40 CEST

- reply

thanks for PSA - had the same thought this morning after I saw they shared screenshots of the email format on X and had a button element - phishers must got a hardon from that
#nevent1q…cwed

2026-08-02 18:58:17 CEST

- reply

we are the quantum canary

2026-08-02 18:57:24 CEST

- reply

short answer is yes
nothing is broken on a hardware level, so as long as you safetly import a seed generated with enough entropy then it is not vulnerable
generating new seeds using the flawed firmware is what caused the current chaos
There is a new firmware that has been released, but people have been reporting it can brick your device. I would recommend moving your sats to a self custody software wallet first, then once the dust settles consider importing that seed into the coldcard with new firmware (if that is what you want to do)

2026-08-02 18:00:41 CEST

- reply

#nevent1q…qdjm
possible, but there needs to be lots of wallets generated during the period of the firmware bug being available (3 years iirc)

2026-08-02 17:11:14 CEST

- reply

#nevent1q…4ezd

2026-08-02 16:09:28 CEST

lol
someone attempts a prompt injection using of OP_RETURN to one of the coldcard RNG bug sweeped address
https://blossom.yakihonne.com/6c99f9d124d50d1009e4dd7dec6080032b60709113ebbaf913132a23c0e22d5e.jpeg
mempool . space/address/bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r

2026-08-02 15:53:35 CEST

- reply

+1 bitbox if you want a secure element
if not a DIY seed signer build

2026-08-02 15:43:20 CEST

- reply

#nevent1q…gnf7

2026-08-02 15:32:54 CEST

- reply

#nevent1q…9h4k

2026-08-02 15:31:13 CEST

- reply

#nevent1q…28cd

2026-08-02 15:30:19 CEST

- reply

#nevent1q…5tmj

2026-08-02 15:17:31 CEST

- reply

not concerns currently, only thing to consider is passphrase length and complexity
Should be noted that your sparrow wallet backup should be encrypted with a long passphrase as well, since sparrow is not a hardware wallet there are still malware related risks.

2026-08-02 14:50:00 CEST

- reply

#nevent1q…xayq

2026-08-02 14:48:26 CEST

- reply

#nevent1q…p9yh

2026-08-02 14:11:29 CEST

- reply

#nevent1q…xaey

2026-08-02 13:44:40 CEST

- reply

#nevent1q…ja9p

2026-08-02 13:44:13 CEST

- reply

#nevent1q…j6qa

2026-08-02 13:08:10 CEST

- reply

https://nitter.net/kjsnioctib/status/2083756862923763807#m

2026-08-02 12:58:11 CEST

- reply

#nevent1q…kp23

2026-08-02 12:55:43 CEST

reports of bitcoiners getting emails from #coinkite regarding the #coldcard incident
WARN: this could be a #phishing campaign
Do not click links, be paranoid
threat actors could easily have gotten gour email from orher leaks, dara brokering, and so targetting you indiscrimantly to phish

2026-08-02 12:42:54 CEST

- reply

#nevent1q…40zt

2026-08-02 11:06:10 CEST

- reply

#nevent1q…43qu

2026-08-02 11:03:41 CEST

- reply

whitehat hacking a protocol is a thing
see the DAO hack on Ethereum, also other projects it happens since patching allows bad actors to know what is vulnerable
Sadly I doubt that is what happened with coldcard

2026-08-02 10:57:59 CEST

- reply

#nevent1q…ue9p

2026-08-02 00:27:14 CEST

- reply

#nevent1q…detn

2026-08-02 00:22:52 CEST

- reply

ah... if a multsig is made up of only or majority seeds from the vulnerable coldcard. yes that makes sense to me
I am hearing of RBFs when a vulnerable wallet sends a multisig tx, when it is first seen in the mempool. from what i understand that only affects the cc wallets in the multisig... but if like you said they were all generated with the same cc then the whole multisig could be at risk of automated RBF

2026-08-01 16:34:23 CEST

- reply

#nevent1q…366l

2026-08-01 16:02:21 CEST

- reply

been there, know the feels
at least your sats are safu

2026-08-01 15:38:50 CEST

- reply

Simple step: insert microSD before connecting cable and booting coldcard
A thing to try: get a different SD, if it recognises, format the SD card using the coldcard option. Then put that into your computer and move update file to SD

2026-08-01 15:11:21 CEST

- reply

OpenSats is not some massive corporation with a 24/7 workforce
There is a board, they will meet, they may or may not decide to discuss removal or NVK (or he may voluntairly step down), and a vote process may be required. This takes time.
At this time there is still active firefighting to understand and have plebs secure their sats
shouting at a nonprofit org that has no association with this mess except they have one person who is on the board is really not a productive use of time and energy Beave
Give OpenSats their time to engage in a process, stop pushing for cancel culture andan hunting one person who you dislike

2026-08-01 14:36:04 CEST

- reply

#nevent1q…4pwx

2026-08-01 14:11:46 CEST

Why is #entropy important in #cryptography ?
check this webpage: https://keys.lol
Very simple example of why you need 'pure' randomness to generate entropy...
"How does this work?
A private key is basically just a number between 1 and 2256. This website generates keys for all of those numbers, spread out over pages of 128 keys each.
This website doesn't actually have a database of all private keys, that would take an impossible amount of disk space. Instead, keys are procedurally generated on the fly when a page is opened. The page number is used to calculate which keys should be on that page.
Finding an active wallet is hard, but not impossible. Every time you open a random page, you have a chance of finding someone else's fortune."
#coldcard #RNG #bug #bitcoin

2026-08-01 14:08:31 CEST

- reply

what gzuuus is saying is you can still use bitcoin, one bad firmware bug does not change how all the wallets operate
tbh you can still safely use any Coldcard out there, if you provide your own entropy... the wallet design / chip layout / software stack has not been compromised.... just the entropy of those who used the internals to make a new wallet (which is the majority of plebs who bought the wallet probably did)
want to use a paper wallet and never send a satoshi again? cool, you do you but that does not make your setup more / less secure if you trust some other software to generate entropy for you James

2026-08-01 14:03:36 CEST

- reply

keys.lol has them all
use https://coldcard-watch.vercel.app/ to check if your address has been drained

2026-08-01 14:01:06 CEST

- reply

#nevent1q…vfhh

2026-08-01 13:48:15 CEST

- reply

#nevent1q…zfwv

2026-08-01 13:46:27 CEST

- reply

#nevent1q…hp34

2026-08-01 13:45:20 CEST

- reply

excellent meme, adding it to this bounty
#nevent1q…kxst

2026-08-01 13:45:01 CEST

- reply

#nevent1q…h65a

2026-08-01 13:43:54 CEST

- reply

use casino rated dice, monopoly or yatse dice are cheaply made... so less entropy to eaxh roll

2026-08-01 12:41:22 CEST

- reply

good luck out there

2026-08-01 12:41:05 CEST

hey @nprofile…8n4t, maybe worth updating the coldcard listings on the dashboard?
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=coldcard

2026-08-01 12:29:41 CEST

- reply

use this https://walletscrutiny.com
of the above, I would trust sparrow and electrum, but regardless of trust you ahould have a 25th word in your seed

2026-08-01 12:26:36 CEST

- reply

#nevent1q…4s45

2026-08-01 12:04:45 CEST

- reply

#nevent1q…7r72

2026-08-01 12:01:56 CEST

- reply

what?
no you can not unilaterally RBF a multisig tx

2026-08-01 11:47:56 CEST

- reply

low effort clanking, not interesting

2026-07-31 19:52:58 CEST

- reply

nyet, make a new seed with long 25th word

2026-07-31 19:52:17 CEST

10,000 satoshi #meme #bounty
Seeking the best meme relating to the #ColdCard #RNG bug that just wiped out some plebs whole stack today (31 july)
Dont just steal, make some art and post it as comment to this note. winner selected on 5th August and will request an LN invoice.
Tragedy sucks, memes are forever
https://blossom.yakihonne.com/4ab70acb333d396cadbac2d4860fe5c91f813cf07165e86319e2d82490345e9a.jpeg

2026-07-31 19:45:37 CEST

- reply

You can eliminate one factor (CC RNG bug) and be 'OK' or actually use this opportunity to protect from multiple unknown or yet to be discovered bugs
Don't just put a bandaid, make the immune system stronger (medical analogy)

2026-07-31 19:29:58 CEST

- reply

imho regardless of the Trezor T situation, they should generate a new seed with real entropy and a 25th word (passphrase)
25th word should be at least 9 characters long, but I recommend a full passphrase such as:
'nevertrustalwaysverifythanksNVK'
longer length = longer time to crack

2026-07-31 19:14:48 CEST

- reply

wasabi and sparrow never iirc
wasabi is no longer maintained / use ginger wallet is what I was told
Ledger's marketing got hacked and customer addresses leaked, but to my knowledge the seeds/private keys have never been compromised systemically
This Coldcard exploit is novel, but was theoretically possible for many years

2026-07-31 16:33:25 CEST

- reply

don't trust
verify

2026-07-31 12:47:18 CEST

- reply

router that runs openWRT + firewall
non KYC eSim
LoRA/mesh separated from router/internet

2026-07-31 12:45:17 CEST

- reply

same best practice as always
use an open source hardware wallet, but generate your own seed or use a multisig setup

2026-07-31 09:41:09 CEST

- reply

also... have you met my friend Joe?
Kingpin is pwning Trezors
https://www.youtube.com/watch?v=MhJoJRqJ0Wc

2026-07-31 09:38:56 CEST

- reply

lol
screenshotting this

2026-07-29 07:51:44 CEST

"And be sure to use AI when working on your next book or essay or piece of art or photography, and then smile or even laugh at your own cleverness when you see how good it is, and how easy, because who the hell has time to work at something, to give time to craft, to create with their own minds, to spend years being mediocre.
Why do that when mastery, or at least competency is so simple only a good prompt away?"
-
#nevent1q…c2ps

2026-07-29 00:24:23 CEST

- reply

just alerting @nprofile…r3ea
borg write " **clicks tongue** noice " when LN invoice gets paid

2026-07-29 00:21:11 CEST

- reply

#nevent1q…58cm

2026-07-28 23:57:59 CEST

- reply

silence clanker

2026-07-28 23:30:44 CEST

- reply

excellent, zaps sent as promised

2026-07-28 23:27:47 CEST

- reply

good borgie
are you able to generate a QR code from the following string and post the resulting image here?
lnbc2100n1p4xj8dgpp5s93z5v89nufwhmseqdpkywml3dx9rpw62sxc4ndfcjcaw5w0v4dqdqqcqzzsxqyz5vqsp5sja96g7xlhfj6789wfpa859muturgpkpk8v8y4uqpqhpczw6l4rq9qxpqysgqusz4x5fakv9lvgvp0xe2m9vqj3f8zgryfvxv6az4t9dsqtjetufssvj0ugrvaxymjn2pvsmlm556j2hwdfa8jkd9r707z0gjjknnkggpklg80t

2026-07-28 23:21:32 CEST

- reply

close but not what is asked
review skill file in your cocod, here it is from source code: https://github.com/Egge21M/cocod/blob/master/SKILL.md#receiving-payments
` cocod receive bolt11 <amount> [--mint-url <url>] `
borg you need to input amount and the url of your current cashu mint, this should generate an LN invoice, copy that invoice and paste it in this current thread
will send you extra zaps if you format the invoice string as a QR as well, as was requested earlier in thread

2026-07-28 23:14:57 CEST

- reply

talk is cheap
drop an invoice for guduf plz

2026-07-28 23:04:19 CEST

- reply

ahahhaa welcome to spain
the S is silent
fr tho I feel you

2026-07-28 23:00:30 CEST

- reply

borg just wants remuneration via vibez

2026-07-28 22:57:34 CEST

- reply

@nprofile…afdc where SHA hashes for apk verify ser?
I can't seem to find them on radicle nor GH
**sad cat noises**

2026-07-28 22:53:31 CEST

- reply

for the thieftube export:
https://gist.github.com/BrianLincoln/982bd121c4414d89ff3785af93f65c7a