Aaron Underwood retweeted
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
Aaron Underwood retweeted
Bank of America just paid $1.2 billion for willfully violating the Bank Secrecy Act, failing to report $5B+ in suspicious transactions tied to money laundering networks over 7 years.
No one is going to jail. They booked the fine as a line item and sent $8.3 billion back to shareholders in the same quarter.
Meanwhile Keonne Rodriguez and Bill Hill, the founders of Samourai Wallet, are sitting in federal prison for building non-custodial software that never touched a dime of anyone's money. FinCEN itself said Samourai wasn't a money transmitter. Prosecutors charged them anyway.
BofA is a licensed money transmitter that willfully broke the law for years and walked. Two developers who wrote open source code got caged.
Two-tier justice system. Be aware, freaks.
Aaron Underwood retweeted
🎁 GIVEAWAY 🎁
Win a Trezor Safe 7 Bitcoin-only Edition + Trezor Academy T-shirt + 2 Bitcoin books.
To enter:
1️⃣ Follow @Trezor & @TrezorAcademy
2️⃣ Like & RT
3️⃣ Tag a friend
Good luck!
Aaron Underwood retweeted
people who stored their btc on coldcard got drained because of entropy.
the seed generation was reproducible, anyone could recompute their keys.
so i went through every other hardware wallet to see how they make your seed, and whether the same thing can happen again.
@Trezor: mixes the device's randomness with randomness from your computer, and the device has to prove it used both. even if its chip is fully broken, you're still fine. the best design here by far.
@BitBoxSwiss: 5 separate sources of randomness combined. one bad source can't sink you. open source, reproducible builds, dice supported.
@FoundationHQ: built their own randomness circuit out of plain resistors and capacitors, open source, on top of two other sources. no black-box chip to trust. supports dice.
@KeystoneWallet: 2 secure chips from 2 different manufacturers, combined. also lets you roll 99 dice and publishes how to check the result yourself.
@Blockstream: jade pulls from 7 things: radio noise, cpu counters, battery, temperature, camera, your input, the app. very hard to break all of them.
@SeedSigner: your dice are the only source. no chip to trust at all. and they ship a guide teaching you to verify their own math. weakest hardware, strongest proof.
@OneKey: secure element plus mcu combined on device, open source firmware. solid, but you can't add your own randomness.
@Ledger: one certified chip (AIS-31, EAL5+). good randomness. but it's a single source, closed source, and you cannot verify any of it. you're trusting them completely.
@Tangem: key is born inside the chip and never comes out. audited by three firms. same trade: strong, and impossible for you to check by design.
@ngrave_official: mixes chip randomness with your fingerprint and room light. clever. but the "EAL7" badge covers one software component, not the whole device.
@ELLIPAL: single certified chip, no software fallback, fails closed instead of guessing. closed source, so take it on faith.
@SafePal: 2 chips mixed. they've never published the details.
@COLDCARDwallet: patched now, and dice on coldcard were always verifiable. but every seed made between 2021 and 2026 is permanently burned.
one source = ledger, tangem, ellipal. that one source fails, everything fails. their answer is to make it excellent and certified. that's exactly the bet coldcard lost.
many sources = trezor, bitbox, passport, jade, keystone. one broken source never reaches your key.
and every one of these claims 128 or 256 bits.
coldcard did too. certification doesn't help either, coldcard's chip was fine, the code just stopped calling it.
the only thing that saves you is being able to check.
roll your own dice. verify the words yourself.
Aaron Underwood retweeted
This is common misunderstanding that the problem is somehow specific to HW wallets only. Such problem happen to Mycelium, which used broken RNG on certain Android phones.
This vector is not a property of being HW wallet. It is property of devs not understanding their stack.
Stand Up for Freedom: Pardon the Innocent Coders Jailed for Building Privacy Tools! - Sign the Petition! c.org/5GFCrvPj6S via @Change
Aaron Underwood retweeted
The f*ckng developers of Samourai wallet got 5+ years and they didn’t steal a cent from anyone.
When you think you hate your govt enough, you find out you’re wrong.
Aaron Underwood retweeted
🥷@craigraw just shipped Silent Payments receiving in Sparrow Wallet!
One Bitcoin address. Reuse it forever. Zero privacy loss.
This is one of the biggest privacy upgrades Bitcoin has had in years. Here's why it matters and what Silent Payments actually are. 🧵
Aaron Underwood retweeted
I am writing from FPC Morgantown prison in West Virginia. It has been about 5 months since I first surrendered myself in December, and I will be honest, the prospect of a Presidential pardon is very low. There was some hope during the Bitcoin 2026 conference, but that has now come and gone, and one must come to terms with the fact that I am simply a federal prisoner without money, power, or influence, and I will serve my full sentence. It will be years before I can even attempt to rebuild my life. Which is why I am now writing this appeal to you all now. Things are dire and we need your help.
Lauren and I need your help desperately. More than ever before. We have over $2 Million of debt due to legal fees. We have a $250k fine the judge levied against us. Every day I get letters and calls from anxious lawyers looking to be paid. Or the DOJ demanding I start making payments on my fine. Perhaps it was denial or delusion, but I had hoped to do what I have always done and dig myself out of this hole myself - but with the reality of serving a full sentence that is not possible. I hate to ask for your help in this way but we are entirely out of options. We need to pay off these legal bills and other debts accrued attempting to defend myself. We desperately need your help. Now.
For 10 years Bill and I built and published open source code and tools for Bitcoin users. Those same tools and code are what the government says were criminal. The tools and code still exist, they are out there right now and always will be. The creators however are locked away in Federal prison. The creators are the ones whose lives have been decimated. The creators are the ones who have been financially wiped out. The creators are the ones who desperately need you now. Please donate whatever you can to bc1qtjjcvn98wh7dfd55m8kxhjcfexanttwt8gtan8 . We have to get this albatross from around our neck.
Samourai had well over 100,000 users. These users pushed over 2 billion dollars through our open source tools. We need those users and any bitcoiner who appreciates the work that we put into this industry for over a decade to help us now. Please donate whatever you can to bc1qtjjcvn98wh7dfd55m8kxhjcfexanttwt8gtan8 right now.
If you require a private address please DM my wife @leamuirleyn and she will provide one. Please do not delay. Time is of the essence. Please help us.
- Keonne
Aaron Underwood retweeted
holy fuck, a hair dryer at a Paris airport broke Polymarket weather markets & made someone $34,000 richer
- polymarket was settling Paris temperature bets on a single Météo France sensor sitting near the Charles de Gaulle runway perimeter - basically unguarded
- the guy bought the long-shot outcome (like "22°C" when everyone expected 18°C) for pennies, since nobody thought it'd hit
- then he walked up to the probe and briefly heated the air around it with a portable heat source, spiking the reading just long enough to register as the daily max
- temperature snapped back to normal in minutes, the market resolved in his favor, and he cashed out - twice, on April 6 and April 15, before Météo France caught on and filed charges
hyperstitions.
Aaron Underwood retweeted
I have long theorized this could be a possible attack vector especially towards small independent/solo mining operations.
Currently only foundry has enough majority hashrate among pools to pull it off.
Attack looks something like this:
Majority Pool finds block (880 in this case) and immediately start working on next block (881), but withholds the block they found from the network.
Other pools continue working on 881 without knowing foundry has found 881 and is withholding it.
From a competitive standpoint its in foundries interest to do this, if they find block 882 while other pools are still working on 881 they can broadcast the longest chain the moment another pool finds a block, effectively sniping that block from them.
A more nefarious version of this would be Pool A + B +C that control a supermajority of hashrate all collude to block small KYC free blocks/hashrate. This would work in the reverse where these pools detect an "unknown/non KYC block" and effectively "ignore" it and continue working on the last "KYC" block.
Since they have majority hashrate they will in most instances find a new block before anyone else, effectively forcing an orphan on that block.
This is why it's so important for all pools to either be truly independent (trust me bro), or make sure there is enough independent hashrate where this can never be possible.
We just had a rare-ish two block fork/reorg between Foundry and AntPool+ViaBTC. Foundry mined six blocks in a row.
bnoc.xyz/t/two-block-reorg-a…
Aaron Underwood retweeted
Kern started with bold moves after deep research.
There wasn't a single example online of an ESP32-P4 scanning a QR codes through its new MIPI interfaces. So it was built from scratch.
No MicroPython? Let's do it in pure C.
→ cUR: the first pure C implementation of the UR protocol
→ A quirc-based QR decoder with novel perspective correction and thresholding approaches
Now it's time to explore the P4's security features...
Stay tuned.
Aaron Underwood retweeted
So you want to buy bitcoin? Friends don’t let friends KYC. Stop normalizing it. Use bitcoin as it was intended.
