The point that im trying to make:
Yes binance may have an insurance fund. But that insurance fund is dollars.
When btc, eth, or any crypto gets stolen, I think it's disingenuous to say that "customer funds are safe"
Because that crypto *was* customer funds. Regardless if they buy it back using their insurance fund.
They are saying "user funds safu" only because they are gonna buy it back. But in reality, a 1:1 customer crypto audit would fail at this time.
fst_nml retweeted
Elon Musk buying Twitter to "promote free speech" was a bait and switch.
In reality, Twitter is forcing people to KYC onto the platform through the verification process.
If you don't verify, or trigger algos, you get ghosted to where people don't see what you write anymore.
fst_nml retweeted
Coinbase “lost” $25m of my firm’s a couple years ago. Turned out they were actually covering up massive and repeated hacks. Still wouldn’t return our money. We traced this to at least a dozen other affected firms and over $1b covered up. That’s all I can say for now as multiple legal processes still ongoing.
fst_nml retweeted
We have some major Ethereum news coming out over the next few months that could interest institutions, app devs, and ETH holders.
I would like to see how far this news can begin to spread, and I strongly believe in enabling more of our ecosystem to write (this is not just for Ethlabs)
I would love to connect with more people at publishing houses and news media to see if we can really turn up Ethereum's media presence a notch, especially by helping more of its most influential yet quiet voices say more.
These stories will be worth breaking.
@CoinDesk @Cointelegraph @TheBlockCo @Blockworks @DecryptMedia @DLNewsInfo @DefiantNews @BanklessHQ @Unchained_pod @crypto @FortuneMagazine
fst_nml retweeted
The main difference between republicans and democrats is where on the globe they want us to be involved in a war.
fst_nml retweeted
Feels like crypto’s allies are leaving Washington en masse.
@HesterPeirce, @HarryYJung, @SenLummis, Tyler Williams.
News w/ @LauraEWeiss16: Treasury Secretary Scott Bessent’s top crypto adviser departed the government on Friday. Tyler Williams is expected to return to the private sector.
fst_nml retweeted
Multiple entropy sources are only worth something if the code actually uses them. You can have four different sources of randomness in the device, but if it is using a test generator instead (code bug), none of those sources actually matter. Rolling dices doesn’t imply the device will actually use it. The entropy is not the problem here, the problem is the device not using it.
We already explained that Trezor does not use the affected code. Here are some examples of what we are already doing to make sure we do not accidentally bundle in testing RNG (random number generator):
👉 We do not use MicroPython's random module at all. It is disabled outright in our firmware config [1].
👉 rng_fill_buffer() reads the STM32 TRNG peripheral registers directly. No macro dispatch, no software path to fall through to [2].
👉 The software PRNG lives in a file literally named "crypto/rand_insecure.c", and compiling it emits "NOT SUITABLE FOR PRODUCTION USE!" warning [3].
👉 random.reseed() exists only under ifdef TREZOR_EMULATOR, and the C function behind it only under USE_INSECURE_PRNG. Two independent guards, and no reseed API in production firmware at all [4].
👉 rng_fill_buffer_strong() fills from the MCU TRNG, then XORs every byte with Optiga output (Safe 3, Safe 5) and, on Safe 7, Tropic output on top. If a secure element fails it returns false and the caller raises RuntimeError. Fail-closed, not fail-quiet on models with a secure element [5].
👉 Our Entropy check makes sure that the host’s (computer/phone) RNG is mixed in as an extra failsafe [6].
These are just some examples of how we protect from this kind of failure. That being said we never stop building and we always humbly learn from situations like these. So we are carefully studying what lessons can be learned from this incident and we are already drafting more safeguards on top [7].
You don’t have to trust me on this, our code is open-source and you can see for yourself or use your favorite AI model. See the links below. And don’t forget to ask your wallet if they can do the same…
[1] github.com/trezor/trezor-fir…
[2] github.com/trezor/trezor-fir…
[3] github.com/trezor/trezor-fir…
[4] github.com/trezor/trezor-fir…
[5] github.com/trezor/trezor-fir…
[6] trezor.io/learn/security-pri…
[7] github.com/trezor/trezor-fir…
I think the world just got a great lesson in entropy, RNGs, single points of failure, multisig, passphrases.
Everyone is going to re-examine their self-custody strategy. For the better.
Unfortunately, it took something bad for this to happen.
You know which entropy never got exploited?
The cursor movement for 30 seconds on bitaddress.
Some hardware wallets like coincard can make things complex, yet a simple cold storage laptop with its Internet modem removed using multisig wallet still feels safer.
fst_nml retweeted
Alright I'm convinced THIS IS NOT A DRILL.
It is a small minority of users, not everyone.
We DON'T KNOW what the attack is. Could be RNG, could be NONCE, could be something else. We DON'T KNOW if it affects only single sig with no passphrase, or if it's a different layer. Use multisig, preferably multi-vendor.
I'm hearing a potential issue with some Coldcard wallets being drained.
I will not FUD, but would like to get at least reports of trusted people.
Can my followers, who own a CC, generated the mnemonic on the CC, and use it as a single sig check their balance and report if it's gone.
Hopefully a nothing burger, but gonna do my job here.
fst_nml retweeted
Seizing another nation's assets to pay for unrelated future claims is an incendiary precedent.
Those who celebrate or profit from such funds should remember: once governments normalize confiscation, no one's assets are safe. Ensuing chaos will not be pretty or peaceful.
