Trading since 2007 "The generous person will be prosperous, and one who gives others plenty of water will himself be given plenty." -Proverbs 11:25
Gooch Island
Joined March 2014
- Tweets2.9K
- Following2.2K
- Followers1.7K
- Likes1.1K
Pinned Tweet
Ancient texts from 1,800+ years ago taught this portfolio strategy:
1/3 in cash
1/3 in real estate and real assets
1/3 in business (risk)
It’s wild how many people ignore this, go all-in on one thing, and eventually regret it when the market shifts. Some wisdom just doesn't age
Blur is shutting down and borrowers have to repay debts. NFT volumes dead, tax loss harvesting also. Everyone capitulating.
January 2027: the NFT bull run begins.
Punks to half a milly. 🫡
An interesting fact about the Coldcard Hack: A strong BIP39 passphrase likely saved many users from the entropy issue. Passphrases create different wallets, attackers can't know which weak seeds hold BTC without guessing the passphrase first. A 16+ character passphrase is already a strong protector against this issue. If you are a trezor/ledger user, consider adding a strong passphrase and moving funds to the new addresses just in case
Nando retweeted
Dear COLDCARD attackers,
Congratulations. You successfully found a bug, exploited, and have collectively gathered around 1,500 bitcoin.
Now you are sitting on one of the most blacklisted coin stacks in history. It will be nearly impossible for you to exchange for currency or deal with any institution. Every move you make will be highly scrutinized and tracked. Presumably for the rest of your lives, you will be looking over your shoulder.
I suggest you plea with CoinKite to return all stolen funds in return for an audit fee of 5% of the loot. This way your work is rewarded and you are able to enjoy the fruits of your labor.
Respectfully,
hodlers worldwide
I generated entropy using physical dice and added an optional seed phrase to avoid this very issue. I recommend others do the same. I trust dice more than I trust corporate manbo jambo
Today it appears that the entropy (or lack thereof) behind Cold Card seed generation was exploited.
The tl;dr is that bad randomness in Mk3 seed generation for Cold Card hardware wallets led cluster of roughly 594 BTC being swept from about 500 addresses in a short window.
Coinkite warns that seeds generated on Mk3 firmware 4.0.1 through 5.0.3 may be at risk. However there's evidence that Mk4, Q, and Mk5 could also be affected, though would require much more compute.
The proposed mechanism is:
1. The Mk3’s seed-generation path produced insufficiently unpredictable entropy for some setups.
2. Instead of a truly 128/256-bit secret, the output may have been drawn from a much smaller or structured state space.
3. An attacker can reproduce the candidate seeds offline, derive standard BIP-32/BIP-44 address paths, and scan the blockchain for funded matches.
4. Once a candidate matches a known address, the attacker has the corresponding private key and can sweep it. The device PIN, air gap, and secure element do not help at that point.
no reason to believe that Ledger, GridPlus, or Trezor devices share similar shortcomings, but this DOES highlight something: trust is everywhere in crypto. We want things to be trustless, but you have to trust that:
- your exchange won't ban you
- your wallet software won't act maliciously
- your hardware wallet firmware won't export your private keys to the feds
- your seed is generated with sufficient entropy
It seems like nothing is safe.
At this point I have to recommend multi-device multisigs for anything of significant value to you.
Generate at least two seeds using at least two different vendors (say GridPlus and Ledger) and then configure a multisig using wallets from each seed.
Write the seeds only on paper, split them via shamir secret sharing and distribute them geographically, among family etc.
Or just give up the dream and buy crypto ETFs.
Nando retweeted
Today it appears that the entropy (or lack thereof) behind Cold Card seed generation was exploited.
The tl;dr is that bad randomness in Mk3 seed generation for Cold Card hardware wallets led cluster of roughly 594 BTC being swept from about 500 addresses in a short window.
Coinkite warns that seeds generated on Mk3 firmware 4.0.1 through 5.0.3 may be at risk. However there's evidence that Mk4, Q, and Mk5 could also be affected, though would require much more compute.
The proposed mechanism is:
1. The Mk3’s seed-generation path produced insufficiently unpredictable entropy for some setups.
2. Instead of a truly 128/256-bit secret, the output may have been drawn from a much smaller or structured state space.
3. An attacker can reproduce the candidate seeds offline, derive standard BIP-32/BIP-44 address paths, and scan the blockchain for funded matches.
4. Once a candidate matches a known address, the attacker has the corresponding private key and can sweep it. The device PIN, air gap, and secure element do not help at that point.
no reason to believe that Ledger, GridPlus, or Trezor devices share similar shortcomings, but this DOES highlight something: trust is everywhere in crypto. We want things to be trustless, but you have to trust that:
- your exchange won't ban you
- your wallet software won't act maliciously
- your hardware wallet firmware won't export your private keys to the feds
- your seed is generated with sufficient entropy
It seems like nothing is safe.
At this point I have to recommend multi-device multisigs for anything of significant value to you.
Generate at least two seeds using at least two different vendors (say GridPlus and Ledger) and then configure a multisig using wallets from each seed.
Write the seeds only on paper, split them via shamir secret sharing and distribute them geographically, among family etc.
Or just give up the dream and buy crypto ETFs.
Fun NFT fact:
BAYC flipping CryptoPunks wasn’t some new era, it was pure bubble hysteria.
For a brief stretch (~18% of the time), hype beat history. People treated it like proof everything had changed, but it never really stuck
I don’t think moments like that come back easily. More mania than pattern, imo.
Nando retweeted
Chuck Norris: “Real men live for Christ”
"It's important to make your peace with Christ while the opportunity exists. Life is so fragile. You never know when it's going to be over."
"It could be over in the blink of an eye, and then it's too late to accept God's gift of salvation..."
Nando retweeted
i still hold eth as my main position because i believe the crypto industry would die if ethereum died
if there can be no long term thesis (ie new chains replace older chains, indefinitely) then the idea of crypto as money has no merit. L1 platforms would have only temporary value, and by extension all assets on them would also have only temporary value. it would mean smart contracts are unable to find a strong fit
but this will not happen. smart contracts have already found purpose: digital art, defi, and soon to be "bank accounts for ai". ethereum will win for the same reason bitcoin won against all its once hopeful challengers: lindy effect
ps it should be obvious but i excluded bitcoin from "the crypto industry" as it has already found a strong fit as "digital gold". it is a [volatile] store of value which is easier to store and transfer (read: better) than its analog counterpart
IMO ETH gonna lead the next bull wave on AI narrative, quantum resistance and L1 scaling. ETHBTC to 0.1
There are a ton of trapped BTC and ETH ETF investors in which this is their first rodeo. We could see significant panic candles before we can rise again
NFTs markets:
punks: 44 → 26 ETH = −40.9%
bored ape: 23 → 4.7 ETH = −79.6%
milady maker: 7 → 1 ETH = −85.7%
mutant ape: 4 → 0.6 ETH = −85.0%
pudgy: 35 → 4.4 ETH = −87.4%
lil pudgy: 4.5 → 0.5 ETH = −88.9%
doodles: 6 → 0.5 ETH = −91.7%
azuki: 13 → 0.7 ETH = −94.6%
im guessing we are in for a koala bear, a mini bear market that lasts less than normal. trump still has 3 years left in his term, 3 years of him and his family trying to pump this market. i think they will succeed and btc/eth will make new highs at some point. so we still gucci
So many people get lucky and think they are geniuses. The scary part? We all do it. Want to know who the next one is? Look in the mirror
money.usnews.com/investing/n…
