Madariaganet

#todossomossatoshi instagram.com/p/DXxNCZCiVns/…

1/ Después del quilombo de Coldcard, tirar dados para generar la semilla se volvió tendencia. Y tiene sentido: no le confiás el azar al dispositivo. Pero hacerlo mal es peor que no hacerlo. Hilo de cómo generar tu semilla con dados SIN cagarla, en 3 niveles de paranoia 🧵

¿Qué es una passphrase, qué consideraciones debemos hacer y cómo complementa a la semilla? #bitcoin

Boltz Swap Services are currently unavailable until further notice. We can't give an ETA as of this time, but will provide an update once we know more 🙏

@Boltzhq Dura y difícil decisión han tomado, con mucho criterio profesional, espero verlos de nuevo!

Update: Boltz will stay disabled until further notice. Our API remains available to process refunds cooperatively. In any case, unilateral refunds will work, as they do not depend on our infrastructure. Our support team stays reachable. To be clear: this is not a response to a single incident. Over the past months we have seen a steady rise in automated, AI-assisted probing of our infrastructure, and we have dealt with several exploits. Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch. In the past few days alone we saw a drastic acceleration, and we do not believe this asymmetry will reverse. After reviewing the results of our own recent security scans, we cannot responsibly re-enable Boltz swaps, especially as we are being actively targeted by what appear to be multiple resourceful groups while we race to deploy fixes. What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis. Do not expect swap services to resume shortly. To be explicit: no user funds were ever at risk. Boltz is non-custodial by design. And as a fully bootstrapped company, the losses were ours alone. We don't know yet how things will continue from here, but we'll keep you posted as soon as we have had the time to catch our breath and make a decision 🙏

🚨 Hoy a las 11 @FedeZupicich recibe a @lontivero (Wasabi Wallet) para hablar sobre el caso Coldcard, privacidad y las mejores prácticas para proteger tus bitcoin. 📍 En vivo por acá

No confundamos las cosas. No es un fallo de Bitcoin. Es un problema de entropía en el software de una empresa que fabrica hardware wallets. Muchos están poniendo como excusa este suceso para meter FUD sobre Bitcoin. Si roban un banco no tiene sentido culpar al dólar. Es ejemplo con pinzas.

Este hilo es para informar a los que todavía no saben de la GRAVE VULNERABILIDAD del firmware de COLDCARD. Esto ha afectado a todos los dispositivos que generaron claves desde marzo de 2021 hasta el 31 de julio de 2026. ¿Cómo saber si te afecta?

El hackeo de ColdCard va a marcar un antes y un después. No tengo ninguna duda. Y la gente está tan tranquila. Piensa un momento en quién ha perdido el dinero. No es alguien que se metió en Bitcoin la semana pasada. Es una persona que ha estudiado, que sabe un montón, que se informó de cuál era el monedero más seguro y por eso eligió ColdCard. ColdCard, que es difícil de usar, que no es para todo el mundo. Y esa persona aprendió a usarlo. Guardó ahí sus ahorros. De las personas que más saben de Bitcoin, y tenía su dinero dentro. Ahora ve y explícale a una persona normal que no pasa nada, que lo que falló fue la generación random de números de bla bla bla. Le trae de lado lo que le digas. Lo único que ve es esto: una persona súper preparada ha perdido sus fondos por tener autocustodia. Y ellos están menos preparados que esa persona. Ya me lo han dicho varios dentro de Bitconia. "Estoy cagado, y eso que hago bien las cosas." Tienen miedo de acostarse y despertarse al día siguiente sin su dinero. Y lo entiendo perfectamente. Sé que más de uno va a sacar su Bitcoin del Jade y lo va a mandar a un exchange. Porque el exchange te dice: yo te lo gestiono, y si pasa algo te cubro hasta 100.000 euros. Y esa persona duerme. Aunque sepa que el exchange puede cerrar. Aunque sepa que no controla sus fondos. Aunque sepa que se lo pueden embargar. Da igual. Duerme más tranquilo. Y mientras tanto me imagino a los exchanges y a los ETFs celebrándolo en su casa. No porque la gente haya perdido dinero, que eso es una putada enorme. Lo celebran porque ven venir la avalancha: gente sacando su dinero de la autocustodia para meterlo donde lo controla otro. Que sí, que la autocustodia no falló, que Bitcoin no falló, que el usuario no hizo nada mal. Todo eso da igual. Lo que la gente ve desde fuera es lo que va a quedar. Y por eso esto va a marcar un antes y un después.

A few thoughts on the Coldcard security incident (in no particular order): 1. This is devastating for a lot of people. They lost their hard-earned economic value in a way most didn’t realize was possible. Not everyone is a technical genius, but almost all are merely looking to build a better life for themselves and their family. I feel for these people and their new reality. 2. I have personally lost bitcoin in the past and it is never fun. The only lesson I can impart from my personal experience on those going through this is that you are unlikely to change the past. Don’t spend immense time thinking about what could have been, but rather focus on a plan moving forward. You can only control your actions and response, so focus on how to come back stronger. 3. People will inevitably attack the various investors in Coldcard, or the podcasters promoting the product, but that anger is misplaced and unproductive. I saw this phenomenon first-hand with the BlockFi situation. Even though I wasn’t involved in the company’s operations, people wanted someone to blame and they came for those who were the most accessible. To those who are angry, don’t waste your time attacking those who are not responsible. To those who will be unjustly attacked, this too shall pass. 4. This incident highlights the difficulty with self-custody. I fundamentally believe in an individual’s right to have true sovereignty over their assets. It is one of the core value propositions of bitcoin. But we must also recognize that self-custody is a technically complex topic that some, but not all, are prepared to take on. Better education and better technology can help bridge this gap in the future. 5. The mainstream media hasn’t picked up this story yet, but I am sure they will at some point. They can’t resist the “bitcoin was hacked!” storyline. Obviously bitcoin was not hacked and there is no known security vulnerability with the protocol. This was a third-party issue, but that won’t stop the misinformation, so it is important to combat the misinformation with facts. 6. Sentiment in the bitcoin industry is very bad right now. This is normal in a bear market, so it is not surprising. But a security incident like this is equivalent to throwing a match on gasoline. There will be more anger, in-fighting, and unproductive nonsense. If this is your first time experiencing it, welcome to the arena. If you have seen it before, you know the negative sentiment will eventually evaporate and the sun will shine again over the next 12-18 months. 7. There are very real ramifications to the acceleration in AI technology. I am not sure if AI played a part in this hack, but it wouldn’t surprise me if that was the case. Every developer should take this new capability seriously and consider how they can enhance their security practices accordingly. 8. The bitcoin community is just as resilient as the network itself. We have been through insane, painful moments throughout the years. This is another one. The only way forward is to go through the fire. In conclusion, this situation sucks for everyone affected. I genuinely feel for you and intimately understand the pain from my own past experiences. Keep your head up and continue walking forward. Love you all ❤️

Blue Wallet has a feature allowing users to add your own entropy using dice rolls or coin flips to create a Bitcoin private key, and if insufficient manual entropy is provided, it fills the remainder from the system random number generation.

Block engineers trace COLDCARD attacker to blockchain services provider. Clay Garrett, engineering lead for @blocks Bitkey, shared that during their investigation of the COLDCARD drain, Block's team identified an unusual pattern in the sweeps that led them to a breakthrough. The attacker used a paid account at a well-known blockchain services provider to query the targeted addresses and perform related activity during the theft. Block contacted the provider directly and their internal logs "matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests." Garrett noted there is no evidence the provider knowingly participated in or facilitated the theft, stating it "was supplying its standard services in response to requests that did not reveal their broader purpose." The team is now sharing the information with authorities and will provide further updates when doing so won't interfere with the investigation. This is a significant development as it means the attacker left an identifiable trail through a service that maintains account records, potentially giving law enforcement a direct lead.

A Passphrase is a great and simple way to add another layer of security to your seed. Learn more about it here 👇 bluewallet.io/docs/import-pa…

A lot of you are asking. How BlueWallet handles wallet entropy 👇 Wallets created in BlueWallet use your device’s cryptographically secure system random number generator. The industry standard approach for generating keys. Want extra peace of mind? You can also add your own entropy using dice rolls or coin flips (Add wallet → Provide entropy). BlueWallet lets users add entropy via dice or coin flips, and if insufficient manual entropy is provided, it fills the remainder from the system RNG. We regularly review this code, including with the latest AI-assisted tooling, and continuously test it as part of our development process. We ask you to do the same if you have the knowledge to do so. Every build also runs runtime self-tests that generate large numbers of seeds and check for unexpected collisions. While no single test can prove an RNG is perfect, these checks are designed to catch obvious regressions before they ever reach users (this is important, your wallet should have this!). You can even run the self-test yourself: Settings → About → Self Test Relevant ways to add security layers: bluewallet.io/docs/manual-en… bluewallet.io/docs/import-pa… bluewallet.io/multisig-walle… Security is hard, bitcoin will humble you. Please verify!

L2294 - EMERGENCIA @COLDCARDwallet Qué ha pasado y cómo actuar En este pod de emergencia trato: - Qué ha pasado - Cuál es el problema - A quién le afecta - Cómo actuar - Por qué ha pasado ¿Creaste tu frase mnemónica en una CC? Escucha y actúa youtu.be/7gLA7_5-lrE

Artículo de 2020 Guárdalo para el fin de semana. Aprenderás un montón de custodia y tb harás una frase mnemónica a prueba de Hardware Wallets. Da igual la marca estudiobitcoin.com/como-calcular-…

Gente, el problema de los random number generators solo está ahora visible en coldcard porque la vulnerabilidad fue identificada Pero puede estar sucediendo ahora mismo en un sinfín de wallets entonces usen passphrase como una medida extra de protección y si pueden no utilicen la seedphrase propuesta aunque ya eso es más avanzado y no todos lo soportan

@paul_ironforce Si el precio se desploma por el cambio tecnológico, quién va a querer invertir o utilizar GNO…

Mi lectura cla apuesta tiene sentido de negocio, venderle infraestructura a instituciones es un mercado real y grande. Pero el costo es resignar la parte más descentralizada de la red y meter presión sobre el token en el corto plazo.

Gnosis Chain quiere dejar de ser su propia blockchain y pasar a apoyarse 100% en Ethereum. Los validadores pierden su laburo y se destraba una montaña de tokens. Te explico pim pam pum

@paul_ironforce Acá lo importante es saber para que va a servir GNO y si conviene hacer exit de los validadores ahora o esperar próximos anuncios.

Presión de venta chikis. Bueno, es difícil saberlo con certeza, pero el riesgo está sobre la mesa. Un cuarto de la oferta total quedando disponible de golpe es una señal que cualquiera que tenga GNO tiene que tener en el radar. Como contrapeso, se termina la dilución anual del 2,3% que sufrían los que no hacían staking.

@paul_ironforce Habría que evaluar cuales son los incentivos por correr un nodo HOPR/Gnosis VPN, que aún es un proyecto en desarrollo. Aportas en la infraestructura de la privacidad y cobras una parte en base al tráfico, se depende que el proyecto salga a producción y consiga usuarios.

a ver, hablan de buscarles un rol nuevo en otros productos del ecosistema, como Gnosis VPN, donde se necesitan operadores independientes. Pero seamos sinceros... a ver...me entendes ?. El rol central que tenían en asegurar la red, se termina , los tienen entretenidos...manoseo.