Clay Garrett

If you use a Coldcard, review these findings from our Engineering and Security teams at @Blocks to see whether you may be affected. engineering.block.xyz/blog/predictab…

@AlexLi98 @milessuter @Bitkey Ha! I was curious about that and checked and got the same thing. Tried again in a different tab and it gave the right answer.

@clay_garrett @milessuter @Bitkey Nice! Google is pulling the answer from your original press release saying source viewable, I got bamboozled by AI 😅

1/7 At Bitkey, we understand that moving your funds to a new wallet can be stressful. As requested by people in the community, here’s a refresher on how those who want extra peace of mind can verify that your Bitkey wallet is in perfect shape before transferring funds into it.

@AlexLi98 @Bitkey @moneyball Good news. It is! We updated our license quite a while ago to use the MIT license. It's fully FOSS: github.com/proto-at-block…

I love @Bitkey but source available is not the same as FOSS, anyone could have looked at the Coldcard source code but many didn’t because they couldn’t use it commercially. @moneyball any chance we can get Bitkey to full MIT?

@AlexLi98 @milessuter @Bitkey Good news. It is! We updated our license quite a while ago to use the MIT license. It's fully FOSS: github.com/proto-at-block…

@clay_garrett @milessuter Huge fans of @Bitkey but this coldcard hack showed source viewable is not the same or as secure as FOSS. Can we get Bitkey to be fully FOSS?

1/ Earlier today, our Bitcoin engineering and security teams at Block began investigating reports of non-Bitkey wallets being drained. To proactively protect our customers, we began investigating immediately. Here’s what we found 🧵

@w_s_bitcoin Post incoming from Block team that addresses devices other than the MK2 and MK3.

7/7 Bitkey’s recovery systems and security model is built to make sure your bitcoin is easy to use and hard to lose.

6/7 If you’d like to add extra security, you can add up to 2 backup fingerprints. This gives you another way to unlock your Bitkey hardware.

7/ Again, the patterns here are strong, but we have not confirmed that these indeed are related to drain. Please reach out if you spot anything that supports/refutes this.

6/ Method: We scanned all 888,661 transactions in blocks 960050–960230. Each match in the original wave had these shared properties: version 2, locktime 0, final sequence on every input, one output and inputs from one source address, a P2WPKH destination, one homogeneous supported input type and a 30 sat/vB pre-signing fee estimate.

1/ Block’s engineering and security team found another set of transactions that could be a part of the Coldcard drain. We’re still working to vet these completely, but given the situation, we feel it’s important to share early.