The Frontier

A critical vulnerability in Coldcard hardware wallets (versions 4.0.1 and later, or any model after 4.0.0) compromises private keys due to a faulty random number generator.

The catastrophic Coldcard bug, introduced in March 2021, compromises seeds generated on any device after that date unless sufficient dice roll entropy (over 100 rolls) or a passphrase was used.

Hosts advise all Coldcard users to immediately move their funds off the devices and to cease using the product entirely, regardless of previous protective measures like passphrases or multisig.

The hosts express deep regret and take accountability for recommending Coldcard for seven years, admitting their past confidence was misplaced despite consistently advocating "don't trust, verify."

The Coldcard vulnerability was publicly disclosed on August 3, 2023, at Bitcoin block height 960885, prompting hosts to release this podcast immediately to maximize user notification efforts.

The hosts had previously conducted Coldcard workshops since December 2019 at Chaincode Labs with figures like Evan Kaludis and James O'Byrne, demonstrating features like dice rolls and passphrases.

Hosts concede to complacency, having placed too much trust in CoinKite's NVK and Peter; they now believe the concept of a "magic bullet" beginner-friendly solution for high-value self-custody is dead.

The bug, which existed for five years, appears to have been recently identified with assistance from AI, possibly through OpenAI's Cypher program utilized by Rob Hamilton's team for auditing Bitcoin projects.

The Bitcoin community has rallied to assist affected users, with Rob Hamilton (@Roboneham on X) publishing an extensive guide detailing Coldcard vulnerabilities, migration options, and recovery steps.

Attackers are actively brute-forcing compromised Coldcard seeds using GPUs, while authorities are investigating an attacker who reportedly pinged a centralized API provider to look up vulnerable addresses.

The hosts clarify the vulnerability is entirely CoinKite's responsibility, stating their firm 1031 is a minority investor (under 10%) with NVK and Peter maintaining majority ownership and control.

The hosts will now refrain from directly recommending specific custody solutions, instead laying out options and emphasizing multi-vendor multisig and robust passphrases as critical for long-term secure Bitcoin storage.

Users are strongly advised not to update Coldcard firmware, as new releases may brick devices; instead, the immediate priority should be transferring all funds off the compromised hardware.

Odell highlights current Bitcoin metrics, including a block height of 959994 and a price of $63,819, emphasizing Dispatch's ad-free model supported by viewers through podcasting 2.0 and Nostr apps.

Odell acknowledges top supporters from the previous week, noting zaps from PGS design, Mav 21, and Liberty farmer, who is behind the Hamster Project bringing Nostr to ham radio.

Soap Miner, who is 58 years old, started his Bitcoin-only soap business during the COVID-19 pandemic after learning soap making on YouTube and being inspired by Odell and Jeff Booth about Nostr.

Soap Miner emphasized choosing Nostr and Bitcoin-only acceptance as his niche strategy in a saturated market. This approach has led to an 85-90% customer retention rate with loyal Bitcoiners.

Soap Miner argues that accepting only Bitcoin is crucial to nudge the Overton window towards hyperbitcoinization, as using dollars props up the existing fiat system and gives people an 'out'.

Odell and Soap Miner discuss how Square enabling 4 million merchants to accept Lightning payments is a net benefit, fostering adoption even if payments are often converted to dollars.

Soap Miner exclusively accepts Lightning payments for his soap business, finding it simplifies transactions by avoiding UTXO management and benefits from its default privacy features.

Soap Miner views Strike as a positive 'stepping stone' because it allows users to purchase actual Bitcoin and self-custody it, promoting personal responsibility despite its KYC requirements.

Soap Miner believes Bitcoin ETFs and MSTR stock represent 'paper Bitcoin' for 'fiat-minded' individuals who avoid self-custody. He argues that Wall Street manipulates prices.

Odell and Soap Miner expressed frustration with the BIP 110 debate, criticizing its misleading messaging and personal attacks. Odell expects a chain split if consensus isn't reached on the proposed soft fork.

Soap Miner describes his soap business as a way of 'mining' Bitcoin, earning sats with each sale, which he finds more viable than traditional Bitcoin mining given its competitive nature.

Soap Miner envisions a future where small Bitcoin miners are integrated into everyday home appliances like water heaters and air filters, leveraging excess heat for practical uses.

Odell notes Paul Sports' upcoming 'e cash fork' in August, which will effectively create a new chain and potentially claim half of Satoshi's coins, adding complexity to the Bitcoin ecosystem.

Self-custody directly incentivizes users during potential chain splits, as those holding their own Bitcoin retain agency over fork dividends, unlike those with Bitcoin in ETFs or exchanges.

Odell and Soap Miner connect the difficulty of encouraging self-custody to a societal reluctance for personal responsibility, noting that early Bitcoin adopters often already possessed a liberty-minded ethos.

Soap Miner credits Andreas Antonopoulos's 2016 explanation that governments couldn't stop Bitcoin for sparking his conviction, leading him down a 'freedom go up' rabbit hole after initial altcoin exploration.

Odell observes Bitcoin events becoming more corporate, preferring smaller gatherings like Camp Nakamoto. The event offers a family-friendly, high-signal experience on Lake Winnipesaukee, featuring Ainsley Costello.