Coldcard's Firmware Flaw Let Hackers Steal $100 Million. Is Your Cold Storage Safe?

Transcript

We're in this institutional age of crypto and when you unpack the institutional mindset, it really comes down to one thing. I want a throat to choke. I want to be able to sue somebody. That's what they'll tell you over and over again. I don't care. Like, I need somebody who's capitalized that I can sue. And I think there's value in that for many institutions. Hey everyone, welcome to Bits and Bips, where we explore how crypto and macro collide one basis point at a time. We're here to discuss the latest stories in the worlds of crypto and macro. And as a quick heads up before we dive in, remember Bits and Bips has its own channel now separate from Unchained. So if you're not subscribed here, you're going to stop seeing the episodes. Don't lose your dose of the sharpest takes in

crypto. We're on X, YouTube, Spotify, Apple Podcasts, really wherever you're watching. And before we begin, a quick commercial break. >> This episode is brought to you by Cape, America's privacy first mobile carrier. Same premium service you'd expect from any other carrier, but designed so your number, your location, and your data actually stay yours. Get 33% off 6 months at cape.co/chained. Not listening to Bits and Bips yet? It's our weekly crypto and macro market show with Rahm Alawalia, Austin Campbell, and Chris Perkins. Search Bits and Bips and subscribe.

>> All right, everybody. Welcome back. So, a quick market snapshot. Bitcoin has been trading around the 63Kish level today. ETH around the 18850s. 10-year is still hanging around like 4.72 to 4.75. Not ideal. Um, the FOMC hike odds are elevated above 50% right now. And here to discuss all of this today, I'm your host Austin Campbell as always with my co-hosts Rahm Alawalia, Maester of Wealth, Leader of Lumida, Chris Perkins, the golden hand of Franklin Crypto. And joining us today is Alex Thorne, head of research at Galaxy Digital, uh, who has

been tracking the cold card exploit in real time. And by the way, if you're not listening to Galaxy Brains with Alex, you need to be. Galaxy Brains is a leading indicator of quality crypto content. Um, all right, let's start with one of the two big stories of the day, which is the Ashen Brener blowup. So, the biggest AI fund of this cycle blew up in basically a single month. Uh, the situational awareness fell from about 45 billion to roughly 10 billion after steep July losses. All numbers approximate according to Bloomberg.

margin calls from prime brokers forced a distressed sale of its public stock portfolio to Ken Griffin Citadel and what remains is the anthropic stake and private vehicle instruments for the fund according to TechCrunch. Um this is a 67% drop in AUM drop is 35 billion. Again, hard to know how much of that is allocated where thanks to the deleveraging. But what happened is both legs of this trade broke at once. The AI infrastructure trade, SanDisk way down, Nebius way down, Micron way down, coreweave way down. If you're forex levered, you don't need a crash. You

need a bad month according to chart. Um there's a spicy claim that Citadel timed it. uh that Sha Balour said Ken Griffin Citadel was pushing surprise rate hike fears just days before the AI trade collapsed and forced the forex levered situational awareness to unload its book near the lows. On the other hand, Scott Milker said it's leverage, not conspiracy. If you believe that Citadel intentionally crashed the market, that I have a bridge to sell you on Mars. Citadel had the dry power to take advantage of the situation. That's it. So I kind of want to start here before we go further into this. Rahm, you've talked a lot about

momentum. You've talked a lot about the current dynamics of the stock market. This has played into some of your previous themes. So what do you think happened to? >> Yeah, I don't think Citadel did anything uh nefarious here. uh when Micron reported the stock sold off double digit percentage points. That same thing happened last quarter when Michael when when Micron reported momentum was three standard deviations uh bid that came undone. We saw tremendous volatility in the South Korean stock market. Uh and Liupole the PM was just drinking his Kool-Aid way too much. It actually reminds me of the blow up of asymmetric which is long

salana and short ETH. Those are like the same trade on leverage. Very similar kind of concept. Um he's a young 24 year old kid. I don't think people should uh um I don't think people should exclude him from the industry. I mean he's learned and he's accomplished quite a bit here. Uh but that kind of positioning is reckless though. like that's not a good portfolio. Uh basic stress testing capabilities would have identified this like where were the adults in the room? Where was the AI based stress testing and scenario analysis?

Um I think he's also just too close to Silicon Valley. You know, his now new wife uh was the chief of staff or is the chief of staff at Anthropic. So he's so close to he can't see outside the AI bubble. Um the the LPS in this got hurt a lot. It seems to be the case that the year-to- date gain comes almost exclusively from the anthropic position. If you mark that to market, that's not much of a gain. You know, publicly listed closedin funds that contain anthropic or train at discounts to par value of double digits.

So a major blow up and a lot of the new money I would speculate here came in in the last three months because that's what happens. people subscribed when the money goes up. Uh and those liquid positions were novated to Citadel on a margin call on a distress basis. So they probably lost their principle on that liquid book and that new money didn't get the benefit from anthropic. So imagine this. Imagine in June you get a monthend statement saying you're up a gazillion%. I guess it was like 200% some large number.

um you're looking forward to the wedding invitation and of course he's invited all his LPs to the wedding. It's a big celebratory moment and now everyone shows up a week before they got a liquidation notice and they're saying can you please contribute to our next fund and we're going to have a breakout session to talk about the future of AI. me. Uh there's so many angles to the story too. By the way, the seed investors were the stripe, the collision brothers, $200 million they put into this, Daniel Gross and others. Uh so just a fascinating story, lessons learned all around.

So one of the things that I have looked at in these situations is you've got to look at the price dynamics and the underlying market fundamentals differently from each other to figure out where things go from here. Right. One move, we saw this with Archugos in the past, is you have something levered that blows up and it still continues functioning. The market is fine. It's just somebody levered got carried out on a stretcher. These things happen. On the other hand, you could have situations where the underlying market itself is breaking down. I don't need to tell anybody here stories about 2008 and where leverage collapsing ended up there. So Alex, I know you guys have some involvement in this space. Can I

ask you among things you're allowed to talk about what are you fundamentally seeing in AI world right now, data center land, all of those sorts of things? >> Yeah, I I I would call this 80% technical and 20% fundamental. um you you have to think some of the it's not just the recent you know unwind or you know whatever you want to call it what's happening in the memory and and data center trade the last month or so also what happened on the runup was probably a lot to do with situational awareness as well the percentages of like every ba major public equity involved in this um but if you look at the big four hyperscalers they're still guiding big capex spend growth um even if the growth

operator is monitoring. I think we still see substantial demand for new AI buildout which is you know important for everyone and all of our uh portfolios but also um I think very clearly now especially with the increase in cyber um needs for AI I really don't think we're close to the to the you know supply hitting the demand for compute and for data centers. um we may be sort of in the end of the second or so and so a little bit of a pause and uh you know a brief repric I think makes some sense. I mean if you recall just think about how uh how far we've come since just last December. You know I

think a lot of people left and and went on sort of holiday vacation found out about coding agents literally like the last week of December. I know I basically did although I'd been using chat and claude for you know research and writing a little bit for at least a year before that. Um came back in January by February you know people are coding by you know the spring we're in a full-on panic slash euphoria about the impact that AI will have. Now you've got frontier models like methos that are blocked by the government, but you've also got open- source models like Kimmy and GLM that are almost as good and everyone is using. So um I think we've still just scratched the surface and

from the from the energy and um you know compute buildout side, you know, it's hard to know. You're going to you're going to see you know it's it reminds me of the internet bubble. It also reminds me of um some of crypto like from 2016, right? People said 2017 was blowoff top. You know, today we're you know three plusx higher than the 2017 top in Bitcoin. And you know the internet well like that exuberance was real earlier this year on AI but um we haven't actually gotten to a steady state uh that we think is coming. I think there's a lot more demand and again if you if you look at the big hyperscalers like they're not bulking an eye here on the

the demand that they see and the money they need to spend on this buildout >> 100%. I'll chime in. Um this is a young market. We're not entirely sure where where how things are going to level out. it's super early and when you have something so early um volatility is is very much to be expected and when you pour leverage on top of val volatility which works in both directions I don't want to say it's not surprising but it's kind of not surprising that you have the outcome here with situational awareness and all of us have gray hair because we spent years on Wall Street and and like blowup after blowup you know what do you do you go back to your stresses you go back to your VAS you you calibrate your

risk. You know, if you come into this as a 24 year old with a background in tech, you know, you hope that you surround yourself with some of those gray hairs who have that experience in risk management, maybe that was a gap that will be expected. Uh I think the thesis is directionally correct, but it's early and super volatile. I think it's going to get more volatile. I mean, experts are projecting that we're going to have AGI as early as 2030. Do do you not think there's going to be massive volatility leading up to that and after that? It's going to happen. So, um, lesson learned. Not the first, not the last. Um, it'll happen again and again.

>> How wild is it that he took on leverage like a den and everyone had this talo effect around him and were just shoveling money to subscribe. They thought he was the oracle and it like he was doing what the South Koreans are doing. Actually, even more so. Well, like even, you know, when when we used to have like credit reviews and you had this massively outsized performance, that was actually always a red flag to them because they're like, well, wait a second. You know, where's this where's this upward volatility coming from? And so, I think that is an also a lesson to be learned. You know, what comes up can go down and what goes down can come up.

Particularly in crypto, particularly in this early AI space, particularly as we're getting into quantum. So, nature of the beast with these early frontier markets. >> I think another lesson here is that AI is not going to disrupt investing anytime soon. I I have no doubt that he was using clawed co-work to review positions and do analysis that clearly did not work out. It turns out having a risk model built by an institution like MSsei Bar or Axioma where you can measure your your betas and your factor exposures and industry exposures and do stress tests which has been around for decades right ma managing variance at risk sear he he didn't do that like that still

matters I think I mean AI certainly can improve a lot of the risk management by honing your stresses and on things like that and looking at data series I think you know there's definitely value ad you say disrupt I don't know is it disruptor evolution definitely changing asset management as we know it >> absolutely yeah >> so one thing I would also notice here is this has been a trend of things when Silicon Valley gets really focused on itself like this is not the first time we've seen a large tech bubble of some sort come out in part and whole same thing happened in 2000 000. And what's fascinating about it to actually echo points all of you are making is it's not

that the internet thesis was wrong in direction. It's that it was wrong on timing. Right? You price all of the gains in immediately and you allocate them to the wrong players. So Rahm, I want to push on one other thing here as we're seeing this like Liupold was clearly making directional bets on a specific subset of this space. Do you as an investor right now have high confidence that 5 to 10 years forward you know where the gains in AI are coming out in the market? >> Well I I would say the AI adoption story is real. The productivity gains are there. You see return on investor Kalpa from the hyperscalers. It's a legitimate story. So the one of the ironies is that Leo's fundamental thesis is actually

correct. He actually has the right big picture view. you just had terrible everything else as we discussed risk management uh and leverage the names though I don't know like the the moves you saw in the market from March to June were truly these are like less than 1% movement and now we know why it was the Scooby-Doo moment someone pulled a the mask off he say oh it's it's Leapole like so he was bidding up names that really didn't make sense like AMD did a double even though it's got half the margin and half the earnings growth and twice the valuation in Nvidia. They were very strange moves at the factor level.

My team and I were looking at and and now it all makes sense. That's what he was bidding up and he was also selling off software. Now that had a vicious rally of course uh so truly extraordinary. I think I think one other take here is the lender of last resort is Citadel and Jane Street. So when long-term capital management blew up, the investment banks were invited down to the New York Fed by uh you know the regulators and they said, "Okay, how do we pass the hat around and auction off slice of this portfolio?"

That didn't happen here. They called up Citadel, Jane Street, and Millennium. These firms are now the lenders of last resort. uh and their impact on markets is more significant uh than ever >> for sure. But like I'll also tell you that Griffin is a very soph sophisticated shrewd investor. Like look what he did after Enron. He got in a plane and he picked out the value out of that company immediately. Um he's not doing anything for charity. He's looking at these guys saying I have a value opportunity. I'm scooping up what I'm going to scoop up. Which which kind of reinforces what you said, Rahm. He probably agrees with you that Liupold is directionally correct and now he's

getting these assets at discount. >> He's already up a couple billion dollars in that transaction. >> It's like Citadel wins again. I think the other thing about this hubris is another part of the story. I saw some comments that in 10 years >> Leopo will come back and disrupt Citadel. No, that's that's not going to happen. There's so much compounding of expertise systems latency capital knowhow risk infrastructure human capital. They have interns that are earning a couple hundred,000 a year. Like, no, you're you're not going to disrupt Citadel. Ken, Ken Griffin, and Jane Street, they're very skillful at what they do.

>> And he has the constitution, too, >> right? >> You got the constitution from us crypto people. I was going to say and like some sort of dinosaur skeleton. I believe like Ken Griffin in many ways if you look at the artifacts that he's accumulating is either going to be starting a museum or is a Bond villain and there's kind of no middle ground between these two outcomes. >> I What about autism here? Right. FTX SBF has some fraud issues but don't give money to autists.

Right. >> I don't pretty well with Elon Musk man. Right. Like if you were early in a lot of a good pretty >> like I I guess if you run quantitative strategies then it works because then you're an autist at two sigma and Jane Street and Citadel give those autist money but discretionary autist they wholeh hog the position they get to a conclusion they can't let go of it. It's it's the wrong kind of uh non-neurotypical. Right, wrong, you want to give your trading money to psychopaths. All right, so before we go down this rabbit hole any further, why don't we do our second ad break quickly and we'll be right back to talk cold card.

>> If you hold crypto on your phone, your biggest vulnerability isn't your wallet, it's your carrier. AT&T, Verizon, and T-Mobile have been breached again and again, and SIM swaps are still one of the easiest ways for attackers to drain accounts. That's where Cape comes in. America's privacy first mobile carrier. Same premium service, but Cape rotates the identifier on your SIM every 24 hours, deletes your call and text metadata after a day, and protects against SIM swaps with a 24word recovery phrase that only you control. You also get two middle to end encrypted secondary numbers for banking and signups, so you stop handing your real

number to every app that asks. Go to cape.co/chained and use code unchained for 33% off your first 6 months. Heads up everyone, we've now fully transitioned Bits and Bips to its new dedicated channels. So, if you're not yet subscribed to the new Bits and Bips channels on X, YouTube, Spotify, Apple Podcast, or wherever you get your podcast, go there and subscribe now. For the next few weeks, we'll play segments of the full interviews on Unchained as a reminder. But for now, you'll only hear those short segments of Bits andBips on Unchained. No more full episodes. You can get links to all of the dedicated channels with the full episodes at unchainedcrypto.com/bitsandbips

spelled vips. Thanks again. >> All right, everybody. Welcome back. It brings me absolutely no joy to introduce our next segment, which is cold card and self-custody. So, cold card was a hardware wallet largely marketed in some places as the gold standard in the Bitcoin ecosystem and it had a deep systemic flaw. So, an exploit tied to entropy, aka key generation, uh, cold card Mark III, MarkV, Mark Five, uh, had Bitcoin drained from, I believe, well over a thousand wallets at this point, and the

reported total has been climbing throughout the week, up up. Um, CZ via Zero Hedge said nothing is 100% warning Bitcoin holders after the exploit. Uh, we also have an expert who's been commenting on it extensively here, Alex Thorne, who Alex, I saw in Cointelegraph you said a fourth organized wave is likely in progress. 208 transactions across some specific blocks, sweeping about 389 Bitcoin from 462 suspected victim addresses in roughly 2.5 hours. Um, human cost is real here. Good example, the retail bull

had said, "I've had all my bitcoins stolen while away on holiday. It was on a cold card Mark III. I was led to believe this was really secure. The two Bitcoin was supposed to be to give to my two children to give them a good start to life." And the ETF crowd has been speaking up here. Um, Eric Balanchuna said, "Such an intermediary upgrade for Bitcoin. safer, more secure, and almost always cheaper. Speaking about ETFs, 33y old industry, 15 trillion in AUM, and never once lost someone's money. So, I could go on and on about this, but Alex, you've been observing the whole thing. Could you

start by telling us like the core of how did people get this wrong? Why was all this money sitting out there in a way that it could be stolen? Yeah, it's it's been a brutal four days. This sort of started early in the morning Thursday UTC time. Um, and is still ongoing. So, before I even go, if any viewer or listener has funds on a cold card in a single signature uh address, as in not part of a multi-gorum, you should move those coins off as soon as possible. Um, and I, by the way, I I like Eric Valunis quite a lot. Um, but I, you know, obviously an ETF holding a DTC registered stock inside it is not the same thing as one

that holds a digital bearer asset. But we move on. I the saddest part is that to your direct question, Austin, um, these people did nothing wrong. In fact, they did everything right. And the the cold card itself is very popular among um a cultural demographic in Bitcoin that believes in cold storage, self-custody, stacking SATs, working hard. You know, not that anyone deserves to have their money stolen, but this isn't a a drain of a DeFi bridge uh where you were, you know, bridging between, you know, Ethereum L2s to harvest, you know, uh altcoin inflation yield, right? This is not people speculating on crypto exchanges on meme coins, right? These are people by and

large and I can tell you I know this community quite well that are working hard and saving and stacking SATs and then putting them away for a long period of time. Uh the average dormcancy of coins that has been siphoned like almost four years. So these are not like short-term holders. um that makes it particularly devastating because they did nothing wrong. To your point, just to underline it a little bit um of how this happened. Um when you generate cryptographic keys, you need entropy. Um you need a random number generator to seed uh the key generation with randomness, which is what makes it difficult to brute force attack. Um, and Cold Card had updated their firmware on

March 17th, 2021 to add their own version of a random number generator. And it's not even that that version wasn't good. They miswired it into the firmware. Um, and such that it would it would fail. It it would never be routed through that random number generator and it would fail silently and it would backfall to this other crappy random number generator that has way too weak entropy uh to create secure keys. That means that attackers with compute that know this vulnerability can go and use that random number generator that it did end up using and compute billions of public keys. Then go and and private keys seeds, seed phrases and then derive

the public keys across the whole derivation space and then go and see if any of them have coins and if they do, bam, submit transactions to move those coins to new locations. It's it's the worst type of attack. These people did not accidentally drop their hardware wallet on the ground or post their private key in a chat. They didn't even click a link, a fishing link that siphoned their MetaMask, right? Like so many that we see. Um I think that's what makes it particularly devastating. Um you know, when compared to other hacks, all of which are devastating, but this is really not supposed to happen. So to unpack this one, the problem here ironically had nothing to do with

Bitcoin specifically. This was a core like cryptography exploit where you had a poorly generated at best pseudo random function to create your seeds and as a result of that whatever was secured with that cryptography could have been hacked. So if this had been for instance a I don't know email provider using encryption instead you would have been able to get into everybody's email. Correct. Like this is not a problem unique to blockchains. It is a cryptography problem.

>> Yeah. Absolutely true. And and not Yeah. Not only not a Bitcoin problem. Um could have been an ETH or Solana problem. And to your point could have been you know an encrypted zip file problem or any type of uh key generation. And and the the worst part is it's not even really even the crypto the software and the firmware just failed to route the keychen through the number random number generator. This is not the first time that we've seen random number generator problems even in crypto to be clear. Um I think one of the other things that's so astonishing though is how popular this hardware is. It's great hardware to be clear. Like they also make the block clock and the open dime extremely popular Bitcoin native hardware. Um but this this is a software development

failure that somehow went unfound for five years. It probably was found with the help of AI. Um people have proven now that now that it's known that AI can find it. Um but it didn't need AI to find this is there was simply not enough eyes on this codebase. Um there were obviously issues as well with the codebase. It was not fully open source. Um, and when you look at the codebase, there's, you know, hundreds of commits right to the master branch with no comments, right? Like, so it's doesn't seem like it was properly reviewed either. Um, but just for some numbers, you know, I'm not an expert in I'm not a software developer. I'm not an expert in

cryptography. Um, and I'm not an expert in um, this type of computation to derive these seeds. U, which is what the attack is. I am an expert in onchain forensic tracing and that's what I've been doing. I've been following the funds here and trying to identify victim and and attacker addresses and along with helping victims if they reach out to me also submitting uh those addresses to relevant US federal government uh law enforcement crypto exchanges, crypto iss um all of the relevant cyber investigators to try to make sure that these addresses get flagged by chain analysis at TRM labs and Elliptic and all the exchanges so that if they do

appear at a centralized intermediary, there's a chance of recovery. Um, it's quite interesting. This started, you know, we've I've got three defined waves, we call it, wave 1, wave two, wave three. Any prospective wave four, which is still sort of in the medium to high confidence. I haven't actually promoted into what I'm considering a high confidence part of the attack. That's one reason, by the way, why it's so difficult to trace. Not because it's Bitcoin specifically, but because these are like thousands of previously unconnected cold storage addresses. You know, if a bridge gets hacked, we go and look at the smart contract address and we see all the funds flowing out of it and we see where they go. this to to actually gather and find all the

examples of people's cold storage addresses being siphoned, we basically have to rely on patterns of attacker transaction patterns and victim reports. And so wave 1 uh which started just after midnight UTC on Friday on Thursday morning, July 30th, was really identified by victim reports around the uh community and then the pattern described and identified by engineers at Block Inc. right? Which Cash App, Square, the Bit Key, um those guys, brilliant engineers there who have their own hardware wallet, the Bit Key, they identified the transaction pattern that then I extrapolated to go find the totality of wave 1. We have I've since talked to dozens of victims who are

confirmed part of wave 1 and that those victim confirmations are sort of how we verify that our pattern analysis is accurate. >> Hey, Alex, can I ask a question? Um, wave 1 through four, same attacker or people piling in and saying, "Oh, I found an exploit." >> Yeah, so wave one is like a bunch of um obviously seeds broken and funds transferred in bulk into one or two collector addresses and then one or two attacker holding addresses and they're sitting there inert. Wave two is a very similar topography. Again, tons of confirmation from victims in waves one and wave two. So, we're very confident in that set. Wave three has a totally different topography. It a very internally consistent one. So we think

it's each of these wave 1 and two and three we're confident um are waves. Um wave three though rather than siphoning many users into one big address which is sort of what one and two do. Wave three has one uh victim per vault storage by the um attacker. So it's like if my 10 addresses all get siphoned in one transaction, they stop at one spot intermediary that's just for me and then they go into one vault that's just for my funds and they're all So there's 293 victims we think and there's 293 vaults.

So I don't know if one, two, and three are the same. I if I had to guess if there is any overlap, I would say one and two are probably the same. Um one and two comprise like 70 plus% of all the funds we think have been stolen. Uh three has a bunch. two. If it if three is the same as one and two, then the attacker demonstrabably changed their operational um process. Wave four is still not totally confirmed. I don't actually have victims yet that I can confirm are in wave four. Wave four u I identified solely by a burst pattern.

Think about the pattern we're looking for. the the addresses have to have been funded and created after the firmware upgrade on March 17, 2021. They likely are dormant for a while in general because again, these are long-term holders. They're fully swept. They're swept with a fee that typically most of these patterns um have dramatically exceeded the medium fee rate, right? Attackers, they'll overpay for fees to get the the coins and they have other transaction fingerprints. I saw all of that at the chain tip last night. Um, and in the me pool and that's why I flagged that. You know, it there can there definitely are some false positives in there. Um, we need some victim reports to really help us

confirm. The last thing I'll say, which I haven't yet really reported, but I will um on X sometime tonight, there are like 14 other identifiable patterns that we have found that do not appear related to any of those waves, but do have verifiable victims identified because victims have come forth and then I've looked at the patterns and behavior of their attackers and found several others or at least one other, right? So more than one instance, you know, those are literally footprints A through L that I'm calling them at the moment. I think N actually now um those have crept up the count. While we may not be able to yet extrapolate like a giant amount to

each of them, um they are confirmed victims. And so um you know, we've been saying I think the last numbers we put out were near,400 Bitcoin yesterday at the end of wave three. If you add the amount, um, you know, we're saying maybe two or three, I think three or 4 hundred in wave four, but I'm not adding that yet. I really do need confirmation. And I encourage victims to DM me on Hex. I've been diligently helping people for several days now, not just cataloging it for us, but providing back basically wholesome chain analysis style reports that they can use to report uh to authorities. Um, but I I have it now at, you know, if we include wave four, we're almost at 2,000 Bitcoin. So, we're well

over a hundred million dollars of self-custodied Bitcoin. Um, even without wave four, we're over hund00 million. I would place it more in the 1,600 BTC range. Again, for a distributed self uh custody storage hack, that's unprecedented as far as I'm aware. Um, quite devastating. That's awful. Um, the thing that jumps out at me is that, you know, we operate in this trustless, permissionless environment. And the problem was is that as as trustless and permissionless as you try to be, you have to have trust somewhere.

And they trusted Colt Card to do the right thing. And that's where everything broke down. And so, it's really, really hard. Um hopefully, you know, there's some good things that come out of this, which you hate to even emphasize right now because it's so terrible, but you know, Alex, you're very much in the Bitcoin world. If a high level of of compute allowed people to derive seed phrases, to me, this is a precursor to what Quantum could do, not only in Bitcoin, but across, you know, all of financial services and beyond. So maybe this is a wakeup call um you know for the community to really focus on these high compute threats. Um >> yeah you agree with that?

>> Um I do. I of course the threats are a little different. Um yeah but you know they're they're not they're really not that different right? I mean, if you had substantially, you know, um, industry standard entropy, you're not affected here, but you could be, you know, because the world's GPUs combined probably couldn't break it. But that, you know, you're talking about multiple step function increases in the case of quantum. They might be able to derive uh seeds across that whole space. That's the fear. Um, I think this, you could call it a trial run perhaps if quantum does emerge. It wouldn't look that different, right? Because the attacker, this is one thing that's going to be tough with the recovery if it can happen.

>> How does the victim prove their ownership, right? Like >> um the attackers have their keys, right? So it can't be solely via cryptographic proof. Um that's why we're encouraging people to make um >> uh you know wholesome formal victim respon uh filings and reports to FBI's, IC3, their local police to establish their victimhood and keep the cold card device. don't use it necessarily. Don't use it, but keep it because it could be evidence that shows that you did act you actually were the one that first had the keys. Um, you know, I think another point worth raising is that it it's not just the cryptography or the generation of the keys that's an issue. Um, AI is

of course across other domains as well are finding substantial codebase issues all over the world right now. there's a red team uh of Bitcoin security engineers working as we speak and for days um unfortunately forced to use like Kimmy and GLM and not Frontier US models which won't allow this type of cyber work um literally going over every hardware wallet codebase every open- source library that's used in crypto and in Bitcoin fulsomely to try to uh patch and and you know fight back against what is becoming an increasingly dangerous threat environment um that work is ongoing. I think you will you may also see that some of the coins that I've labeled as stolen may end up having

actually been rescued in a white hat effort. Um again because the vulnerability is so well known uh at least since Thursday and there are quite a lot of people with compute these days at their fingertips. Um I hope that's the case. It's going to be messy. Um, but you know, I think the other one last part here, Chris, sort of goes to your question is like, but I know the the whole group here has probably thought about this. Um, and and I will say that red team has looked at the code bases for all the other major hardware wallets. None of them have this uh this this vulnerability. It doesn't mean, you know, I can't tell you they're all 100% safe, but they are not affected here. Um the damage to self-custody though

because these are some of the most principled self-custody >> coiners. Um you know they chose cold card some of them chose cold card over ledger or treasure because those two support altcoins and they don't they don't want those. I think one thing to know about is that cold card ultimately was relatively niche hardware and firmware. And if you're building cool niche hardware, like you better be using widely adopted open-source software for the firmware. I think that this is where the the bug was introduced was when Coin Kite basically rejected some of the open- source software and started building their own. So I I think this can damage the narrative at a minimum

for self-custody uh for at least you know among the most ardent people um and push more into ETFs and on exchanges you know you've seen one of the largest flows of you know off off exchange bitcoin back into exchange uh I saw 22,000 bitcoin uh sonni from time chain index uh posted since Friday and cryptoquant said the largest influx of sub1 one BTC transfers into exchange over I don't know how many years, right? People are fleeing. It's the opposite of FTX. They're fleeing from self-custody into exchange. Um so that's going to have repercussions over the long term as well.

>> Yeah, I even saw Munib, founder of STAX talking about, hey, diversify your custody. You go into ETFs. It feels to me like we're in this max period of AI threat, but I don't know about you guys, I think AI over the medium term is going to be actually very very good for security once we get through this little hump because once these vulnerabilities are solved, they're solved. And I feel like, you know, I was watching um Face the Nation today, like polit big political I was watching yesterday, big political show obviously, and they had the the founder of Hugging Face on and he made this point, you know, despite the fact that that rogue agent started going nuts. He's like, AI is going to be the biggest asset for DeFi long term. We

just got to get over this hump is is my take. And uh yeah, >> well, >> I think that's right. So, let me ask I know Alex you have some views on this. I suspect Rob will have some views on this as well. In the current state of AI, is it being more or less helpful for attackers versus defenders? Because one thing I've been observing and had a few people talking to me about today is ironically some of the guardrail training on some of the USIs are actually frustrating the efforts of defenders in this case. Alex, what you can see in there?

>> That's absolutely right. Right. I can tell you the red teams that are literally objectively evaluating these code bases. They're not trying to create exploits, right? But they're doing, you know, I I understand how uh, you know, an objective robot, uh, Clanker mind might think that it is. Like, I get that. They're all using Kimmy and GLM, literally open- source Chinese models. The frontier models are not available to them. Even when I traverse my own Bitcoin analytics stack, I'm not going out onto the web, right? I have a 3.7 billion row 1.7 terabyte Postgress database of every every coins's movement in the history of Bitcoin every change to the entire state and I ask you know Claude Fable 5 to go and you know pull

some data from me half the time it I get cy safeguarded right just to look at my own data on my local machine right so um and this is to your point about the hugging face co is exactly the same thing that they faced when the open AI lab leak happen. So I I don't I don't have a great policy answer to this at the moment. I just know that on its face it's absurd that American, you know, companies and victims are having to rely on Chinese AI models. That's insane. >> Yes. >> Well, just on your policy point, I think the line between defender and attacker needs to change as well. Like I've been pushing this for how many years now? We need to go on offense. And the thing about clarity, which is making me crazy

right now, is that there is a rewards for justice program. Finally, we can permission white hackers to go on an attack. Going back to the early days of our constitution and privateeering, you know, we have to have a much better policy response. Like people cannot this this is illegal. This is like no different than someone going to your house and stealing your car or robbing your house. And like just because it's crypto doesn't make it any better. Like it's like so we do need a much better policy response across the board. Rom >> I like Austin you're the way you pos that question is super interesting like does technology favor the attack or the defense? Most of the history of technology is that it favors the attacker. You know you've seen this with

stuckset and neuron. You've seen this with the development of u you know aircraft. Um so many forms of technology favored the attacker. the defense that you have to cover is simply too broad. The fact that the United States has two oceans on both sides has been an incredible benefit. There's just too much to protect and defend and insulate and inoculate. So, it goes towards the offense. Um, it is a shame that we don't have an open-source American model yet. You know, China's got several and they're impressive and the VCs don't want to fund an American open source model, which I also can't blame them. I can't blame them for that. Where's the value capture around open source?

>> I mean, this is one of those what's the right way to say that say this is it's a public private coordination problem. Open-source models are in many ways a like public good a little bit like a park. Everybody benefits from them, but nobody individually has much incentive to fund one unless it's purely charitable giving. I think China having to play from behind on the hardware and original development front took a very different approach here because now you're playing like a call it multi-olar competitive threat game which is very different than just looking inward and figuring out what you'd fund. I feel like an openweight model is the sort of thing the government should be looking at. You

know, Department of Defense this seems like a pretty mainstream DARPA sort of thing. There are definitely levers that we could have to pull, but we are just not doing it in the United States. And like even today, as I wanted to get up to speed just to have this discussion with Alex for our segment, Claude is guardrailing me and I end up using Quen. What does that really say? Like I'm an American citizen here, guys, right? Is this not the circularity? So, Alex, I want to come all the way back around to a point you made at the start because for me, this is probably the hardest part of where this goes. And I'm curious about everybody's views here. Is it I don't have a good answer on the

self-custody thing right now. Like, if my mother, if my father, if my friends are asking me what does this mean, how could I have protected myself? My answer is I don't have an answer for you. And I think demonstrabably, especially after this hack, right, I agree with your commentary on Eric talking about tokenized stocks, but as of yet, the track record of things in MPC institutional custody at regulated places is significantly better than self-custody funds. So, what does that say going forward for Bitcoin with where we are?

Uh yeah, I mean most of the time that people uh lose self-custodied funds, it's because of fishing attacks on them or their own mistakes. And I do think, you know, there's that old, you know, would you have your grandma use a hardware wallet or just tell her to open a Coinbase account? I think most people really truly would have them open the Coinbase account >> uh for, you know, or or get the Bit Key, which I I've actually I think was the first hardware wallet I ever even considered suggesting to like, you know, older family members. I will say that multi-IG collaborative custody in Bitcoin like provided by Casa, Unchain, Nunchuk, Lana wallet, Anchorwatch, others uh remains incredibly secure and there is support uh to help you use it.

Um you know because it diversifies among many hardware wallets. Not really that complicated. Still probably too complicated for grandma. Um but I I think you know so so it is possible. It still is possible. I'm, you know, I'm like, uh, Jordan Belelffort, like we're not effing leaving yet from the self-custody trade. I know I'm not. Um, but it is very problematic and I think, you know, you've already seen an enormous amount of coins flow into the ETFs and, you know, let alone MSTR and people getting exposure through centralized means. And that's fine. You know, I think there's been a wing of the Bitcoin community that has, you know, looked down upon those people like with a purest mindset as if they're not, you know, true Bitcoiners. And, you know,

they might not be as much a Bitcoiner as you if you're rolling a hundred dice to introduce your own entropy into your cold card, you know, MK5. Um, but that's okay. That is okay. You know, this is your money. If you don't feel strong that you have the uh education and training to do self-custody, um don't and don't feel bad about that. I think it's totally fine. You know, I use River.com all the time as a Bitcoin uh exchange. It's a great Bitcoin brokerage. Um I've got accounts at most of the big exchanges and custodians. I bought and held Bitcoin at Fidelity Digital Assets. You know, I own ETFs, right? So, like all of that is fine. I think you I think in the near and medium term you absolutely are going to

continue to see uh people move towards those and I and I agree. Look, they have a a checkered history crypto exchanges of catastrophic failure. Um but again, it's sort of like the nuclear uh power plant thing. You know, was Chernobyl a nuclear power plant thing or was that Soviet mismanagement? Was FTX fundamentally like a crypto exchange thing or was that a criminal named Sam Bankman Freed? Right. I think I do think with strong regulation and oversight and industry standards, centralized intermediaries can be very safe and are are demonstrabably very safe.

>> I have to pile in on the regulated front, the one area where FTX had a truly regulated subsidiary, which is FTX Japan. They didn't lose any money, >> right? >> US2 or Ledger X. Do you name any US? >> Yeah, Ledger X. That's a great call. And by the way, on the ETF front, like Chris, I'm just shooting from the hip here, but Easy BC, do you know anything about that thing? But I was going to make the point like, have you lost any Bitcoin to this hack? >> Personally, no. >> No. Well, no. Franklin, right? Like, >> no. No. No. So, like I think the point is, and I think Eric Baltun has made it, um, look, we've said this over and over and again, um, you shouldn't be forced to use an intermediary. I think we all

agree on that. >> Yes. But I think we also agree that intermediaries do deliver certain value and there's going to continue to be a desire to use intermediaries by certain parts probably the preponderance of the population because you get value added services. Um and so like you know DeFi maxis can be DeFi maxis but remember like what did we learn? you're still placing trust in something or somebody even if you're trying to be, you know, self-custody. You're you're trusting that software. You're trusting that provider. You know, I I I I tend to hope that Alex is right. And these NPC players are are secure, but you're trusting them. So, um you know, you have to choose at the end of the day who do

you want to trust? Do you want to trust an intermediary that's well capitalized? Do you want to choose an intermediary that's insured or not? And I think we all agree on this, you know, because we've been in this space for so long. The government shouldn't tell you what to do. You should make that choice and it should be an informed choice. >> Yeah, I totally agree. And it's not just like the random number generator in this hardware wallet. Like you are trusting making different trust assumptions depending on how and where you store your coins, >> right? Like it it's true that at a centralized intermediary, they could have a catastrophic failure. It's also true that even if the random number generation and key generation in a hardware wallet's great, they could have a different error, right? So, I mean, this is one reason why if you one reason

why me personally, I I'm not in the business of recommending uh ways to store Bitcoin, but um I like the multi-IG collaborative custody where I hold some keys, a a vendor that I pay uh holds some other keys and that gives me some peace of mind. I can lose a key or two of mine or they can go away and I can restore they can't you right to me and by the way this is I think as we know this uh fundamentally is the way that regulated custodians basically also store which is with multi-distributed multi-IG setups um that they those are available to individuals they still may be too difficult for you and that's okay >> yeah last point if I just make one more

point so we're in this institutional age of crypto. And when you unpack the institutional mindset, it really comes down to one thing. I want a throat to choke. I want to be able to sue somebody. That's what they'll tell you over and over again. I don't care. Like I need somebody who's capitalized that I can sue and and I think there's value in that for many institutions. Um so that's my last point about this se segment. >> Yeah. There are not institutions that are single sig cold gold card. Well, that is not a thing. We hope >> and very few I would say Fidelity and Coinbase I think are the and maybe uh I guess Pico doesn't have an ETF. Fidelity and Coinbase I think are the only two

ETF uh because well Coinbase doesn't have one either. >> Gemini >> Je well they don't have an ETF though. I guess Fidelity is I think maybe the only ETF that is self-custodying but of course they themselves are an institutional custodian using all the sort of same principles as the coin. So most are and and I think at this point many if not most of the major Bitcoin ETFs in the US are using multiple custodians um for this reason again. So everyone's sort of making that same point and I think you know again we don't go I typically do not go to you know defined uh contribution or defined benefit plans or high net worth individuals or liquid funds or family offices and suggest even that they self

custody coins. Right? that we're all suggesting qualified institutional custodians. >> So another point that I would like to make here because I've given this advice to my students actually about US regular way bank accounts is the only free lunch in finance is diversification. And what I mean by that is always have multiply redundant options. Don't leave your stuff in one place because things that have nothing to do with you can break your [ __ ] if you do that. If you only have one bank account and your bank goes bankrupt or something gets hacked or there's some sort of fraud that you had nothing to do with, which totally happens due to things like account compromise, all your money can get

bricked until that gets fixed. You should always have a backup plan. It's probably not a bad idea to extend that thinking into crypto, right? Like everybody, you're going to need to decide on your own personal situation, but I do not have all my Bitcoin in like one single ETF. I have it spread out amongst for exactly this reason. >> Yeah, I think Giannis uh not going to try his last name. The NBA superstar >> Jiannis from Greece, right? >> Thank you. Uh he he said in an interview once that he has his literal cash in American banks spread across like 50 banks. Yeah. He comes from a unique, you know, Greece has a unique history with banking and haircuts, right? like, you know, the Cypress haircuts are literally

why like the Wlvoss twins got excited about Bitcoin. Um, so I mean that's an extreme example, right? But I I agree. I think it's great advice, Austin. >> All right, so final point on something that requires trust before we run out of time. The Fed. So FOMC kept rates at 3.5 to 3.75. The vote was 9 to3 uh with three people dissenting. Um Qashqari spoke publicly about his saying data center investments have added a new demand element to inflation. I would rather tighten policy incrementally as we gather more data. Uh the long end's not thrilled here. It's pushed up into the 4.7s at the 10-year point as I

talked about. We're going to pretend the 30-year is not looking even worse. Um and Lyn Alden said bond bulls don't make arguments for why deflation is coming anymore. They just look at Wsh like this now and included the amazing meme from the whale. So, Alex, while we've got you here, I know you talked to your friends at Galaxy about this frequently on your own podcast, but what are you making of the rates environment? >> Oh man, it's the market. They're letting the market uh try to do it for them. Um, I think that's there is no more Fed put, right? I mean, that that's sort of the obvious empirical consensus. I and are we in an era now of I mean I'm I'm

starting to feel like this is a a parliament at the Fed voting uh you know with many different ideas. I think it's a very uncertain rate environment um is the simplest way to say it. You know I declined not just for this reason at the end of last year I said I was refusing to make a Bitcoin price call for this year. I'm quite happy I did refuse. I have to say I said it was a very uncertain investing environment. not just because of AI but or macro or the Bitcoin draw down and the crypto bare market but also because of rates and and to me you know I'm a an observer but a relatively novice one but um I I I don't know what to say here exactly and did you see um Scott Bessen's photo of the

uh >> buying JPY and and and Trump said on Air Force One that uh why are we doing we really love the Japanese they've been really great to us except for that one time about Pearl Arbory. How to throw >> Yeah. And we're selling the euro, too, right? >> Yeah. Yeah. I mean, I I think it's um it's a very tricky environment and so far uh it looks like we're kind of getting less information from Wars as now is pretty clearly expected um than when we're what we're used to and so the market has to react on its own. >> It may be healthy. I mean, it ultimately that may be a healthy option here. You know, I I tend to lean free market and you know, I am a Bitcoiner. I am I would say my sort of base position is to be a

critic of the Federal Reserve. Um I I think that this is in some ways although not necessarily the ones that matter to you, you know, your pocketbook right now, you know, a little bit healthy to have the market sort of drive the rates a little bit more than the Fed. But um again, I'm not an expert in that. That's just my sort of sense. And >> for years, the yen carry trade like really was one of the foundational parts of markets. We saw it, you know, we saw it get shocked um some months back. We saw markets puke because of it. I'm just hopeful now that traders are realizing that that's not here to stay forever. Uh and that they'll and that they'll adjust. That said, the Secretary of the Treasury wants to keep rates low. It's

very much on his mind. We're also seeing more power move from the Fed to the Treasury. We've known this. And um look, if there's anyone who understands currency markets and uh it's our current Secretary of the Treasury. Um you know, he was on board when they broke Bank of England. So I think he he knows what he's doing. Let's see how he plays it out. But um yeah, it's how do you keep rates low? How do you stabilize and not shock markets through an abrupt uh unwind of the carry trade? And uh how do we stay uh onwards and upwards? I like Kevin's message creating accountability for the Fed. He's right to point out that the Fed has missed its end. We've been well above 2% for over

five years. So, he's saying the right, but he's not really cutting rates. The bond market is doing the work itself on the long end of the curve. Um, on forward guidance, we'll have to see how this plays out. This element, I'm not sure, right? because you may have other Fed members that do in if Kevin Worsh uh provide less feedback, right? The the market's going to make a reaction function for the Fed anyway, even if it's imperfect.

What used to happen before forward guidance I remember this distinctly go to these conferences there'd be some connected party that knows someone at the Fed or in the F and everyone would gather around the the fireplace and they would tell the story about how they're reading the tea leaves. It's kind of similar to the world before FD before the REGG FD buy investors who have access to sellside analysts and could front and run research and exploit take advant >> all right >> the is that people have privilege access have an advantage over other investors >> so Rahm thank you for closing us out

I've got to stop us here because we have a couple of hard halts at 5:30 today so For everybody listening, remember to subscribe to the new channels. Thanks for joining us for this episode of Bits and Bips. Special thanks to Alex for joining us to discuss these topics today. We appreciate it, man. And for everybody else, we'll be back in one week to discuss more about how the worlds of crypto and macro are colliding. Until then, thank you for watching and hope you enjoyed this episode of Bits and Bips. Just remember, nothing we say here is investment advice. And please check unchanged crypto.com/ bits and bips for more disclosures.

Hey, hey,