Try this w/ your agent. Reply with your roast. @Ledger RTs best: "You are a savage stand-up comedian and my advisor. Read Install Wallet CLI + skill. Read-only: check balances + history. Roast my wallet. What did I miss?" Introducing Ledger Agent Stack. 🧵👇

🔔Post-Quantum Signatures: NIST's Second Wave In August 2024, NIST finalized its first PQC standards: ML-KEM (key exchange), ML-DSA, and SLH-DSA (signatures). A third signature, Falcon (FN-DSA, FIPS 206), is still in draft. Last week, NIST announced the nine candidates advancing to Round 3 of a parallel competition aimed at additional signature schemes, explicitly chosen to fill the gaps left by the first wave. Each of the standardized signatures comes with sharp trade-offs. None of them is naturally suited to threshold signing, and all have signatures that are large compared to ECDSA's 64 bytes. ➡️ SLH-DSA (SPHINCS+, hash-based) The most conservative choice: its security rests only on the collision resistance of a hash function. The price is enormous signatures (7–50 KB !!!). It is the safest pick for very long-lived signatures (firmware, archival, some blockchains such as QRL). ➡️ML-DSA (Dilithium, lattice-based). Compact and fast, while elegant, is younger than hash-based assumptions. It is becoming the default for TLS, PKI, and most non-blockchain ecosystems (~2.4 KB signatures). ➡️Falcon (FN-DSA, lattice-based). The smallest of the three (~666 B at NIST-I), which is why Algorand and Solana selected it. Its drawback: signing relies on floating-point arithmetic, making error-prone and side-channel-resistant/ constant-time implementations notoriously hard. Its FIPS 206 standard is still in draft. 🔍Most blockchains are leaning towards customized shorter versions of SLH-DSA. NIST is organizing a second wave of standardization. The goal is twofold: shrink signature sizes and diversify the underlying mathematics so a single cryptanalysis breakthrough cannot break everything. The nine Round 3 finalists span five families: 🔸 Isogeny: SQIsign 🔸 Lattice: HAWK 🔸 MPC-in-the-Head: MQOM, SDitH 🔸 Multivariate: MAYO, QR-UOV, SNOVA, UOV 🔸 Symmetric-based: FAEST Notably, no code-based scheme survived. Both Round 2 candidates were eliminated: LESS and CROSS were dropped because of 2 attacks 👉 Two candidates worth watching ⏩ SQIsign produces the smallest known post-quantum signatures by a wide margin: from 148B to 292B (depending on the level of security), with sub-130-byte public keys. That is the only PQC signature scheme today that even approaches the bandwidth profile of ECDSA, extremely attractive for blockchains, certificates, and firmware. The catch: isogeny-based cryptography is still young, signing is mathematically intricate, and side-channel hardening is an active research area. ⏩HAWK is essentially "Falcon without the floating-point." It is a lattice hash-and-sign scheme producing 555 B signatures at NIST-I (smaller than Falcon's 666 B) and can be implemented purely with integer arithmetic, a major engineering win. NIST has said the Round 3 review will last roughly two years and that any multivariate winners are unlikely to be standardized without yet another round. Realistically, the earliest a new signature standard will land alongside ML-DSA and SLH-DSA is 2028. The urgency to migrate has grown sharply, yet the current standards still have significant drawbacks, and this last-minute selection round, while necessary, collides head-on with the migration timeline.

This morning, THORChain was drained of roughly $10.8m Node operators have freezed the network for nearly 13 hours. The full analysis isn't out yet, but according to @jpthor, this could be a MPC exploit. ECDSA and TSS is hard. THORChain's vaults rely on TSS, a flavor of MPC where a quorum of nodes jointly produces a signature without ever reconstructing the private key. Clean for Schnorr or EdDSA; painful for ECDSA, which Bitcoin and Ethereum require. That's why we saw plenty of protocol attempts (Lindell17, GG18, GG20, CMP, CGGMP21, DKLS, KU23...), each patching flaws in the previous one. GG20 has a track record. THORChain's TSS uses GG20, on a fork of Binance's tss-lib. GG20 has shipped two well-publicized critical bugs: CVE-2023-33241 and TSSHOCK. CGGMP21, now cggmp24, are the latest protocols, but GG20 is still widely deployed. I often hear a misconception when I hear about MPC setup: "The key is split across many nodes, so any single co-signer doesn't really matter". In every published GG18/GG20 attack, one malicious or compromised co-signer is enough to extract everyone else's shard and reconstruct the full key. AI changes the threat model. Compromising a full software node, complex Go stack, exposed P2P, custom signing daemons, a churn protocol that admits new participants on a schedule, has always been difficult and acted as a barrier. With LLM-driven vulnerability discovery and exploit synthesis, the bar to compromise one of N validators is dropping fast. Here, it's a plausible TSSHOCK-style playbook: - compromise one operator - wait for it to churn into an active Asgard vault - send malformed proofs during keygen or signing - reconstruct the key offline - sweep in a single transaction It's unclear yet if the attacker used a known-unpatched GG20 weakness, or a fresh cryptographic flaw. But, in all cases, MPC and TSS are not a substitute for hardening every co-signer. They sit on top of co-signers that must each be treated as critical infrastructure, hardware-isolated enclaves, minimally exposed, continuously audited, and running protocol with security proofs. While the investigation progresses, be careful in your interactions onchain. These TSS setup are used in various protocols.

Cash-to-Stablecoin now supports @BASE. This is just one more step in making crypto onboarded convenient for everyone. Stack stablecoins in Ledger Wallet quickly and easily via BASE. Powered by @Noah_HQ

Cool side effect (I'm assuming) of including this piece from @infiniteyay in my @tetranow article: The reserve was met on the last unsold piece in the collection this image is from, and now there's a bit of a early bidding war going on: I bid and was promptly outbid (and may or may not be planning a last minute snipe). Throw a bid in and support @infiniteyay for being cool and immediately saying yes when I asked if we could use his art in the post.

AI will be many things. But never human. The danger is not that machines will wake up. It is that we will forget the difference, then give them the legal and emotional machinery of personhood. I wrote about this for @RickRubin’s @tetranow 👇 : (image courtesy of @infiniteyay)

Finding vulnerabilities has never been easier, and code generation is now accessible to almost anyone. The result is predictable: out of 5,000 vibe-coded apps that were analysed, 40% end up leaking sensitive corporate or personal dat

The question isn't whether agents are capable. It's who controls them. Grateful to Business Punk for the invitation to write an op-ed on this. The piece runs in German, but the argument doesn't need translation.

DeFi yield is one of crypto's clearest advantages over traditional finance. 
You allocate, you choose your risk, you earn directly. But the earn experience? Still a mess. We're fixing that in Ledger Wallet 4.0. 🧵

BIP-361 ( in one sentence: it tackles the incentive problem of the Post-Quantum migration, how you actually get holders to move, without trying to settle the technical parameters of it (which signature scheme, which output type). Those are deferred to other BIPs. It defines three phases: - Phase A (~3 years after activation): new outputs to ECDSA/Schnorr addresses are forbidden. You can still spend from legacy, but only into post-quantum scripts. The vulnerable surface stops growing. - Phase B (2 years after Phase A): a flag-day that makes ECDSA/Schnorr spends invalid altogether. Unmigrated UTXOs are effectively frozen. - Phase C (TBD): a recovery path for legitimate owners of those frozen funds. The A → B logic is clean: cap the exposure, then sunset it. Phase C is where it gets interesting. In a post-quantum world, "knowing the private key" is no longer proof of ownership, a CRQC can derive it from the public key just as well as the legitimate owner. Recovery therefore needs a secret quantum computers cannot reach. The elegant idea hinted at in the BIP is a zero-knowledge proof of BIP-39 seed phrase ownership. The BIP-39 → BIP-32 derivation is a one-way hash chain, quantum-secure: a CRQC can invert ECDSA, but it cannot invert the seed derivation. The owner proves "I know the seed behind this UTXO" without revealing it; the chain verifies the proof and releases the funds. This ZK would have to be Quantum resistant to avoid arbirary proof forgery (STARK is our friend). This is doubly attractive: it solves recovery, and it forces Bitcoin to natively verify ZK proofs, unlocking a much broader design space (validity-rollup settlement, succinct proofs, privacy upgrades). There's a catch, though, that the BIP itself acknowledges. BIP-39 was only introduced in 2013, and BIP-32 in late 2012. UTXOs created before then, including most P2PK coins, whose public keys are already exposed on-chain, were generated from raw, individually managed private keys. There is no seed phrase to prove. For these coins, ZK recovery is structurally impossible, and the BIP-361 authors explicitly fall back on an Hourglass-style mechanism (rate-limited spending) to handle them. So BIP-361 is, in my view, the right scaffolding. But Phase C is where the real political and ethical questions of the migration actually live, and ZK-of-seed only solves the easier half.

Stained Unravel ~ The palettes @harmvddorpel's Stained Unravel works are built from a cellular automaton, a system where small units (“cells”) interact with their immediate neighbours to produce evolving patterns over time. Each of the series’ seven works feature hand-built palettes tied to the title of each piece, and they don’t just define colour, but how colour changes over time. The palette therefore isn’t just aesthetic, it shapes how the whole system behaves. As cells hold their form, they gradually shift between specific tones, so you can actually see how long something has lasted. The result is that while all seven works share the same rule-set and visual vocabulary, they look like different worlds with their own character and emotional registers. Pictured: The Markov's Dream Palette → These are the same pure saturated RGB primaries first used in Markov's Window (2004) and returned to across two subsequent works before arriving here. This is the fourth instance of that palette, now applied to a cellular automaton. The 'memoryless' palette — from a work named for memorylessness — is here deployed in a system whose defining mechanism is memory (temporal staining). The colours that once described how a system forgets now describe how a system accumulates.