Zach Herbert 🇺🇸
@zherbert
Cofounder & CEO @FoundationHQ. Building Human Authority Hardware for Bitcoin and more. Mechanical engineer, MBA dropout. Also tweets about health.
3.3K Following 12.1K Followers
‼️Is Bitcoin under attack?
.. and is Bitcoin Maximalism partly to blame?
In two weeks:
😱 $130M drained from @COLDCARDwallet wallets.
😱 Boltz shut off swaps indefinitely.
😱 BTCPay Lightning nodes swept
🤖 Volunteers are burning $10k a day on AI to scan the rest of the stack.
Joining us live to discuss:
Zach Herbert @zherbert of @FoundationHQ (which got one of its Lightning nodes drained)
Nick Neuman @Nneuman of @CasaHODL
Today @ 10am ET
Show more
BIG NEWS!
Foundation Passport Prime is coming to Solo Satoshi soon.
The next generation of Bitcoin security: wallet, keys, 2FA, files, and vault, all in one beautifully engineered device. Assembled in the USA.
We're excited to work with the entire @FoundationHQ team!
Show more
Your password and second factor shouldn't live in the same place.
How to setup 2FA on your Passport Prime from your google account, all offline. 😎👇🏼
Just spent a couple hrs stamping some new seed & passphrases, consolidated my UTXOs keeping my KYC and Non-KYC’d sats separated, all while keeping my BlockClock facing away from me 😬
Its kind of insane we expect normies to be able to do all this shit and not bail for the ETFs
Show more
Envoy v2.3.1 is now available! 🚀
This release focuses on bug fixes, privacy, and reliability:
• Activity-feed privacy for passphrase accounts
• More reliable Tor connectivity
• QuantumLink pairing restored on Android 10 and 11
• Passport Prime message-signing fixes
Details 👇
Show more
We are rebuilding our @BtcpayServer from scratch and continuing to use it on our website for Bitcoin payments.
It’s a wonderful open source project and, after researching the centralized alternatives, I was not impressed.
Show more
How many BTCPay lightning nodes were swept? Our Foundation node was drained overnight by attackers.
Signed. Crucial initiative.
Today, Bitcoin Policy Institute and a broad coalition from across the digital-asset ecosystem are publishing an open letter calling on the world’s leading AI labs to provide qualified open-source defenders with trusted access to frontier AI models.
The past several weeks have made the need for this abundantly clear. The people defending digital-asset infrastructure and open-source software need access to the latest AI capabilities to perform comprehensive security reviews and stay ahead of increasingly sophisticated adversaries.
The coalition includes open-source development organizations, major custodians, treasury companies, payment services, security firms, capital allocators, and others whose businesses and customers depend on the integrity of open-source infrastructure and libraries.
Open-source defenders often occupy the least privileged position in the AI security landscape. They have limited access to the strongest internal cyber models and are frequently blocked by guardrails when using publicly available frontier systems for legitimate security research. As a result, they often resort to less capable open-weight alternatives.
We are urging frontier AI labs to establish a clear, trusted pathway for qualified open-source and digital asset defenders to access their strongest capabilities, with sufficient compute and secure environments to conduct meaningful security reviews. Frontier AI could become one of the most powerful defensive technologies ever developed, but only if defenders get fair access to those systems.
It’s time to give defenders the tools they deserve.
Read the open letter, add your organization, or sign as an individual on our website at
Show more
Passport Prime is assembled in the USA!
That matters because hardware security begins long before you switch a device on.
Who assembled it? Who tested it? Who handled it before it reached you?
The reason is practical, not patriotic. When you’re building a device people will trust with their keys, you should know exactly where it has been and who handled it before it reached them.
With Passport Prime, we do.
Show more
LIVE: BFM273 w/ @FoundationHQ CEO @zherbert⚡️
"This hack has set Bitcoin self-custody back significantly"
We discuss:
🔸The industry’s rapid response
🔸FOSS vs Source available vs Closed
🔸AI changing cyber security
🔸Hardcore OPSEC vs happy path UX
🔸The future of self-custody
Show more
Excited to get my new Passport Prime device from @FoundationHQ.
Wholesome exchange. Bitcoin is messy. Consensus is messy.
I was trying to be realistic on it and pretty vocal that it would result in a fail to activate (or tried to be in terms of managing expectations).
Personally I like the direction though (cleaner chain, focused, filter the noise yada yada) so wanted to support it, and still do like that direction of focus and narrow scope, but the ecosystem has spoken!
I think it’s important to support things that you’re aligned with, even if it’s not popular. It’s a very easy option for me to think ah this things dead, I’m not staking my reputation (don’t have one but you know what I mean) on a failure. Sort of like lawyers taking cases that they know they win to preserve their hot streak.
I do like Bitcoin to be focused, and support that, but you have to go with the flow and not be bitter and dig your heels in if you lose (e.g BIP-110) as it isn’t the most constructive path forward and doesn’t add heaps of value.
BIP-110 failed and I think the best thing is to take stock in what new info was gained, to then explore how the chain grows moving forward!
Not sure if that answers your question, but it’s a lens into the view from a supporter of BIP-110!
Cheers dude!🍷
Show more
This is a travesty. We need to be able to use American frontier models for hardening our code and defending against cyber attacks and exploits.
If we don’t open up the tech to the good guys, then the bad guys will have the upper hand.
Show more
Yesterday I began fully integrating the @OpenAI trust cyber program into my Bitcoin Red Team efforts.
This morning I woke up to see this.
I am now being blocked from doing additional analysis on a codebase which I've already responsibly disclosed to, and have received confirmation had legitimate findings.
To be clear, this is after having already KYC'd and completed the onboarding process months ago to use the cyber capabilities OpenAI has to offer.
I am now prevented from being able to continue the investigation in a further effort to make sure their code changes are sufficient, as well as understand if there are other issues that have yet to be discovered.
It absolutely guts me as a patriotic American to have to do this, but I will be going back to using Chinese open source models to conduct my research to protect Bitcoin infrastructure.
Black hats will not hit these issues. The white hats will. We've hit a local minima in policy. Intelligence is unrestricted for those who don't follow rules, and those who engadge in harm reduction are left on the sidelines.
What are we doing in this country? How is this keeping people safe?
Please do something @DavidSacks @sama @realDonaldTrump
Show more
How many BTCPay lightning nodes were swept? Our Foundation node was drained overnight by attackers.
Regarding the Coldcard entropy bug – many folks are explaining what happened but I wanted to take a minute to explain why it may have happened.
It's a disastrous situation and our heart goes out to all the Bitcoiners affected.
Here's a timeline of events:
On July 28 2020: @FoundationHQ announced our first Passport hardware wallet and noted that we were building on Coldcard firmware which at the time was GPLv3 licensed (FOSS license).
On July 30 2020: NVK publicly said he regretted choosing GPL because Coldcard now had a “clone” and that they would change things in future updates.
On November 18 2020: Coldcard added its MIT + Commons Clause license, prohibiting commercial products substantially derived from the software.
On January 8, 2021: Coldcard firmware 3.2.1 formally announced, “License changed from GPL to MIT+CC on files for which the GPL doesn’t apply.” CC is the "Commons Clause" license addendum which is "source available" instead of FOSS.
On March 1, 2021: The “First pass w/ libNgU” commit removed the GPL @Trezor-derived crypto libraries and replaced them with libNgU. That same 120-file commit changed seed generation code. libNgU was licensed with a novel “Licensed for Bitcoin Only” license.
On March 17, 2021: Version 4.0.0 announced that all crypto and BIP39 code had been replaced and that the “last remaining GPL code” was removed.
Our best understanding right now is that the entropy bug was collateral damage from this major overhaul of the codebase.
To be clear, this overhaul was not solely about licensing. Coldcard also cited technical goals including adopting Bitcoin Core’s libsecp256k1, faster AES and SHA implementations, and reproducible builds.
But the timeline establishes two things:
(1) Foundation’s launch was the obvious impetus for Coldcard’s licensing change, and
(2) removing the remaining GPL code was an explicit goal of the subsequent v4 rewrite.
We don't know by how much the licensing pressure affected the scope or timeline of the rewrite. All we can determine is that the entropy bug was introduced inside the same 120-file commit that removed the old GPL code dependencies.
Show more
This is the worst thing @nvk has done. He actually sent a cease and desist letter to an open source developer who made an open Blockclock competitor (btcclock) AND sent a trademark claim to GitHub who took down the repo.
NVK has harmed open source more than any other Bitcoiner.
Show more
