oskarth(@oskarth):What can be done? We'll see a lot more of this in the age of AI-assisted cyber attacks. We see this already with things like Zcash supply bug and the resulting Ironwood. Expect more to come. Assuming you want self-custody, what should you do? 1) Diversification: don't put all your eggs in one basket 2) Use multi-sigs: less vulnerable to vendor attacks 3) For seed phrases: Use additional passphrases and consider dice wallets Even with all of this, there'll be more types of attacks not in our locus of control. Unfortunately, I think we are likely to see continued and worse attacks from here. There are no silver bullets, and vigilance is a prerequisite, but it might not always be enough. Diversification applies to seeds, assets, networks, and methods. Maybe there'll come a calm after this current set of AI assisted cyber attacks, but right now we are in the middle of a storm. Prepare accordingly.

2026.08.01 04:13

What can be done? We'll see a lot more of this in the age of AI-assisted cyber attacks. We see this already with things like Zcash supply bug and the resulting Ironwood. Expect more to come. Assuming you want self-custody, what should you do? 1) Diversification: don't put all your eggs in one basket 2) Use multi-sigs: less vulnerable to vendor attacks 3) For seed phrases: Use additional passphrases and consider dice wallets Even with all of this, there'll be more types of attacks not in our locus of control. Unfortunately, I think we are likely to see continued and worse attacks from here. There are no silver bullets, and vigilance is a prerequisite, but it might not always be enough. Diversification applies to seeds, assets, networks, and methods. Maybe there'll come a calm after this current set of AI assisted cyber attacks, but right now we are in the middle of a storm. Prepare accordingly.

oskarth@oskarth

2026.08.01 04:01

The attack on COLDCARD HW wallet is probably one of the worst ones in crypto history. COLDCARD was seen as one of the most secure and paranoid option for self-custody, with proper airgapping and many security measures. Its users did basically everything right, yet got hacked. A bug in the RNG for how seed phrases are generated, undiscovered for 5 years, meant hackers can re-generate seed phrases on their own. Owning a Mk3 and being on the exposed firmware myself, I was up late last night scrambling to access it and see if I was affected. Luckily, and more by happenstance, my seed predates the RNG bug. First close call on a hack in a long time. But this isn't true for a lot of people, and these people are fucked now despite doing 95%+ of self-custody right. Not hopeless, there are several ways to mitigate these things, but definitely not good. Unlike e.g. previous CEX hacks, this one strikes at the very core of self-sovereignty, self-custody, and what a big part of this technology is about.