telluride on Nostr: PART ONE: It’s inevitable that we will see more aggressive supple chain attacks or ...

PART ONE:
It’s inevitable that we will see more aggressive supple chain attacks or just outright infiltration to coerce companies to release malicious firmware updates or even malicious hardware. (ex: Ledger reseller CryptoBillis)
—It never really occurred to me until Coldcard incident

That hit pretty close to home as id been advising people to use Coldcard and Trezor for years.

Here’s the “blurb” of what I’ve published about it.

All of this is “assumptive” based on the citations provided.
Even if I’m completely wrong, it’s totally plausible.
—Thats the real point.

“Switck deliberately introduced the weak-entropy flaw in Coldcard’s seed generation. A nation-state actor honeypotted him by exploiting his deviant sexual interests (he’s Trans), after which he reduced the available entropy just enough that ordinary collisions stayed improbable while still leaving the space searchable by anyone who later enumerated it.
He disabled the hardware RNG build error so the misconfiguration produced no warning and appeared to be an ordinary amateur mistake.
The same person signed the relevant GitHub commits under both the Switck and Peter D. Gray identities using one key, concealing that a single individual both wrote the vulnerable library and integrated it into production firmware.”

Citations:

https://x.com/switck (bio: She/he/his/hers)

https://x.com/hodlonaut/status/2086156684255494383

https://x.com/hodlonaut/status/2083888379465273754

https://x.com/jamesob/status/2084620229389197453

All of this was done within a btc price window of ~$75-$125k

What about when btc is $500k?
$1mil ?

Buckle up.
I don’t think anyone is paranoid enough when it comes to self custody.
🧡👊🏻🍻

⚡️⚡️3 digit zaps for reposts that reply here⚡️⚡️