It sounds like it was human error.

I don’t get it, doesn’t coinkite routinely get independent security audits? Why was this not caught?

I would imagine a sensitive project like this would have nonstop independent audits???

Humans will always make errors and new models will uncover (and introduce) new attack vectors. Isn’t this what audits are for?

I almost feel as bad for the guy who made this mistake as the people who lost their funds. Imagine wearing the burden of knowing what your one mistake resulted in …