If they did know, why wait until now to sweep? Malice is a thing but this reeks of incompetence.

I did not lose a single sat except some extra mining fees but this still cost me dearly. 36 hours with barely any sleep, worried sick about people close to me that I had recommended a ColdCard to. Fortunately, none were affected but this has shaken me deeply.

Perhaps an individual programmer may have made this mistake but what does this tell us about Linus’s law?

We were all trusting that someone had verified. Meanwhile, the whole thing was a clown car built by the intern who knew how to write Python but not C.

You can’t because you cannot control the environment the user is operating in. Instead of striving for the most convenient UX, force the user to provide the entropy. @SeedSigner does this well: roll dice or take a photo or GFY.

We all feel like big ass LARPs rn

IDk about that. If it gets that bad, we can all play with our bitcoins on a Windows PC like in the good old days because they wont’ be worth all that much.

We must also take responsibility.

I’m guilty of being prideful, by sneering at the people using other hardware and software.

I’m guilty of being complacent and recommending a way of custody that I didn’t use myself for my life savings just because everyone I trusted said it was secure and because it was accessible to normies who took bitcoin seriously.

I’m guilty of sloth, not following up with those that I orange pilled to make sure they kept learning and improving their security.

I’m guilty of greed, wanting to orange pill as many as I could so my own stack would become more valuable.

And, now I’m guilty of wrath, almost uncontrollable anger at those responsible. Pray for me, but first and more importantly, pray for those who got hurt by this terrible tragedy.

I have swept two of my “nephews’” wallets to a multi vendor multi sig with external entropy. obviously not scalable but can work with close friends and family with relatively small stacks in an emergency such as this one.

yeah it would work just fine with “deterministic entropy.”

This is not just a technical issue with one brand of hardware. The assumptions I was operating under are broken. I was listening to a technical spaces last night with Rob Hamilton, Wicked, etc. and they made it sound like the RNG bug was obvious once you look at it. Therefore, a non-technical user thinking that Bitcoin software that is bitcoin only, produced by a reputable group with source that is viewable so long as he checks the binary’s signature is completely wrong. so it goes for keeping seeds offline. The only mitigation is multi vendor multisig with each seed generated without relying on the device entropy. Tell me how I can recommend that to friends and family with just a few million sats?