梦想-8

Another lesson from a single-point failure—this time, the weakest link was the one everyone assumes is the safest: cold wallets. 😮

Coldcard is a Bitcoin hardware wallet made by Canada’s Coinkite. It’s known for keeping private keys completely off the network, and among people who stockpile coins, its reputation has always been very strong. But this time, the “offline” part—precisely that—was breached.

When the firmware generated private keys, it mistakenly used a deterministic pseudo-random number from software instead of the chip’s hardware random number. The entropy was so low it could be brute-forced—so the seed generated offline could also be computed offline.

The mistake was buried from the firmware dated March 2021 all the way until today—five full years. 😮‍💨

7/30: the first wave emptied 1,196 addresses in 41 minutes. By 8/1, the total reached about 1,367 BTC (about $88.6 million, Block/Galaxy figures). Chinese media reported on 8/3 that it was 1,755 BTC—over $110 million. The average “sleep time” of the stolen addresses was 3.18 years, mostly belonging to people who had held coins long-term.

⚠️ The most damaging point: flashing firmware does not fix seeds that were already generated. Affected users must replace the seed and move the funds.

The aftershocks are even more telling than the amounts: the scale of “risk-off” moved close to the level of the FTX crisis—about 39,600 BTC were moved. Many people moved from self-custody to exchanges and ETFs. The belief that “a cold wallet is absolutely safe” has been shattered.

So this is actually the same disease as liquidation events caused by smart contract bugs. But moving coins from a cold wallet to an exchange isn’t a solution—it merely swaps the single point of failure from the firmware to the exchange. Don’t let any unverified link carry your entire position alone. ⚠️

(The above is compiled public information and methodology sharing; it does not constitute investment advice)
$BTC #Bitcoin #安全

────────────

📋 Coldcard vulnerability roundup (as of 8/4)

【Vulnerability】Firmware ngu.random misused MicroPython’s deterministic Yasmarang fallback, not the STM32 hardware random number; this fallback depends only on the chip ID and system timing, with extremely low entropy that can be exhaustively searched → seeds can be reconstructed offline and private keys computed. The root cause is the v4.0.1 firmware from 2021-03.

【Affected firmware】
· Mk2/Mk3: 4.0.1–4.1.9
· Mk4/Mk5: below 5.6.0 (Edge below 6.6.0X)
· Q series: below 1.5.0Q (Edge below 6.6.0QX)
· Not affected: TAPSIGNER, OPENDIME, SATSCARD (different codebase)

【Stolen amount】First wave on 7/30: 1,083 BTC (about $70.2 million) / 41 minutes / 1,196 addresses. By 8/1: 1,367 BTC (about $88.6 million) / 4,585 addresses. Chinese media reported on 8/3: 1,755 BTC—over $110 million. Throughout the attack, the fee was consistently 30 sat/vB with no change; it was an automated script. Chainalysis says the first 10 minutes already swept about $30 million.

【How it was discovered】Bitcoin engineering and security teams at Block found it while investigating abnormal stolen coins reported on 7/30 to Coinkite. There’s also a community claim that someone used AI to scan the open-source firmware exhaustively and pinpoint the flaw within 8 minutes—but I haven’t found primary evidence for that; treat it as rumor.

【Official response】Coinkite has confirmed the issue and released patched firmware (Mk2/Mk3 4.2.0+, Mk4/Mk5 5.6.0+, Q 1.5.0Q+), and destroyed all problematic devices waiting to be shipped. ⚠️ Flashing firmware does not fix seeds that were already generated.

【What affected users should do】Verify old backups → flash the patched firmware → regenerate a new seed → verify the new addresses on the device → do a small test → move all funds to the new wallet → keep the old backup until the migration is complete.
Note: seeds generated by supplementing entropy with ≥50 rolls of a fair die are not separately affected by this vulnerability. A strong BIP-39 passphrase provides extra protection, but it does not fix the underlying seed.

【Industry impact】The risk-off scale is close to the level of the FTX crisis: daily active addresses rose from 645k to nearly 1 million. About 39,600 BTC were moved, and small transfers hit the highest level since 2022-11.

“History proves that the ones who survive are not the smartest—they’re the most adaptable.”

Daly recently talked about an AI bubble on a podcast, and I stared at this line for a while—put into contract terms, it’s basically plain common sense. 😮

What he didn’t give is a “run” warning. Instead, he provided a checklist: prices rise but profits don’t keep up; huge amounts of new money with no experience rush in; leverage (borrowing/options/leveraged ETFs) is everywhere; IPO supply surges; and valuations don’t match liquidity (raising $50 million with a $1 billion valuation).

Does this look familiar?

The key is in the second half: what he does is feature recognition, not predicting the exact day things will collapse. These two things are very far apart—you can be right a full half-year early, and still get swept out during the following half-year. $BTC —once you turn on the leverage, one pinprick is enough. 😮‍💨

So I’m not using this list as “liquidate and run.” It’s more like “keep leverage at a level that still leaves you on the field even if your judgment is wrong.” Live to survive first, then try to be right. ⚠️

One more thing: his own allocation is pretty plain—gold 5–15%, and Bitcoin about 1%.

(Contract risk is high. The above is personal methodology sharing and does not constitute investment advice.) $BTC #AI #Contract Risk Control

────────────

📋 Summary of the Dalio × The Diary Of A CEO interview (aired 7/30, hosted by Steven Bartlett)

Main point: The AI revolution is real, but investors are manufacturing a new bubble—and this bubble is layered on top of the late stage of an 80-year downturn cycle.

【I. Five characteristics of the AI bubble】His judgment isn’t about calling the top
① Prices rise but profits don’t follow
② Large inflows of inexperienced new money
③ Widespread leverage: borrowing, options, leveraged ETFs
④ Exploding stock supply (overfunded IPOs)
⑤ Valuation and liquidity mismatch: $50 million raised, $1 billion valuation

【II. The 80-year cycle—now in the late stage of a downturn】
The starting point is the order established in 1945, containing three layers of order: currency, domestic politics, and geopolitics.
It counts as a “late stage” only when three things happen at the same time: an internal debt crisis + inequality + external geopolitical conflict.
The debt chain: bubble breaks → assets sold for cash → higher rates force repayment → assets fall → more forced selling → recession.
UK example: in 6 years, there were 7 prime ministers.

【III. U.S. decline and geopolitics】
In the past, merely “hinting” could affect other countries. Now it doesn’t work the same way; China is already the largest trading partner for most countries.
He calls the Iran War a “huge mistake,” drawing an analogy to the UK’s Suez moment.
On the Taiwan issue, threats from chip export controls matter more than military confrontation.
Moving toward a bipolar/multipolar and regionalized world may not necessarily mean a big war.

【IV. Inequality】This is the part he worries about most
Automation reduces labor’s share and increases capital’s share.
Only 61% of American adults own stocks, and 90% of stocks are held by families in the top 10%—“the stock market rising” has little to do with most people.
Connecticut: 22% high school dropout rate, and its prison budget exceeds its education budget.

【V. Asset allocation】
Gold 5–15% (strongly recommended by him); Bitcoin about 1%; the rest is diversified across stocks, bonds, cash, and real estate.
Why he favors gold: “It’s the only financial asset that isn’t someone else’s liability”—it can’t be printed, and central banks hold it. Bitcoin, by contrast, has regulation, is monitorable, and has quantum risks.
Don’t hold 100% cash—“for a long time this has been the worst investment; inflation will eat it up.”

【VI. Words for ordinary people】
First, calculate “how long you can last without income,” and keep emergency cash for 6–12 months.
Don’t try to time the bubble precisely when it breaks; don’t touch high leverage (he directly calls options and leveraged ETFs gambling).
A single asset can drop 70%; diversification is that free lunch that lowers risk without reducing returns.
“Smart rabbits have 3 holes”—prepare 2–3 escape routes.
For a 30-year-old with no assets: your only asset is yourself.

【Key quote】
“You can't spend wealth. You have to sell the wealth to get money.”
Wealth can’t be spent directly—you have to sell it first and turn it into money.

Have you ever had this experience? You’re chasing the hottest trends at full speed, and then once the market starts to shake, your account instantly turns green.😮

AI is now being elevated to the height of a “national strategy.” U.S. Treasury Secretary Bessent said: the computing share needs to be increased from ~60% to 80%, putting AI, semiconductors, and quantum on par as pillars of national security. He also claimed the U.S. is ahead of China by 3–6 months to 1 year (different sources cite different figures). At the 7/17 Shanghai World Artificial Intelligence Conference, Xi Jinping advocated for “openness and mutual benefit, with security and controllability.”

One approach leans more toward competition, the other more toward cooperation, but the common ground is obvious: major countries are treating AI as a long-term main line.

The problem is: the clearer the direction, the easier it is for people to get carried away. This round of the AI market has repeatedly gone “doubt → repair → overheating → doubt again.” U.S. stocks’ semiconductors, leveraged ETFs in South Korea, and China’s A-shares have all been tossed around until it’s hard to tell what’s going on. Crypto, too, has been swinging with AI sentiment—once leverage is turned on for contract $BTC , a single needle-like spike can knock you out of the game. And the losses you rack up won’t come back on their own.😮‍💨

My response is actually pretty simple: getting the direction right is one thing; whether your position can withstand the violent swings in the middle is another. Don’t chase the highs, don’t use high leverage—first, make sure you stay at the table. Being able to stick with this main thread for longer is more valuable than going all-in on a single correctly-timed impulse.⚠️

(Contract risk is high. The above is my personal methodology sharing and does not constitute investment advice.)
$BTC #AI #合约风控

The new quantitative strategy is live! Attached is the out-of-sample (WFA-OOS) backtest equity curve of the strategy—clearly labeled: price-only measure, including transaction fees, and the maximum drawdown. Backtests ≠ live trading. In contract trading, surviving is more important than making money quickly!

Whether this is true or not, it just makes me so happy 😍 Who doesn't love to hear sweet words~ There are always nice words popping up from time to time [sneaky laugh] to make you happy [hey ha]

Important reminder! I have not hired any assistants! Anyone claiming to be my assistant is a scammer! Please spread this reminder and be cautious not to be deceived. [smirk] A user who followed me reminded me that I almost fell for it~ The image below shows the scammer's ID on Telegram, and there might be some on WeChat as well. There are so many scammers these days. [facepalm]

Important things should be said three times! Here are a few accounts of known scammers! Please be very cautious! These are professional scammers, and once you get in touch with them, it's very easy to be deceived! They will send you links to click on, asking you to install mobile software or wallet plugins! They will directly steal all the money from your wallet! I hope everyone can help spread the word! Don't let the scammers succeed! Thank you all very much! [cup hands][cup hands][cup hands]