Recordatorio diario para que no te vacíen la wallet:
Dejar de mirar los mails que te mandan "de la marca" post-compra. El 99% es phishing.
Usar correos alias/temporales para comprar.
Info crítica? Solo en las redes oficiales verificadas.Tu sentido común es el verdadero candado
El mejor truco de seguridad en bitcoin es que todos piensen que sos un laburante promedio que apenas llega a fin de mes y que "te la re perdiste" con el Bitcoin. Que te tengan lástima es mil veces más seguro a que te tengan envidia o especulen cuanto btc tenes.
En este ambiente, que piensen que no tenés un mango es una póliza de seguridad gratis 🫰
Te miden, te venden, te entran.
El perfil bajo tiene que ser una religión, cero comentarios a vecinos, mantener la fachada de siempre. Si no saben lo que tenés, no te pueden robar.
@mattunchi Y yo digo los que hablan de bitcoin, criptos como vos no les da miedo exponerse tanto? Yo digo es mejor un perfil bajo que andar viendo si te vas de vacaciones, te entran a tu casa y te dan vuelta todo o te miden tu rutina te frenan un auto y te llevan a tu casa, ect.
🚨 New COLDCARD firmware is out: 5.6.2 for Mk4/Mk5 and 1.5.2Q for Q.
View TRNG Words is back. We also added an offline tool to verify dice-roll or coin-flip mixing, USB ncry v3, and more transaction, Virtual Disk, firmware and wallet-state fixes.
Please update promptly:
https://t.co/fQ9dvFRXJx
Full notes:
https://t.co/uGfj1XHIqB
Glassbox is a neat new tool to help you understand how uniquely identifiable of a "fingerprint" your browser is leaving when it visits a web site and provides guidance for how to better blend into the crowd.
https://t.co/Zg8xKQF68b
I've wanted miniscript on @SeedSigner for years. @Rob1Ham opened a Git Issue three years ago. It sat there.
So this week I built it.
A SeedSigner fork with miniscript support, plus a SeedSigner x Liana bridge so the whole flow runs over QR. No cables, no USB, completely airgapped.
Here's a timelocked inheritance wallet, created in @lianabitcoin, descriptor registered and PSBT signed on a SeedSigner.
Bridge tool: signet-only, not audited. SeedSigner PR: tested, hardware-verified, up for review. Repos below.
Sparrow v2.5.4 has been released, delivering the results of several extensive security reviews.
Thank you to all the contributors and security researchers who provided input on this release.
Changelog: https://t.co/1mDfqa7Gu7
Download: https://t.co/HOEwliSIRd
Recomendamos encarecidamente que todos los usuarios de Mk4, Mk5 y Q actualicen y verifiquen la descarga de firmware firmada.
Gracias a cada investigador que reportó problemas, reprodujo casos límite, revisó correcciones y ayudó a hacer esta versión más fuerte.
🚨 New COLDCARD firmware is available: 5.6.1 for Mk4/Mk5 and 1.5.1Q for Q.
This release follows three weeks of sustained review since our July 31 hotfix. We continue to acknowledge the customers who suffered severe financial losses from the seed-generation attack.
Every newly generated seed now requires one source of user entropy: at least 65 key presses with unpredictable timing, 50 physical dice rolls, or 128 physical coin flips. This input is combined with fresh entropy from the STM32 TRNG, SE1, and SE2.
The release also adds staged-PSBT verification immediately before signing, stronger USB and firmware-update boundaries, improved Delta Mode isolation, active-wallet backup fixes, stronger RNG initialization and fault checks, safer SIGHASH defaults, and many additional security and correctness improvements.
Important: Updating does not repair an existing seed generated on affected firmware. If the advisory applies to your seed, update your device, generate and verify a new seed, then move your funds.
We strongly recommend that all Mk4, Mk5, and Q users update and verify the signed firmware download.
Thank you to every researcher who reported issues, reproduced edge cases, reviewed fixes, and helped make this release stronger.
https://t.co/tFAiHhEWAy
@satoshi_hodler_ Si la notebook va a estar completamente aislada del mundo exterior, Tails te instala un montón de programas y controladores de red que no vas a usar. Un Debian limpio, instalado sin soporte para wifi ni bluetooth, te da un entorno mucho más cerrado, controlado y seguro.
@satoshi_hodler_ Coincido con la estrategia offline, pero por eso mismo prefiero usar Debian antes que Tails. Tails tiene sentido si necesitás conectarte a internet de forma anónima
A la gente le cuesta mucho entender que cualquier persona que se lo proponga puede llegar a enriquecerse mediante el capital compound. ¿Saben por qué?
Porque el cerebro está diseñado para pensar en términos lineales y no exponenciales.
¿Hasta dónde creen que puede llegar una servilleta que se dobla 42 veces?
Nadie se imagina, prima facie, que la respuesta es más allá de la luna, porque el cerebro requiere entrenamiento en lo exponencial, más allá de lo lineal.
Esa es la riqueza de la capitalización compuesta.
🎲Rolling dice to create a new bitcoin seed is EASY.
People WAY OVERCOMPLICATE it, stressing everyone out by insisting on absurd levels of perfection and unnecessary rituals.
I told AI to do the research. Then I organized it all to be human-friendly.
https://t.co/jHqY2hJCsG
Filtración de datos en proveedor de Trezor afecta a clientes (EEUU, Latam y Europa). Tus fondos están seguros, pero el phishing por correo viene fuerte.
💡Usa puntos de entrega, no la dirección de tu casa.
💡Usa un correo exclusivo para la compra y deséchalo después.
We have some difficult news to share. Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data. This affects new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who received an order within the 90 days prior to August 8th, 2026.
The data exposed:
- Full names
- Shipping addresses
- Phone numbers
- Email addresses
The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email). The breach is limited due to Trezor’s strict 90-day data storage policy (we were also able to negotiate the same terms with fulfillment partners, who follow the same policy).
All affected customers have been contacted separately by email.
Our systems and devices remain secure, but affected customers could experience an increase in phishing attempts.
NEVER enter your wallet backup on a website or share it with anyone, and only check for updates on official Trezor channels.
We are deeply sorry to the community and those affected.
We are investigating this situation and will post updates on our blog:
https://t.co/JGrttMs4Ev
gained a ton of new insights working in bitcoin red team 🟥 that i wish i could share without vague posting. but this is what i got anon.
- we’re experiencing a massive collision between decades of human open source slop against 2 weeks of kimi k3 (not good)
- everything is broken, bitcoin is burning
- bitcoin is becoming stronger through this
- bitcoin is the obvious first target but the rest of the world will follow shortly
- sometimes old things need to burn so new things can grow on healthy soil
- humans should never code in c (just stop)
- lightning is complicated and is more broken than the average (sorry)
- verification is free. we used to complain about slop PRs. then about slop security audits. if you can’t handle the information overload, stop complaining and use AI to sort through it.
- those projects that started AI audits months ago are in a completely different position than those who didn’t
- projects need their own AI audit pipeline going into the future
- the burden for a developer to keep software safe and secure is pretty stressful and not for everyone. it has become a lot more stressful now.
- unmaintained projects are most probably broken, don’t rely on them. i’d rather one-shot it myself with a modern AI
- multiple concurrent, diverse human approaches have proven to be the best vulnerability search method
- external red teaming will probably have to continue forever
- we’ve basically completed a basic scan of virtually the entirety of bitcoin open source. the low hanging fruit is done.
- we’ve reported a ton of real critical and high vulnerabilities. project maintainers across the board have validated our findings.
- response speed is very different across projects and shows how healthy each project is. i recommend acting fast these days.
- red team etiquette matters. if you don’t disclose responsibly, boast on twitter about your findings on a particular project, or make indications about the nature of particular findings, you’ve disqualified yourself as a serious security researcher. trust is the most important factor in this game. if you lose it, it’s very hard to win it back.
- did i mention that humans should not code in c?
love you all.