Zero-Knowledge Goof❄️

UNLICENSED BROKER OF BITCOIN

Working on @FrostsnapTech

npub1xh897wvhn93tda0zws94mdyc7eagc8qm0798clp7x48zh6kjwa

[Zero-Knowledge Goof❄️ @LLFOURN]

Upgrade your frostsnap app. And upgrade the firmware on your devices when you can.

[Frostsnap ❄ @FrostsnapTech]

Frostsnap v0.4.0 is out ❄

It fixes two security issues. We know of no user funds lost to either, and each has a published report. Update your app and device firmware.

Also: firmware downgrade protection and dozens more fixes.
https://t.co/iWiwbmVbd3

[stu 🥪🥞 @stutxo]

stay humble hack sats

[Adam Mashrique @sakak_musdom]

I found a SIM implant in my friend's @Ledger Flex. He set it up but never used it, so no funds were lost.

He bought it from @cryptobilis at their May 22 2026 Global Pizza Party, Raintree Club Kuala Lumpur.

nRF9151 LTE module, eSIM module, v1.1 UFL antenna

cc @MagicalTux

[Zero-Knowledge Goof❄️ @LLFOURN]

😂🤣 SHORT ETHEREUM (TICKER: $ETH) INTO THE FLOOR. IT'S OVER.

[Haavard @HFroeiland11075]

@rrwilliams In this conversation, ETH refers to the Exponential Time Hypothesis, not Ethereum (ethereum:native ).

No meaningful practical impact on Ethereum’s cryptography.

[Zero-Knowledge Goof❄️ @LLFOURN]

@AndyBTCAdviser @FoundationHQ @zherbert is**?

[Zero-Knowledge Goof❄️ @LLFOURN]

@AndyBTCAdviser @FoundationHQ @zherbert wait what. The footer contains an address in australia. What does it say this address it?

[UTXOCLUB @utxoclub]

TREAT EMAILS FROM @FoundationHQ WITH EXTREME CAUTION. ONGOING PHISHING ATTACK DISGUISED AS RECALL NOTICE.

DO NOT ENTER YOUR SEEDPHRASE INTO AN INTERNET CONNECTED MACHINE.

WEBSITE AND EMAIL COMPROMISED.

[nifty, ideas guy @niftynei]

@btcinsider__ @NYDIG @HRF I’m announcing today our first ever bitcoin++ cold storage edition 🧊

Join us for the bitcoin developer conference of a lifetime. It’s a boat accident waiting to happen 🚢

Registration is now open — only 21 spots available

https://t.co/tkbfnjnspw

[Zero-Knowledge Goof❄️ @LLFOURN]

@utxoclub @Rob1Ham https://t.co/1paLmjrMJj

[Zero-Knowledge Goof❄️ @LLFOURN]

@kcalvinalvinn Never get tired of bitcoin K-drama

[Olaoluwa Osuntokun @roasbeef]

Wavelength is now live on mainnet! ƛ

https://t.co/rVwVqaOxiD

shouts out to all the testers that gave valuable feedback to help us improve the performance and UX of the system 🤓

you can grab v0.2.0 of the release here: https://t.co/jfBFDtm4v1

[Zero-Knowledge Goof❄️ @LLFOURN]

Bad: All these mutation tests were not getting cleared each time and ended up using more than 1tb of space in /target/debug for one project.

[Zero-Knowledge Goof❄️ @LLFOURN]

Good: claude loves mutation testing now which is great.
Bad: A mutation test removed a guard which narrows processes to kill and killed very process on my machine.

[Zero-Knowledge Goof❄️ @LLFOURN]

@benthecarman it's over. Your bloodline ends here.

[Zero-Knowledge Goof❄️ @LLFOURN]

It is try and increment:

Start from …0x62, not …0x00, and accept x only when it's on the curve and its even root is > p/2. The offsets then come out 0/4/1/1, which gives your 98/102/99/99, so the bottom nibble is scan offset, not an edit. Only 7→4 is unexplained but is likely a manual edit to communicate intention.

[Zero-Knowledge Goof❄️ @LLFOURN]

I hosed the end of of my weekly credits on it:

1. The 1/2 thing is almost certainly because it shares code with curves that need cofactor clearing. E.g. secp160r2 also doubles even though it has cofactor 1.
2. The actual value of half G was probably produced using the routine from ANSI X9.62 (also in SEC 1) for generating a curve "verifiably at random" from a seed. It's the step that turns a SHA-1 seed into a field element, the one P-256 and the other r-curves used to derive their coefficient b. For a t-bit field:
•hash the seed s, keep the low t − 1 − 160·v bits (for 192 bits, 31), and drop the top bit;
•then append SHA-1(s+1), SHA-1(s+2), and so on.

We don’t know what was hashed but it looks like:

1. They used the routine to produce the 160 bit one
2. Then they run the routine for 192 bit with the same secret one but fiddled with some bits for some reason OR they had already forgotten the secret for (1) by this point so just padded the 160 bit value with random bits and fiddled with it to make it clear they weren’t using the actual routine so no one accused them of pretending they were later.
3. By the time they are doing the next 224 bit one they are tired and can’t be bothered generating a further random 32 bits and are already afraid of questions about how they produced the 32 bits in the 192 bit curve so they just truncate it back to 160 bit but they goof it up and so it goes to 168 bit. Or maybe they knew it was 168 bit but didn’t want to go back to 160 in case someone would be annoying and point out they had used the same 160bit value as the 160bit curve and ask questions. So he keeps an extra byte to make it clear they are intentionally breaking the rule (a bit like in 2) and it doesn’t matter and fuck off asking about why.
4. 256 gets the same one as 224. Now it’s clear they dgaf anymore and choosing G doesn’t matter anyway. Whoever produced the 160bit value without telling us the secret and went on holiday is to blame for all this.

To find out what the actual preimage for the 160bit value is going to take a lot of compute and we may never find it.

[Steve Weis @sweis]

CLAUDE FOUND THE SEEDS
https://t.co/m8N6OPQoCQ

[Olaoluwa Osuntokun @roasbeef]

Announcing LayerTree: a new tree-based scaling solution for Bitcoin that permits O(1), independent of the number of users in the system: https://t.co/RtARIow733

A single UTXO can hold the balance of millions of users as an off-chain Merkle-sum tree.

Transaction introspection techniques permit batched exit from the system in a single transaction w/o any pre-signing: https://t.co/AqvaZqkvyW

[Zero-Knowledge Goof❄️ @LLFOURN]

@danWilcz Europeans 🙄

[Zero-Knowledge Goof❄️ @LLFOURN]

@tempstat @sakak_musdom I mean the demo has a point: you don’t even need to do that.

[Zero-Knowledge Goof❄️ @LLFOURN]

WARNING: do not leave your tamper evident bags unattended near @sakak_musdom.

While waiting for an uber at the frostsnap factory I gave him a mk3 in its original bag as a parting gift. Before the uber had arrived he had completely disrespected its bag.

Don't be like him. Make sure to leave evidence when you tamper with hardware wallet packaging. It's part of the ToC.

[UTXOCLUB @utxoclub]

It's remarkable that the Ledger supply chain infiltration was able to grow to the scale it did given that we were aware of these implants ~6 months ago (thanks @joegrand!)