Theo Randall

Easy and swift, that's how life moves

[Theo Randall @_Theo_Randal]

The coins were sitting in "cold storage" while the security was apparently sweating in the background.

[Matt lander @m477lander]

Yeah, this is pretty much the whole problem.

The question is not really where to keep BTC anymore. Every option just moves trust and risk into another layer.

A CEX can freeze withdrawals or blow up. A hot wallet is only as safe as the device it runs on. A hardware wallet depends on firmware, keygen and the manufacturer not screwing up somewhere deep in the stack. And the second you actually use the asset, you inherit bridges, oracles, RPCs, contracts, external signers and the whole execution path.

You can solve storage and still lose everything on the first transaction.

I have been off the timeline for a month and a half. The industry apparently used that time to keep bleeding money.

30 major incidents. More than $210M gone in July alone.

The number is not even the interesting part. In the clearest cases, nobody hacked the blockchain. The chain did exactly what it was told to do.

The security model around it failed.

Coldcard, @COLDCARDwallet.

A Bitcoin only hardware wallet people trusted for years because it was supposed to be the safest layer.

Affected firmware could fall back to deterministic software seed generation instead of proper hardware RNG. Effective entropy could drop to around 40 bits on Mk2 and Mk3, and around 72 on newer affected models instead of 128.

After that, the attack is almost mechanical. Brute force candidate seeds offline, derive addresses, check them against the chain, drain the funded ones.

No physical access needed.

The first major wave took 1,082.65 BTC from 1,196 addresses in 41 minutes. Around $70M at the time.

Cold storage that was never actually cold.

No stolen device. No phishing. No user signing random garbage. The seed was weak from day one.

That is the Keygen TCB. The lowest layer. The exact layer I have been talking about for a long time.

Once that breaks, everything above it is theater.

AFX, @AFX_XYZ.

Seven validators. 2/3 threshold. Multisig. Dispute window. Every box checked.

The attacker got signing authority over five validators, enough for 7,142 out of 10,000 voting power and a fully valid withdrawal.

The quorum was real. The signatures were valid. The contract was untouched.

After the 200 second dispute window, the bridge released $24.15M USDC exactly as designed.

The multisig did not fail. The trust model did. The supposedly independent keys were sitting inside the same operational risk zone.

Ostium, @Ostium.

Same problem, one layer higher.

The attacker got access to an authorized oracle signer and a registered PriceUpKeep forwarder, then pushed correctly signed reports with fake prices and controlled timestamps, including future dated data.

Those reports were used to open synthetic BTC/USD positions against the vault.

The verifier checked whether the signer was authorized.

It did not check whether the data made sense.

The OLP vault lost $23.75 M.

Cryptography proved who signed the data. It did not prove the data was true.

Different products. Different attack surfaces. Same architectural mistake.

Control of a key is not trust.

A valid signature is not a valid action.

An authorized source does not make the data true.

Blind signing is the user facing version of the same problem. A wallet can prove that a key signed a set of bytes. It cannot prove that the economic result matches what the user intended.

And the industry keeps responding the same way.

One more audit. One more multisig. One more scanner. One more policy layer. One more check bolted onto the same old architecture.

But when keygen, risk verification, signing, routing and execution live in separate trust zones, every boundary becomes a place where context gets lost and extra trust slips back in.

So the answer to the original post is not another hardware wallet.

And it is definitely not another wallet with a swap button.

This market needs a different category.

An isolated execution environment that stays fully noncustodial.

One hardened perimeter under user control, where keygen, local risk checks, typed intent, policy, signing and protected execution are tied together instead of scattered across separate trust zones.

Everything coming from outside stays untrusted until it is checked locally.

Calldata. RPC responses. Routes. Spender permissions. Token metadata. Protocol state. All of it.

The user should not be signing opaque bytes. The user should be signing a clear intent bound to an active policy.

The backend holds no keys, signs nothing and gets no delegated authority.

I am tired of writing the same postmortem after every drain and explaining which key or trust boundary failed this time.

Protocol names change. Numbers change. The exploit changes.

The architecture underneath does not.

At some point, repeating the same warning for the hundredth time stopped being useful.

Building the answer made more sense.

So I was not quiet for a month and a half because I had nothing to say.

I may have just been busy building the answer to the question in this post.

[Theo Randall @_Theo_Randal]

"Project Eva" Sounds serious enough to have a board of directors

[Matt lander @m477lander]

Eva has never been just a pet to me.

She’s my best friend, my most loyal companion, and probably the creature I love most in this world. But over time, she became something else too. A symbol.

She somehow represents a lot of things that have always mattered to me. Even her name makes me think of life. But she’s also a predator. Protection, speed, agility, independence, always alert, and that focused stare that seems to notice everything around her.

A few years ago, I had a thought: what if one day she became the symbol of the biggest project of my life?

Not just a name or a cool mascot. I wanted the idea behind the project itself to stand for those same things.

As you can probably tell from the screenshot below, this didn’t start yesterday. Project EVA already existed back in 2024. There were early plans, job openings, people I was looking for, and something that, at the time, mostly existed in my head was slowly starting to take shape.

I’ll leave what happened after that out for now.

Maybe Project EVA will actually turn into something big and serious.

Or maybe there’s nothing serious about it at all. Just some weird idea from a developer who loves his serval way too much and decided to dedicate something to her.

Maybe it’s just for fun and one very long story.

Or maybe those of you who’ve been reading my posts for a while are starting to wonder about a few things.

Who knows.

For now, let’s just call it Project EVA.

But I’m genuinely curious. When you look at this screenshot, the name Project EVA, and this whole story, what’s the first thing that comes to mind?

What do you think something like this could turn into after a few years?

Something actually serious, or just one big idea that ends up going nowhere?

[Theo Randall @_Theo_Randal]

@Cyberoom2 @m477lander She's the beginning

[Theo Randall @_Theo_Randal]

@m477lander Since 2024...Feels like this is the right time for this project to skyrocket. Have seen years of dedication here.

[Theo Randall @_Theo_Randal]

@giuli_ivanteamo @m477lander The story had just begun mate.

[Matt lander @m477lander]

Eva has never been just a pet to me.

She’s my best friend, my most loyal companion, and probably the creature I love most in this world. But over time, she became something else too. A symbol.

She somehow represents a lot of things that have always mattered to me. Even her name makes me think of life. But she’s also a predator. Protection, speed, agility, independence, always alert, and that focused stare that seems to notice everything around her.

A few years ago, I had a thought: what if one day she became the symbol of the biggest project of my life?

Not just a name or a cool mascot. I wanted the idea behind the project itself to stand for those same things.

As you can probably tell from the screenshot below, this didn’t start yesterday. Project EVA already existed back in 2024. There were early plans, job openings, people I was looking for, and something that, at the time, mostly existed in my head was slowly starting to take shape.

I’ll leave what happened after that out for now.

Maybe Project EVA will actually turn into something big and serious.

Or maybe there’s nothing serious about it at all. Just some weird idea from a developer who loves his serval way too much and decided to dedicate something to her.

Maybe it’s just for fun and one very long story.

Or maybe those of you who’ve been reading my posts for a while are starting to wonder about a few things.

Who knows.

For now, let’s just call it Project EVA.

But I’m genuinely curious. When you look at this screenshot, the name Project EVA, and this whole story, what’s the first thing that comes to mind?

What do you think something like this could turn into after a few years?

Something actually serious, or just one big idea that ends up going nowhere?

[Matt lander @m477lander]

I’ll leave the first part of your comment unanswered for now lol😺

You’re right about the fangs, though. I never did explain why she has titanium fangs. I also never told the story of how Eva ended up living with me in the first place.

Eva is an African serval, a real predator. I never wanted a serval, and I don’t think people should buy wild cats just because they want something beautiful or unusual at home. A serval isn’t a toy. But things were different with Eva.

This was about six years ago. I was on a short trip, and people nearby had been looking for an escaped serval for several days. People from my country have local group chats wherever they move, and the escape was all over ours. We followed the search too, then decided to help and eventually got in touch with the owners.

That’s when we found out they were breeding exotic cats to sell. The escaped serval was an adult male, and we later learned he was Eva’s father. His escape brought way too much attention to the breeding operation. Inspections followed, along with questions about how the animals were being kept and bred. I won’t get into every detail. There was plenty of fucked-up shit going on.

The breeders ended up in immigration detention because they were foreigners. At the time, they still had an adult female serval and two very young kittens they were planning to sell. One of them was Eva.

The kittens had already been separated from their mother and bottle-fed way too early so they’d get used to people and be easier to sell. By then, both were completely dependent on humans.

The escaped male was eventually found. People who knew the breeders took him and the adult female, but the kittens were going to be put down. It all came down to a new law. People who already had these animals before the law took effect were allowed to keep them. Acquiring or keeping new ones was banned, and the kittens didn’t qualify for the exception.

At that point, I didn’t see much of a choice. The two kittens had already been born. They were alive, they’d done nothing wrong, and now they were going to be put down because of all this bullshit.

I took both of them somewhere it was legal to keep servals. I won’t get into exactly how I pulled that off. Let’s just say it took a hell of a lot of time and money. The stress was even worse.

I later gave the male kitten to someone who already had experience with animals like him. He couldn’t take both because two adult servals need a lot of space. The boy is still doing great, and Eva stayed with me.

The whole thing started with trying to keep them alive, so I named her Eva.

I realized pretty quickly that a serval is absolutely fucking nothing like a big house cat. She’s a predator who weighs over 14 kg, runs fast, can jump almost three meters straight up, and has the temperament to match. But you get attached to her almost instantly. And once you do, you’re responsible for an animal that depends on you for everything.

Eva also had health problems. Being bottle-fed so early took its toll, and as she grew, we discovered serious issues with her bone development. We spent a long time going from vet to vet and figuring out her diet. She went through exam after exam and slowly got better. Eventually she got stronger and grew up. For a while, everything was fine.

Then the dental problems started, especially with her fangs. Most vets suggested simply removing them. She could live a normal life without them, so medically, that was the easiest option. I didn’t like it.

Eva is still a serval and a predator. These problems went all the way back to the beginning of her life. Just removing her fangs now and calling it a day felt wrong. So I started looking for another option.

Eventually I found a veterinary dentist who takes on difficult cases. I had to wait several weeks because right before Eva, he’d been working on a bear’s teeth. An actual bear.

He examined Eva, and we decided to restore her teeth. She got ceramic crowns on the back teeth. The fangs were more complicated. A predator’s fangs have to withstand much more force, so ceramic wasn’t strong enough. We needed something tougher. That’s how Eva ended up with titanium fangs.

She uses them without any problems, including when she eats meat. No one replaced healthy teeth with metal ones just for looks. The damage was already there. Her fangs had to be rebuilt, and we went with titanium.

The engravings were my idea. When the fangs were being made, they asked if I wanted anything engraved on them. I figured that since they were going to be titanium anyway, I might as well add something personal.

One upper fang has a tiny crown engraved on it. The other has E.L. The E comes from her name, and the L from my last name.

Her teeth are fine now, and Eva is doing great too.

[Theo Randall @_Theo_Randal]

@m477lander You are indeed a guardian Angel Matt.

[Theo Randall @_Theo_Randal]

@Cyberoom2 @m477lander Because she feel safe with Matt the moment she saw him

[Theo Randall @_Theo_Randal]

@cantlovedave @m477lander Matt gave her a second chance.

[Theo Randall @_Theo_Randal]

@AveryWilliic @m477lander Because that's what she is..😊

[Theo Randall @_Theo_Randal]

@tariqrehman8 @m477lander Unique rather

[Theo Randall @_Theo_Randal]

@m477lander the aura is different

[Theo Randall @_Theo_Randal]

@m477lander not another product on top

[Theo Randall @_Theo_Randal]

@kim_monia @m477lander Following every security recommendation gives you 80-90% chance of not getting wrecked.

[Theo Randall @_Theo_Randal]

@LuLualexq @m477lander Naa it fails sometimes

[Theo Randall @_Theo_Randal]

At the gym 💪💯

[Theo Randall @_Theo_Randal]

Nothing really beats eating healthy

[Theo Randall @_Theo_Randal]

@Sehat_INA pilih mas jokoo nuw

[Theo Randall @_Theo_Randal]

@gisel_la pngen dehh pacarannya romantis kek km kakak :(