Daniel

[Daniel @danie27990]

@isnansayyidinaa feels like he feeds on the popcorn daily

[Daniel @danie27990]

Ummmm

[Daniel @danie27990]

I don't care enough to understand all the architecture but I definitely care about not losing my money

[Matt lander @m477lander]

Yeah, this is pretty much the whole problem.

The question is not really where to keep BTC anymore. Every option just moves trust and risk into another layer.

A CEX can freeze withdrawals or blow up. A hot wallet is only as safe as the device it runs on. A hardware wallet depends on firmware, keygen and the manufacturer not screwing up somewhere deep in the stack. And the second you actually use the asset, you inherit bridges, oracles, RPCs, contracts, external signers and the whole execution path.

You can solve storage and still lose everything on the first transaction.

I have been off the timeline for a month and a half. The industry apparently used that time to keep bleeding money.

30 major incidents. More than $210M gone in July alone.

The number is not even the interesting part. In the clearest cases, nobody hacked the blockchain. The chain did exactly what it was told to do.

The security model around it failed.

Coldcard, @COLDCARDwallet.

A Bitcoin only hardware wallet people trusted for years because it was supposed to be the safest layer.

Affected firmware could fall back to deterministic software seed generation instead of proper hardware RNG. Effective entropy could drop to around 40 bits on Mk2 and Mk3, and around 72 on newer affected models instead of 128.

After that, the attack is almost mechanical. Brute force candidate seeds offline, derive addresses, check them against the chain, drain the funded ones.

No physical access needed.

The first major wave took 1,082.65 BTC from 1,196 addresses in 41 minutes. Around $70M at the time.

Cold storage that was never actually cold.

No stolen device. No phishing. No user signing random garbage. The seed was weak from day one.

That is the Keygen TCB. The lowest layer. The exact layer I have been talking about for a long time.

Once that breaks, everything above it is theater.

AFX, @AFX_XYZ.

Seven validators. 2/3 threshold. Multisig. Dispute window. Every box checked.

The attacker got signing authority over five validators, enough for 7,142 out of 10,000 voting power and a fully valid withdrawal.

The quorum was real. The signatures were valid. The contract was untouched.

After the 200 second dispute window, the bridge released $24.15M USDC exactly as designed.

The multisig did not fail. The trust model did. The supposedly independent keys were sitting inside the same operational risk zone.

Ostium, @Ostium.

Same problem, one layer higher.

The attacker got access to an authorized oracle signer and a registered PriceUpKeep forwarder, then pushed correctly signed reports with fake prices and controlled timestamps, including future dated data.

Those reports were used to open synthetic BTC/USD positions against the vault.

The verifier checked whether the signer was authorized.

It did not check whether the data made sense.

The OLP vault lost $23.75 M.

Cryptography proved who signed the data. It did not prove the data was true.

Different products. Different attack surfaces. Same architectural mistake.

Control of a key is not trust.

A valid signature is not a valid action.

An authorized source does not make the data true.

Blind signing is the user facing version of the same problem. A wallet can prove that a key signed a set of bytes. It cannot prove that the economic result matches what the user intended.

And the industry keeps responding the same way.

One more audit. One more multisig. One more scanner. One more policy layer. One more check bolted onto the same old architecture.

But when keygen, risk verification, signing, routing and execution live in separate trust zones, every boundary becomes a place where context gets lost and extra trust slips back in.

So the answer to the original post is not another hardware wallet.

And it is definitely not another wallet with a swap button.

This market needs a different category.

An isolated execution environment that stays fully noncustodial.

One hardened perimeter under user control, where keygen, local risk checks, typed intent, policy, signing and protected execution are tied together instead of scattered across separate trust zones.

Everything coming from outside stays untrusted until it is checked locally.

Calldata. RPC responses. Routes. Spender permissions. Token metadata. Protocol state. All of it.

The user should not be signing opaque bytes. The user should be signing a clear intent bound to an active policy.

The backend holds no keys, signs nothing and gets no delegated authority.

I am tired of writing the same postmortem after every drain and explaining which key or trust boundary failed this time.

Protocol names change. Numbers change. The exploit changes.

The architecture underneath does not.

At some point, repeating the same warning for the hundredth time stopped being useful.

Building the answer made more sense.

So I was not quiet for a month and a half because I had nothing to say.

I may have just been busy building the answer to the question in this post.

[Daniel @danie27990]

@theoashbyy @m477lander Someone as been reading

[Daniel @danie27990]

@MrDaamm_ @m477lander are you talking about matt?

[Daniel @danie27990]

@NanceFab @m477lander

[Matt lander @m477lander]

Eva has never been just a pet to me.

She’s my best friend, my most loyal companion, and probably the creature I love most in this world. But over time, she became something else too. A symbol.

She somehow represents a lot of things that have always mattered to me. Even her name makes me think of life. But she’s also a predator. Protection, speed, agility, independence, always alert, and that focused stare that seems to notice everything around her.

A few years ago, I had a thought: what if one day she became the symbol of the biggest project of my life?

Not just a name or a cool mascot. I wanted the idea behind the project itself to stand for those same things.

As you can probably tell from the screenshot below, this didn’t start yesterday. Project EVA already existed back in 2024. There were early plans, job openings, people I was looking for, and something that, at the time, mostly existed in my head was slowly starting to take shape.

I’ll leave what happened after that out for now.

Maybe Project EVA will actually turn into something big and serious.

Or maybe there’s nothing serious about it at all. Just some weird idea from a developer who loves his serval way too much and decided to dedicate something to her.

Maybe it’s just for fun and one very long story.

Or maybe those of you who’ve been reading my posts for a while are starting to wonder about a few things.

Who knows.

For now, let’s just call it Project EVA.

But I’m genuinely curious. When you look at this screenshot, the name Project EVA, and this whole story, what’s the first thing that comes to mind?

What do you think something like this could turn into after a few years?

Something actually serious, or just one big idea that ends up going nowhere?

[Daniel @danie27990]

@m477lander Eva really said security first 😂

[Daniel @danie27990]

@ameliaparfaite thats not fair enough haha

[Daniel @danie27990]

Sometimes you just need to reset and try again

[Daniel @danie27990]

@JaniceWong @m477lander Anticipating

[Daniel @danie27990]

@LeeThomas08 @m477lander Madddddddddddddd

[Daniel @danie27990]

@m477lander industry keeps bolting more layers on

[Daniel @danie27990]

@Tianaarius @m477lander Gm Tina, you cute tho

[Daniel @danie27990]

@Angel28257738 @m477lander i agree with you

[Daniel @danie27990]

@maggie_t17 @m477lander too simple

[Daniel @danie27990]

@m477lander the teeth look real

[Daniel @danie27990]

@DonWedge Goodnight