๐จ BREAKING: THE WORST HARDWARE WALLET HACK IN BITCOIN HISTORY!!!
$38M drained from 500 cold wallets in 25 minutes. The attacker never touched a single device.
If you are a Coldcard Mk3 owner, move your coins today.
Quick version of what happened:
594 BTC drained from ~500 air-gapped wallets in 25 minutes. These wallets never touched the internet. Turns out another 488 BTC was stolen earlier the same way and nobody noticed. Over 1,000 BTC gone.
And the attacker never hacked a single device.
A firmware bug from 2021 made the Mk3 skip its randomness chip when creating seeds. So your "random" 24 words were basically generated from the device clock and how fast you pressed buttons.
One developer literally predicted his own seed phrase by counting his button presses during setup.
Think about that. Life savings protected by button timing.
The attacker figured this out, precomputed the keys, then sat on them for 5 years waiting for the wallets to fill up. Then took everything in one shot.
And the uncomfortable part:
This code was open source the whole time. Public repo, "thousands of eyes," don't trust verify, all of it. The bug sat there for 5 years and nobody looked.
If your seed came out of a black box you never checked, you don't really own your Bitcoin. You're holding it until someone smarter takes it.
(If you used a passphrase or dice rolls you're fine. Mk4, Mk5, Q, Ledger, Trezor also fine. And watch out for fake "support" accounts in your DMs right now, they're circling.)
@ChrisStadele STIR markets (smart money) is betting there is zero chance of rate hike this week by BOJ. Forward guidance for upcoming meetings reg rates trajectory would be very important imo
the big jobs report tomorrow will find BLS overcounted ~1M jobs between Apr 24-Mar 25 because the model has a systemic flaw. @TheStalwart + @tracyalloway just did a great half hour dive on why the count keeps getting messed up, summarizing here:
- non-farm payroll (NFP) numbers are a key heartbeat of the economy, they're released by BLS a week after the previous month and summarize job gains/losses
- relies on poll of 121,000 biz (~1/3 of non-farm workers, which gives 90% sampling confidence)
- it's becoming increasingly less accurate: overstated job growth by 736,000 in 2023 and 943,000 jobs in 2024
why is it not accurate?
- BLS makes seasonality assumptions that aren't true any longer: macro keeps changing w enduring bullwhip effects post-covid + immigration + tariff policy
- but the biggest flaw their guest steven englander highlights is called the birth-death adjustment ๐ชฆ
- because NFP is a survey, it tries to account for gains/losses from businesses who opened/closed (aka birth-death). so BLS adds this adjustment in
the birth-death bad math
- the math behind this is simplistic and is weighed based on older data (moving average regression)
- if you compare Q1 2025 to Q2 2023 (when peak fed rates hit) there are now more quarterly job losses than gains from birth-death (-150,000 vs +500,000 then)
- the overly optimistic B-D weighting from the past skews the real negative change today
how off is it?
- englander: "there's about a hundred thousand jobs a month that are ... basically just not there" and it swings +/- with the business cycle
- Bloomberg's @AnnaEconomist, @MishGEA, @MBjegovic, along w @EconguyRosie@DonMiami3@profplum99@onechancefreedm were some of the first to raise this flaw over the past couple years, in fact NFP was also undercounting jobs in 2022 during the boom๐
- @MishGEA mentions another wrinkle in auditing these numbers: the birth-death numbers are not seasonally adjusted, so it's hard to separate the B-D # from seasonal adjustment
- tl;dr the count is off and no one at BLS has seen The Wire
so what's actually accurate?
- the accurate numbers come from BLS's Quarterly Census of Employment and Wages (QCEW) which pulls from state unemployment records, and covers over 95% of U.S. jobs
- englander: "QCEW is basically the universe, it's not a sample... it's very authoritative"
- but the problem is the long lag: 5-6 Months vs NFP's week
- englander also suggests looking at another BLS source: the prime Employment-Population Ratio (25-54 Yrs), it's a separate monthly survey of 60K households and has little revisions
how do we fix this?
- englander's main suggestion is stop B-D from using historical averaging and leverage incoming dynamic data more
- for example, linking it to general job creation ๐ "Let's assume that the job creation from new firms versus closed firms has some relationship to the job creation that we are seeing from continuing firms"
- my own take: fixing NFP's model makes sense, but QCEW shouldn't take half a year either. we have the tech to speed up state-level processing, or API integrations w payroll companies, or building private federal data hubs like @sriramk suggests
what's the outlook? ๐ธ
- NFA but englander views the near term as bullish, w rough employment the fed has no choice but to cut rates (prediction markets + i agree)
- intermediate term, there's a tough situation for the fed to navigate: lots of upward inflation pressure but also trying to preserve employment and prevent recession
- implied: if we see a boom from the Fed rate cuts or AI productivity, it'll take a while for it to show up in the numbers
@PKycek Mean reversion is betting against the recent trend & breakout is going with it. Both are polar opposite. Youโre just exiting part of your position during breakouts & calling it risk mgmt in the name of mean reversion. Idk how clients give crypto hedge funds any money to manage.
@ElonTrades buddy have you heard of an essential commodity known as Oil? Spike in price of Oil affects every industry & 20% of world's Oil supply passes near Iran through Strait of Hormuz. If there's a significant escalation, buy the dip is fucked to say the least. Risk Management is key
@AdityaRajKaul IND established deterrence due to demonstration of complete Air, Navy and Land superiority over PAK forces leading to capitulation of PAK DGMO asking for "pausing" of fire to IND counterpart (mediated by trump admin & china due to nuclear scare). IND-US trade deal already done.
Utterly incorrect statement by Trump saying trade was the reason IND-PAK war stopped. PAK Air def sys were brutally destroyed in 3 days of war with IND. There was a nuclear spillage threat as IND hit major PAK nuclear facilities along with its airbases. #Trump@AdityaRajKaul
@OZinOZfreedom@IFM_Economist All cbanks are stuck b/w a rock & hard place, cut here & look like a fool if inflation picks up due to tariffs (may or may not be implemented) or stay put & let demand dwindle. Fortunately, there's no systemic risk in Australia like US, so they can afford to wait.
@acllc2 Seems like fake trump news triggered lots of algos which overlaoded the TT servers, brutal if you get stuck in such environment on top of market uncertay.
US 10yr(ZNM5) Fut may bounce a bit here to be ultimately sold after Apr2 Tariff deadline acc to descending triangle, target 2 handles down. This week very imp for big money positioning. @2yrflipper@dampedspring#tariffs#Trump
@amphilomath Been immersed in USDJPY for more than 30 years - not as a tourist but defender of the risk
August 2024 was as mild as they have come.
In the same light, run up from 105 has been their biggest gift ever. Transparent policy, asking you to do it.
1/2