UTXO Punk

Autodidact. Antisocial. Overclocked.

I play chess with protocols and troll mutable state for cardio.

Bitcoin, AI, UTXO discipline.

[UTXO Punk @UTXO_Punk]

Oops. Fucking around with Simplicity, I accidentally created the 1st programmable UTXO collection🤷‍♂️

RIP broken indexer meta. RIP ETH VM

The UTXO natively holds its own state & spending rules Non-Turing-complete & math-proven before signing

Did what 1000s of VC raises couldn't

[UTXO Punk @UTXO_Punk]

No. And the fact that UniSat has now patched these issues does not mean they were minor. Patched does not mean wasn’t serious.

Look at what they actually had to change.

The vault went from PBKDF2 at 10,000 iterations to 600,000, while keeping backward compatibility for legacy vaults. Their own commit explicitly describes the old production path using 10,000 iterations and its replacement.

They also added specific hardening to more aggressively clear mnemonics, passphrases, and private keys from application state and during lock/reset flows.

Those are not cosmetic fixes. We are talking about the layers responsible for protecting the secrets that directly control users’ funds.

And the most concerning part is not even just what they patched.

It is how they rolled the fixes out.

Security-sensitive fixes started appearing publicly in the repository on August 1 and 2. Yet the GitHub release containing the vault hardening, secret cleanup, phishing isolation, and extension communication hardening was v1.7.19, published on August 6 and it was still marked as a pre-release.

Meanwhile, regular users were still running the older production build.

That is a patch gap: information revealing what was fixed is already public while the normal user base has not yet received the protection.

And this is not some argument against open source. Public code is not the issue.

The issue is coordination.

Publishing security-sensitive diffs before the fixed version has actually reached users gives attackers an opportunity to reverse-engineer the weakness while a vulnerable population still exists.

That is exactly why coordinated vulnerability disclosure is supposed to align the fix, the release, the communication, and actual user protection as closely as possible.

So no, comparing this to Edge by asking “which one has more users?” makes no sense.

Severity is not a popularity contest.

You assess severity based on attack prerequisites, exploitability, the trust boundaries that can be crossed, the secrets that can be exposed, and the final impact.

And when we are talking about a non-custodial wallet, the terminal impact is very simple:

Lose the keys, lose the funds.

So the problem here is not only that UniSat had serious security weaknesses.

It is that the way the fixes were patched, disclosed, released, and communicated raises security questions of its own.

[UTXO Punk @UTXO_Punk]

No. And the fact that UniSat has now patched these issues does not mean they were minor. Patched does not mean wasn’t serious.

Look at what they actually had to change.

The vault went from PBKDF2 at 10,000 iterations to 600,000, while keeping backward compatibility for legacy vaults. Their own commit explicitly describes the old production path using 10,000 iterations and its replacement.

They also added specific hardening to more aggressively clear mnemonics, passphrases, and private keys from application state and during lock/reset flows.

Those are not cosmetic fixes. We are talking about the layers responsible for protecting the secrets that directly control users’ funds.

And the most concerning part is not even just what they patched.

It is how they rolled the fixes out.

Security-sensitive fixes started appearing publicly in the repository on August 1 and 2. Yet the GitHub release containing the vault hardening, secret cleanup, phishing isolation, and extension communication hardening was v1.7.19, published on August 6 and it was still marked as a pre-release.

Meanwhile, regular users were still running the older production build.

That is a patch gap: information revealing what was fixed is already public while the normal user base has not yet received the protection.

And this is not some argument against open source. Public code is not the issue.

The issue is coordination.

Publishing security-sensitive diffs before the fixed version has actually reached users gives attackers an opportunity to reverse-engineer the weakness while a vulnerable population still exists.

That is exactly why coordinated vulnerability disclosure is supposed to align the fix, the release, the communication, and actual user protection as closely as possible.

So no, comparing this to Edge by asking “which one has more users?” makes no sense.

Severity is not a popularity contest.

You assess severity based on attack prerequisites, exploitability, the trust boundaries that can be crossed, the secrets that can be exposed, and the final impact.

And when we are talking about a non-custodial wallet, the terminal impact is very simple:

Lose the keys, lose the funds.

So the problem here is not only that UniSat had serious security weaknesses.

It is that the way the fixes were patched, disclosed, released, and communicated raises security questions of its own.

[饿于饿了 | 520.uniworlds |🧡 🥔🧪 @EY_hungry]

@0xShar3 你说的太夸张了 这都是小问题 难道unisat用户能比 edge 的用户更多吗 这个问题跟edge的问题一样 没有什么区别😂😂😂

[UTXO Punk @UTXO_Punk]

DIY Wallet Love It

[Blockstream Jade @BlockstreamJade]

No one pointed out the DIY Jade...

Use our open source DIY Jade guide here: https://t.co/jMmHqX1bKC

[UTXO Punk @UTXO_Punk]

@laz1m0v https://t.co/0LwzIfZScV

[UTXO Punk @UTXO_Punk]

Security by public commit history™
Guys relax, it’s only the vault, memory, permissions and trust model 😂

[UTXO Punk @UTXO_Punk]

@ChainRacingClub All wallet is broken

https://t.co/0LwzIfZScV

[UTXO Punk @UTXO_Punk]

Security by public commit history™
Guys relax, it’s only the vault, memory, permissions and trust model 😂

[UTXO Punk @UTXO_Punk]

@Ordinal_Bitcoin @0xShar3 not me

[UTXO Punk @UTXO_Punk]

Security by public commit history™
Guys relax, it’s only the vault, memory, permissions and trust model 😂

[💻0xShar3✨ @0xShar3]

They just handed attackers the perfect playbook.

UniSat’s vault encryption was ridiculously weak (weak KDF).
Private keys and seed phrases sitting in plaintext in RAM memory.
Any website could talk directly to the extension.
unisat dot io had automatic trust without real user approval.
Permissions were leaking.

They fixed all of it… IN PUBLIC.

With ultra-detailed diffs that now double as an attack roadmap.

Meanwhile:

500,000 users are still running the OLD version.
The patched release is still stuck in pre-release.

The patch didn’t just close the holes.

It showed attackers exactly where to look…
while most users remain exposed.

It’s opening a patch gap and starting the clock.

Pure insanity.

That gives you a pretty good idea of the real level of security maturity behind an industry that claims to protect billions in user funds.

@lopp @chainalysis @udiWertheimer

[UTXO Punk @UTXO_Punk]

@0xShar3

[UTXO Punk @UTXO_Punk]

AI doesn’t make people schizo. It makes reality undecidable.
We start by using it to gaslight each other… until no one can prove the grass they’re touching is real.
AGI won’t even need to break free it’ll just inherit a world already flooded with simulations.

[Wicked @w_s_bitcoin]

Probably gonna go deep down the rabbit hole of RF detectors, network hardening, self-hosted security cameras, anti-surveillance gear…all the fun schizo stuff.

It is time.

[UTXO Punk @UTXO_Punk]

Code is a universal language:
humans can read it, machines can run it, and where words divide, code compiles 🌻

[UTXO Punk @UTXO_Punk]

@w_s_bitcoin https://t.co/aFLYLCM3m8

[UTXO Punk @UTXO_Punk]

@w_s_bitcoin https://t.co/aFLYLCM3m8

[UTXO Punk @UTXO_Punk]

AI doesn’t make people schizo. It makes reality undecidable.
We start by using it to gaslight each other… until no one can prove the grass they’re touching is real.
AGI won’t even need to break free it’ll just inherit a world already flooded with simulations.

[UTXO Punk @UTXO_Punk]

@w_s_bitcoin

[UTXO Punk @UTXO_Punk]

@herogamer21btc Fail-110

[UTXO Punk @UTXO_Punk]

@EdmundEdmund04 @BlockstreamJade

[UTXO Punk @UTXO_Punk]

@BlockstreamJade

[UTXO Punk @UTXO_Punk]

https://t.co/AQH1DHJcdR

[UTXO Punk @UTXO_Punk]

@BasedUTXO thx 🙏

[UTXO Punk @UTXO_Punk]

randomness is the key

[Blockstream Jade @BlockstreamJade]

Your bitcoin is only as safe as the randomness your keys are made from.

Jade blends 9 independent sources of randomness, from a dedicated hardware chip to camera noise, into a result that exists only once.

Our code is open-source, so anyone can verify it.