You've had a dynamic where money has become freer than free.
If you talk about a Fed just gone nuts, all the central banks going nuts.
So it's all acting like safe haven.
I believe that in a world where central bankers are tripping over themselves to devalue their
currency, Bitcoin wins. In the world of fiat currencies, Bitcoin is the victor.
I mean, that's part of the bull case for Bitcoin.
If you're not paying attention, you probably should be.
Yeah, I don't think we can assume everybody's heard.
And I know.
I think that's a bad assumption just because I've been texting people I know have cold cards and they're completely oblivious to what was going on last night.
So, yeah.
Sad day.
Yeah, we've talked under better circumstances for sure.
For those who are unaware, there is a massive vulnerability in cold cards produced after 2021, all models, some worse than others, but essentially the random number generator that creates the entropy for private keys that you produce.
Using the cold card is insufficient. Is that the right word?
Yeah, you could call it deterministic. So the search space required to get the private key to guess the private key basically is highly, highly limited relative to what it should be.
So basically the, you know, funds under the MK2, MK3s with firmware between, you know, 2021 and 2023 are just kind of like dangling in the wind.
And so luckily, if you use dice rolls, you know, if you use, say, over 99 dice rolls to initialize the key, you're you're safe.
And or if you're using a passphrase, which is basically like the 25th word you can specify when you're setting up the wallet.
But if that passphrase is of a sufficient length and complexity, which is longer than most people think, then you may also be safe.
But yeah, those the MK2, MK3s are affected severely to the point where it's like, you know, you need to drive home from work and migrate your funds.
if you're single SIG under one of those without a passphrase, without DICE, or with a weak passphrase.
But we're finding, and it's part of an ongoing investigation as to the current state of the cold card firmware,
which would affect newer devices like the Q, we're finding that the problem still exists there too, but it's partially mitigated.
So estimates right now are that current users of cold card devices are getting about 70 bits of security, whereas you're supposed to be getting 256 bits during key gen.
But that 70-bit number is even going down because we're finding that one of the fallback RNGs that is used to paper over the original defect is actually less random than we thought and is specified by the manufacturer.
And, you know, they may be doing things like zeroing out certain parts of this ID.
And so it might actually be worse than we were thinking last night for current devices.
So my headline for everybody at this point is if you're working off of a cold card device,
after 2021, you need to migrate your funds pretty expeditiously.
If you did all the dice rolls, don't worry.
You're probably in good shape.
But even so, yeah, I think, unfortunately, people should be making moves to get off of the post 2021 devices.
Yeah, I mean, we're trying to find some humor in light of this, but cold card.
Hey, listen, I've been an advocate for cold card for many years.
If you listen to the show, I've recommended it.
I have my cue right here.
I moved my funds off last night.
obviously a managing partner in 1031
were invested in CoinKite, which produces the cold card.
This is very close to home
for me personally, to many people I know that have felt very confident
recommending this in the past.
It seems that the confidence was ill We were joking before It like the cold card souped up two secure enclaves but you mess up one part of it the random number generator so you get a ferrari on top of a lawnmower
engine well pretty devastating i'm in the same boat man i mean i i'm a single sig passphrase guy
on a cold card you know i think mark ii my firmware is older and unaffected but
I love CoinKite. They make great products. But the unfortunate nature of security and
hardware wallets is that you screw up one thing, you screw up the wrong one thing, and
it's toast. And so that's the reason why people have been sort of paranoid in this
department is because you just simply can't trust one manufacturer or one source for your entropy.
You know, when you're doing entropy construction, and this is what I do professionally for the last few years, is you have to be utterly paranoid when you're constructing a private key.
And you can't just click a button and expect that it'll happen, you know.
um so it's yeah it's it's really it's really sad to see because i recommended
cold card left and right you know um the people who i thought were savvy enough uh to use them
and um i'd say like aside from you know getting yourself safe my message to people would be
think about who is a sort of more normal person than maybe you are listening to this podcast who
you've recommended cold cards to who maybe isn't like following bitcoin twitter um you know give
them a heads up if you got them set up with a cold card um i've got a few such people in my life that
i've reached out to yeah that's why i wouldn't that's why i hit you up last night to record this
and I'm distracted right now because I'm about to send out a newsletter
that just covers this as well.
I've got to give one more prompt to my client here to make something very clear here.
But dive into the math.
So you mentioned later versions.
People are saying potentially 70 bits of entropy.
You should have 256, MK2, MK3 after 2021, even less.
I think it's like 30 bits.
it's 20 20 yeah and i mean the nature of the attack i mean this is obviously very much centered on on
coin kite and cold card however um ai comes into the mix i mean this is a new era of security
vulnerabilities and i mean we've been talking about it the better part of a couple years now
on this show and others that these models once they get sufficiently intelligent we'll be able
to uncover these. And it seems like that may be exactly what happened yesterday.
It's totally plausible, man. You know, me and a number of other researchers very quickly,
independently reproduced this just by giving the AI kind of a pointer as to, hey, you know,
between this window of time between these firmware versions, check for an RNG problem.
And Kimmy K3 chewed through it and found it readily.
And, yeah, look, if you're a sort of unscrupulous attacker and you're willing to just sit there and grind through, you know, take any open source Bitcoin software you can and just say, hey, file by file, go through, look at the entire history.
You know, find something that's plausibly an exploit.
All that stuff's going to get unearthed. So somebody I was talking to yesterday put it this way. He said, you know, security by obscurity is going to zero rapidly and everything, you know, the tide's washing out. So it's going to be really wild a few weeks and months and probably years.
outside of Bitcoin, Matt and I discussed
on RHR where there was a water system in Minneapolis that was attacked
with some vibe-coded
LLM attack.
How big of a setback do you think this is?
Well, you know me, man.
I tend to be somewhat pessimistic in the short to midterm.
And my real worry, aside from like the horrible tragedy of a bunch of good people losing their coins, that's obviously horrible.
I a bit worried about the second order effect of this being a hit against kind of the most reputable hardware wallet vendor
you know, among hardcore Bitcoiners, that kind of like rippling out into a notion that, well,
even the smart guys screwed up self-custody. And how can we expect that anybody, you know,
will comfortably solve custody after this point. So I don't necessarily agree with that because
again, if you kind of followed best practices that were recommended, you'd have avoided this pickle
purely by obeying that principle that you can't trust a single manufacturer or you have to bring
your own entropy to the table somehow. But even so, I worry this event is going to get a lot of play
and maybe the general public
is going to be like,
oh yeah, that Bitcoin thing,
that's impossible to keep safe by yourself.
So just got to use a custodian.
I mean, the irony of the whole situation
is with all the eyes
and compute focused on
the cold card repository right now
by the end of the week
and maybe the most secure system
in the space.
But again, the trust is...
Very hard to build, very easy to break.
Yeah, and that's the problem.
And, you know, in some ways, this is a sort of inexcusable error if you are a company making the product that they make.
And so, you know, again, the CoinKite guys are friends of ours, certainly of yours and mine.
And even so, it's like, I think, huh?
What the fuck?
Yeah, it's going to be hard to trust anything that comes out of that brand anymore, you know.
So it's, you know, I mean, the thing like, it feels like every single hardware wallet manufacturer has made some kind of like fatal misstep.
this step again because this domain is just very hard you know let a ledger spilled you know all of
their clients information essentially back what was that like 20. twice okay yeah yeah probably most
multiple times you know bitbox had some pretty um pretty obvious physical defects that allowed key
exfiltration. I don't know specifically if anything has befallen Trezor or not. But,
you know, it's just it's kind of the nature of the game that these things get hit with something.
And even if they aren't obviously hit with something, the very fact that it's a security
critical Bitcoin device means that their whole supply chain is probably targeted.
The companies themselves are targeted for for intervention. So.
Custody is tough, man. It's really tough. And.
I spent many years, you know, hoping we could make it easier with better scripting primitives and covenants and vaults.
But, you know, I think given the community is more fractured than ever, I'm not sure we're going to get there and certainly not in the next year or two.
but I don't know.
I think I think this may light a fire in our people's ass to figure that
figure out how to get that stuff through.
I mean, a lot of
the conversation there's back and forth people on both sides of the aisle.
Like now is not the time to talk about this.
And I think.
Alex B from
from Arc Labs
Arcade was making some good points.
It's like, hey, like, don't worry about obscure covenants
when we haven't even verified like random number generation on
some of these wallet providers.
There's a point there, but again, you're going to,
there's a sort of inescapable point, which is that like, you know,
even if you supposedly verify all the RNGs, like you just can't, you, again,
you can't trust one manufacturer, even, you know, like, look,
I'll pick on say BitKey because that's being touted as like a,
a migration target.
And I think the world of that team, and I know a lot of the guys who wrote that,
They're super smart, but, you know, like, are you really auditing their whole software stack?
You know, like BitKey requires on-device software, you know, it's closed source.
I know a lot of it is open source, but some of their black-end services are closed source.
So it's like, you know, until you move some of that security into the chain itself, you're not going to be able to, like, trust one provider.
And that until we get until we solve that, you know, it's like, OK, well, all right.
So I go to two providers I set up a multi for myself So that that kind of a horrible user experience or a worse one for sure So while yeah I mean Alex point is taken that like there are fish to fry in the auditing department
I think the only categorical fix for a much better UX and multisig level security is going to be something at the covenant layer.
So that's why it's important to kind of keep focus on that.
I do think focus will be coming back to Covenants pretty strongly here.
That's my gut feeling.
And as we've discussed throughout the years, I mean, the Covenants vault conversation has been probably the most consistent, continuous thread that we've had on this show.
The conversation that you and I have had on the show over the last two or three years.
i don't think it is time to have that conversation but i mean bringing this back to like llms and
security that's that's another frustrating thing is like in your mind as somebody who is
a protocol engineer or somebody's building custody systems for enterprises what is the importance of
usually fuzz testing your system with the latest models as soon as they're dropped
Yeah, I'm doing it all the time now, both on the level of like analysis, as well as generating, you know, permanent test fixtures that are really solid, which is that's a total blessing.
It's easier than ever to say, hey, cross test every cryptographic implementation I'm relying on against like two or three other alternatives.
Make sure everything marries up, you know.
oh, and then by the way, run a full audit of my entire system at both the conceptual level
and implementation level. Like that's incredible. And those are the same tools, obviously that enable,
you know, unearthing these kinds of attacks. And so it's the arms race. Like if you're not
a diligent user of the latest AI models and techniques, and you're building this stuff,
then you're at a real disadvantage. And it really points you back in the direction of,
man, this stuff has to be simple and rock solid.
And it's incredibly frustrating. I mean, in parallel to all this happening, we have like the
model wars here in the US and the government stepping in and cucking like Fable 5 and
chat gpd 5.6 and so that's it's like if you're trying to audit these systems you can't use the
american frontier models because you get immediately nerfed and you're forced to figure out a way to
get access to kimi k3 which i think many people are assuming that that is the model that was used
to discover and then exploit this particular vulnerability with cold carb um and uh
What are we doing in the US?
Like the Operation Glasswing, because I know many Bitcoin teams are like, hey, Anthropic,
we have a pretty important system over here in Bitcoin.
Can we get access to this to make sure that we're audited and finding any vulnerabilities
or bugs that may exist?
And I've heard that some teams in space and maybe even core developers got access to it.
But when it comes to something like a system like Bitcoin, we need the ability to audit
this immediately now.
I think people really need to get through their minds that the landscape of defensive
technology has completely shifted.
And the way in which you secure your systems has changed.
And it's being proactive and consistently proactive from here on out.
100%. I was using Kimmy exclusively last night to do the triage and investigation. And I was working with some colleagues and the US-based models were just shutting, blocking up, refusing to go further on certain lines of inquiry.
um you know i don't have a lot to say about the policy side i'm i'm i haven't thought much about
that um i'm sort of a freedom guy and uh you know i i bless i feel feel blessed that we have vpn
technology but um yeah the the fact of the matter is if you're not kind of on the bleeding edge and
you're doing security stuff you're at a real disadvantage yeah um bringing this back to cold
card walking through many scenarios like just thinking of the questions that many people
were just becoming aware of this may have in their mind let's like walk through the scenarios
like going from mk3 past 2021 and like obviously mk4 mk5 q
what's the difference in terms of vulnerability exposure and urgency to move coins and then
beyond that you mentioned the dice so to be clear if you set up a cold card and you added you brought
your own entropy by rolling dice if you did it more than 100 times you're very confident that
you did you should be good you basically rolled your own entropy and are not affected by the
the rng bug that exists on the firmware or existed on the firmware yes they have updated the firmware
um so you can update that too um for mk4 mk5 and q if you want to um
get on get on something that's more secure than what existed yesterday but if you do that if you
just update the firmware that doesn't make you secure you have to create a new private public
key pair and move the Bitcoin from your existing wallet to that new wallet that you set up there.
Yeah. The key point right there is it's not the firmware that's currently running on your
device. It's what you generated your key with. So I could see that tripping some people up.
Yeah. But yeah, we initially thought the red zone was basically cold cards from 21 to 23.
that footprint has expanded because we're hearing about mk4s that have been uh stolen from and we
have some indications of why that might be um but again to reiterate at this point you know
if if you've generated a single sig with no passphrase no dice roll on a wind kite device
post 21 you know you got to get off um pretty expeditiously yes um
Multi-sig. I've talked to a number of people that are using cold cards in a multi-sig setup.
Some are using two MK3s and a two out of three. What are the intricacies there?
There's some nuance depending on if you've ever spent from that wallet, if you haven't.
So if you have a two to three multi-sig using two MK3s or an MK3 and MK4,
just go through those different scenarios. You've only sent Bitcoin to, you've never spent from,
or you've both sent Bitcoin to and spend from?
What is the exposure there?
Yeah, so multi-sig is where it gets pretty complicated.
I think it had helped to maybe step back
and just explain a little bit how multi-sig works
or pay-to-win to script hash or taproot scripts
in general in Bitcoin.
When you spend from a multi-sig,
you actually have to present the script
that locked up the coins in the first place, which means you have to present the pub key
for each key involved in the multi-sig. And so what that can mean is if you're using a multi-sig
with all cold cards and you've used, say, that address before, you've revealed all of your pub
keys. And so an attacker could theoretically grind out all the private keys, you know, and
construct a valid spend and be able to present a valid signature or a valid script.
If you have a multi-sig quorum where you have like any device that isn't a cold card or a coin
kite product, and that has to be part of the critical spend threshold, then you're in good
shape. Basically, your coins are protected by that segment of the multi-sig. So, for example,
if you have like a three of five and you have, not that I hope anybody out there as a consumer
has a three to five, but three or five, but, you know, that would require signing with a device
that isn't a coin kite device affected by this. So you'd be, you'd be in good shape.
If for example, you're like an unchained customer, let's say, and you're doing a two of three.
And let's say that you yourself used two affected cold cards at home. That's sort of an interesting
situation because depending on what unchained does, their pub key may or may not be on the
chain. I don't know. They'd be able to field this question. If their pub key is available,
then you are vulnerable. So I think the safe guidelines there are basically if in your
multi-sig, you have a situation where you could move the coins with only coin kite products,
I would move to get off of that. Because there are a lot of subtleties around, well,
you know are the hub keys out there Aren they out there Don get too clever by half And you know if you have a critical threshold of your multisig that can be provided by CoinShare products
I would just move, don't think twice.
So that's the long short answer there.
And what is the assumed time you,
like again, multisig 203, two MK3s,
maybe the pub keys exposed,
but compared to just a single SIG MK3,
no bring your own entropy, no passphrase.
I've heard that if you have multi-SIG,
you probably have a couple of days
the way these attacks are.
Yeah, that's my inclination to say,
but with this stuff, you kind of have to assume
that now that the vulnerability is out there,
that the entire internet is gonna be just like
grinding on this. And so, yeah, multi-sig is harder to scan for for an attacker, but that's
just a shallow throw more compute at it type problem. Yeah. And I wouldn't back up to that.
And let me reiterate there when I say, you know, if you have a critical threshold of coin kite
devices able to sign for your multi-sig, that is assuming you didn't use dice, you don't have
passphrase and so on and so forth. That's just a kind of naive, you know, single SIG. So,
so don't, if, if you've used 99 dice rolls, you know, on, on some of your coin kite keys,
I have verified by hand that that code path is safe. So you're okay. Um, don't worry about those.
It's really just, yeah, if you just trusted the device to, to give you a good key.
Oh, um,
i'm trying to think of all the scenarios that
oh the the one question like have you heard of any white hats
going after this because it's going to be messy and there was some discussion there was a twitter
space this last night i was listening in on him it was a the moral conundrum a lot of people were
discussing, like, should we run GPU and just sweep the people that are exposed?
Yeah, that's a, that's an ethically gray area that I haven't sat down and put the
right amount of consideration into. I have been contacted by people with prospective
plans for that. I don't know if it's actively happening.
there's obviously the problem of attribution. You know, if you do sweep those funds as a white hat,
how do you then verify back? There's some indication that given into UID, if you bring
the physical device, exactly. If you can present, you know, but that's, you know, the mechanism for
that hasn't been demonstrated to me conclusively. So on the one hand, it's very difficult.
And I personally wouldn't be rushing out to white hat this. But on the other hand,
the real argument for that kind of thing is that there are a lot of users out there who are affected
by this, who probably are not listening to podcasts and browsing Bitcoin Twitter. And those
of the guys that are going to get ground down over the next few weeks if they're not made aware
of the situation. And so that's a real tricky one. Yeah. There's a big ethical dimension to that one
as well as probably like a legal dimension that you need to think through. Yeah. Yeah.
I mean
that's like
does the
collapse in confidence of
the
coin cake hold cards
lead to like a lack of confidence in other
and like it goes back to the importance
like I've been a big believer of multi-vendor multi-sig for this exact reason for for many years
since it's like there's a bunch of people wondering like okay cold card I don't have a
cold card but I'm looking at my treasurer look at my ledger like are these okay and we should
worry like I think no you shouldn't be worried as of right now and maybe we won't ever have to be
worried there's the potential that the way they do their entropy and create their private public
key pairs is is really top-notch and gives you uh enough it gives you 256 bits of of entropy that
is secure and very hard and impossible to break statistically uh improbable to break um
and so if you out there in that situation like do not panic that what i would say Yeah That because that one of the other big mistakes that many people will make
Many people will lose coins by panicking and foot gunning themselves in the process of trying to sweep coins or something like that.
Yeah.
You always want to be doing test transactions of small amounts whenever you're sending anywhere, you know.
And that's crucial to keep in mind.
Yeah.
throughout all this if you're migrating your own stuff.
How do we know that exchanges have secure setups?
Well, I know that a few do firsthand.
But. Yeah, I am not aware of any exchanges that, you know, would be vulnerable to this.
And I would like to think that almost every exchange has put more thought into entropy generation than, hey, we're going to click a button on a consumer device and hope for the best.
Um, but, uh, this, you know, I, this is a wake up call for everybody, including enterprises that, um, you really have to put tremendous amount of care and thought into this part of the process.
And what I've always tried to emphasize to clients is you need at least one component of your entropy that you can physically reason about and that you understand in terms of how it's being incorporated into the entropy.
And so I think probably guys like us, consumers are going to have to start to think about this.
You know, how do we take a very simple piece of code, you know, that we can reason about or have audited by somebody we trust and say, oh, yeah, this is a part of the key now for sure.
Because, yeah, I can see how this event would keep you up at night.
You say, well, why? Why couldn't this happen to Ledger?
Why couldn't this happen to Trezor?
You know, what I will say is that like CoinKite was a very lean, is a very lean company.
And most other hardware wallet manufacturers, certainly Ledger and Trezor have pretty big teams, you know, who are doing a lot of internal auditing.
I mean, Ledger's, you know, there are some phenomenal people there.
This isn't an advertisement for Ledger or anything.
I don't even use a ledger personally, but there are some phenomenal people there who have done some very novel hardware attacks.
The Don John team.
It's like it's.
Yeah.
Joke last night.
It's like they figured out a way to use two hundred fifty thousand dollars lasers to hack a cold car.
But it was.
Yeah.
Exactly.
So, yeah, I mean.
Yeah.
I still think a multi-manufacturer approach for guys like us is a really solid approach.
But as Nick Szabo said, it just echoes all the time, trusted third parties are security holes.
And for something like this, there's a certain level you can't delegate to a packaged product.
Not easy, man. It's really not easy, especially at the enterprise level, thinking about this stuff and designing it. It's a tough thing.
Well, trying to find the silver lining in all this.
I mean, it is.
Horrible.
Disasterous.
But something that Bitcoiners have said for a while,
Bitcoin creates this honeypot to surface these vulnerabilities
because the ability to.
Send the bearer asset and actually have control of it
with no clawbacks,
price that incentive to find these vulnerabilities.
Now with the AI tools,
obviously that is accelerating.
So I'd be interested to get your thoughts
as there's silver lining
where we're going to find these vulnerabilities.
And obviously there's already been collateral damage.
There's likely going to be more collateral damage
in the weeks to come.
But on the other side,
it's darkest before the dawn.
On the other side,
could you see Bitcoin actually being
significantly more secure and the products around it being more secure a
year from now because of the wake-up call that we just got in the last 24
hours yeah it possible this could be like a step along the anti path to essentially discovering the final form right of individual level Bitcoin security
because it's possible that we could get to some kind of deterministic endpoint where,
you know, there's a system or a set of software or an arrangement where, you know,
humans, machines have done all the analysis and have said, yeah, I mean,
if you do it this way with this binary on this platform, like, you know, if it's simple enough,
we could get to a point where ultimately this event has catalyzed a bunch of people to put
put the effort in and create something where you truly can't be hacked unless you get
you know some physical component and then even then you know if if something like this motivates
a re-interest in vaults well even if you do get hacked then you have a
six hour window to, to claw into a, you know, a trusted counterparty, like an exchange.
So, yeah, I think conceivably this, this could be the kind of kick in the butt that the industry
needed to start thinking about some of that stuff. I, you know, there's a long timeline on that. And
right now the community is pretty fractured so um uh i don't know yeah i will say i mean
in terms of like protocol development it certainly is fractured but another silver lining i mean it
was encouraging to see people come together publicly behind the scenes i mean i think it
was i mean i was in dc at an event at pub key and like at the beginning of it i was like oh
what's going on then it became clear what's going on it was just like in the corner on my phone the
whole night like all right all hands on deck and i think there was um it's weird too with bitcoin
there is no ceo to call so it's like people like rob hamilton yourself um portland huddle others
hopping on spaces to try to educate people about all this and i know behind the scenes many people
reaching out one node to many like hey my guy i uh wound up texting a friend
um being like hey are you aware of this he's like no i've been heads down all day
and his brother um is a is a coin or two and was on vacation and like he was able to like go over
to his house like and he had he just sit on a bare single cg mk3 with no dysentropy or passphrase
was able to like move it and so that like was like okay and i think there was much of that going on um
and i think that's the spirit that um we need to lean into heavily particularly as this is
unfolding is obviously there's going to be a lot of uh justifiably angry angry people um
very very much justified but um i don't think this is the time like sling and
and throw people under the bus.
It's like, okay, this is happening.
While it's happening, let's just make sure we get as many people
out of harm's way as possible.
Totally agree.
And this thing is still ongoing, so it's still critical to give people heads up
and just be racking your brain for anybody who may not be listening to podcasts
uh, you know, who has a cold card. Um, because I think probably we're going to continue to see,
uh, you know, funds flow around. Um, so, uh, yeah, I mean, it's, it's, it's hard to,
this, the sentiment thing's difficult because like, there is a kind of like,
um, excitement and camaraderie that comes out of an event like this, but that we, we can only
experienced that because we didn't lose our life savings, you know, and there are people
that happened to, um, and that's horrible. Uh, that's really horrible. Um, it's not,
it's not the worst thing. You know, um, if you're one of those people, uh, God has a plan and,
um, you need to keep that in mind. Um,
But, yeah, it is good to see the community kind of reorient in certain ways and come back to, you know, the real stuff of Bitcoin rather than, you know, gathering about 110 or whatever.
No.
I think we need to keep the shore.
Is there anything we missed?
We should be getting out there.
I mean, it's probably we should keep it short so we can get out there to people as quickly
as possible.
No, I mean, I think we hit the headline.
You know, there's obviously tons of technical detail you go into, but the investigation is still ongoing.
So, you know, again, my headline is if you have a coin kite device post 2021 and you didn't use dice rolls, don't have a super strong passphrase that, you know, is cryptographically strong.
You know, you need to expedite getting your funds.
My, you know, my recommend recommendation for a lot of people would be find an exchange that you trust.
And just if you don't mind doxing yourself, park park your funds there while you figure out what the long term is and just kind of get out of Dodge.
Do a small test transaction.
You know, don't don't panic.
Don't don't rush anything.
But, you know.
Steady is smooth.
Smooth is fast.
Yeah.
Just to clarify, if you're sitting there, like, did I roll the dice enough?
Is my passphrase strong enough?
If you have 99 or more dice rolls and you did it correctly, you're confident in that, you should be fine.
Passphrase, if you have six or more VIP 39 words as a passphrase, you should be good.
Is that the thresholds that are correct there in my mind?
sorry repeat uh uh password criteria six six bit 39 words or more um
uh maybe i i wouldn't uh i wouldn't enjoy on that per se because there you know
there are things like are you mixing case for that um uh you know each bit 39 word is like a
drawn from a set of 2048 So 2048 times six isn a big search space That why passphrases are tough because something you might think is pretty strong like given enough GPUs is not
Okay. So unless you're like a specialist and you know your passphrase is like crazy and strong,
I would not rely on that. I'll be moving my small number of fractional Bitcoin around,
even though I'm not affected by the firmware version and I have a strong passphrase. But
even so, out of an abundance of caution, I'm just going to be moving.
All right. Well, I hate that we had to meet here under these circumstances,
but I really appreciate that you hopped on to walk through this.
We'll get this out and warn people about all this.
Of course, man. Yeah. Good to see you.
Good to see you too. Peace and love, freaks.
Thank you for listening to this episode of TFTC.
If you've made it this far, I imagine you got some value out of the episode.
If so, please share it far and wide with your friends and family.
We're looking to get the word out there.
also wherever you're listening whether that's youtube apple spotify make sure you like and
subscribe to the show and if you can leave a rating on the podcasting platforms that goes a
long way last but not least if you want to get these episodes a day early and ad free make sure
you download the fountain podcasting app and go to fountain.fm to find that five dollars a month
get you every episode a day early ad free helps the show gives you incredible value
so please consider subscribing via fountain as well thank you for your time and until next time