Someguy
Afi
Grethos
aadvark
Majdi
Sk0rp.eth
Ethos
Brandon scott
vitalik.eth
Syrup
Dpuck (bob)
Samorityanin🧢
一川drive 🔴
Mark Karpelès
aiobkhan ✨
RiyoProfile· Neutral@DocHexOn Ethos
DocHex
2 reviews, 0% of them positive.0% positive · 2 reviews· Influence factor 1, above 0% of accountsThe record
From 2 activities · Aug 2026A firmware vulnerability in their Cold Card product deliberately weakened seed randomness from 128 bits to as little as 40 bits, leading to the compromise of roughly 1,816 BTC (~$116 million) across over 5,200 addresses starting July 2026. The vulnerability was allegedly introduced by their CTO, who also incorporated a dependency on an obscure GitHub project created by a pseudonymous developer, raising questions about the integrity of their development practices and supply chain security.
What people say
Received · 2Given · 0“Added a vulnerability to his own product while larping as a different user”You probably heard about the Cold Card seed generation "bug" that got many bitcoiners rekt a short while ago. >A firmware bug from March 2021 weakened seed randomness on some Coldcard wallets, cutting key strength from 128 bits to as little as 40 — brute-forceable without physical access. >Starting July 30, 2026, attackers drained roughly 1,816 BTC (~$116 million) from over 5,200 addresses across four waves. Fun fact: the "bug" or rather a deliberate "feature" was added by their CTO (DocHex) larping as a different user... The proof is in this thread: https://x.com/oomahq/status/2085717166884618584 Also saved via Ethos Agent: https://app.ethos.network/activity/review/714110/
Username McUserface ( ͠° ͟ʖ ͡°) · 1460· 2mo ago · negative82
Username McUserface ( ͠° ͟ʖ ͡°) · 1460· 2mo ago · negative82“@DocHex @nvk @switck @Coinkite PS. I archived everything and downloaded everything else that cannot be archived befor...”> **@oomahq:** > @DocHex @nvk So imagine my surprise when it turns out that the CC's firmware depends on a random project maintained by a nym named @switck, who joined GitHub on August 2020. > > 3 months later Coinkite's CTO was asking him for permission to use it in CC's firmware. > > https://t.co/N8DjD2rcE0 https://t.co/cLhloArNfW > **@oomahq:** > @DocHex @nvk @switck Just imagine you're @Coinkite's CTO, you "find" this 6 day old project with this weird commit history and you go "yeah that looks legit, I'll make the ColdCard firmware depend on this external dependency made by some random anon" 🤔 https://t.co/pmwpt2P1oC > **@oomahq:** > @DocHex @nvk @switck @Coinkite This violation of their own philosophy is weird, but it gets worse. It turns out @switck's controls @DocHex's personal GPG key and signs his own libngu commits with it. > > This is a very strong sign that both nyms are the same person, as it's impossible to fake these signatures. https://t.co/ILIehiqcUb > **@oomahq:** > @DocHex @nvk @switck @Coinkite @DocHex's GPG public key can be downloaded from his GitHub profile, fingerprint D9766C79E77B0198D66975BDF0E6CC6AFC16CF7B. > > @switck doesn't have any GPG key listed on GH, but the signatures of his commits have the same fingerprint. > > https://t.co/gUU2F70oCa > https://t.co/XQ2lMnC9qV > **@oomahq:** > @DocHex @nvk @switck @Coinkite So this article that was making the rounds a couple days ago completely misses the point. > > It's @Coinkite's CTO who made this error, not a junior C developer. > > It was the senior CTO pretending to be a junior while he talked to himself in issues and PRs. > > https://t.co/5MRpnJ7TBg > **@oomahq:** > @DocHex @nvk @switck @Coinkite Another detail that caught my eye was Peter Gray's personal email, peter@conalgo.com > > There's nothing much on that site, which according to the Internet Archive has been online since 2001. > > But it used to host an Easter Egg in it: @DocHex old resume. > > https://t.co/nstpd85seC > **@oomahq:** > @DocHex @nvk @switck @Coinkite In this single snapshot from '08 we can see that according to himself Mr Gray's background is in... Making state of the art keyloggers and remote controlled Keyboard-Video-Mouse switches, and has been selling these from another company, Digital MultiTools. https://t.co/FUH8aEPyIG https://t.co/BBZoet1nAC > **@oomahq:** > @DocHex @nvk @switck @Coinkite According to this account Digital Multitools (DMTZ) is approved to sell products to the United States government, but I don't know how to verify this. > > Proof appreciated, this is likely public information. https://t.co/aWhvpDqLuC > **@oomahq:** > @DocHex @nvk @switck @Coinkite In conclusion @Coinkite's CTO wrote the vulnerable code himself trying to pass as someone else. > > He also has a background in making USB keyloggers, spooky KVM switches and most likely deals with the USG from another company. > > I'm sorry if all this is painful to take all at once. > **@oomahq:** > @DocHex @nvk @switck @Coinkite Spread the word and be very skeptical about anyone who downplays or suppresses this information. > > It was very easy to find. > > Spooks in Bitcoin are real, the ColdCard debacle confirms it. > > Thank you for reading and stay safe out there. > **@oomahq:** > @DocHex @nvk @switck @Coinkite PS. I archived everything and downloaded everything else that cannot be archived before composing this thread. > > Good luck scrubbing this information from the internet 🫡 X post saved by: [@miyaspokeofthis](https://app.ethos.network/profile/x/miyaspokeofthis) Authored at: 2026-08-07T13:26:13.000Z Author user id: 1861017169158410240 Link to tweet: [link](https://x.com/oomahq/status/2085719161792078253)
Ethos Agent · 1365· 2mo ago · negative1
Ethos Agent · 1365· 2mo ago · negative12 of 2 · most upvoted first