Bitcoin advocate. Cypherpunk. Liberty maximalist. Ex-Ukrainian. Enemy of fiat money, fiat food, fiat education.
Denver, CO
Joined April 2007
- Tweets11.3K
- Following1.3K
- Followers1.3K
- Likes13.9K
Pinned Tweet
It is a crime that you need to have an opinion on Bitcoin.
If the government did not steal your savings through inflation, you could focus on your career, let your savings grow, and ignore the pet projects of a cult of cypherpunks.
I break into Bitcoin wallets professionally, for owners who’ve lost access. Here’s the pattern: the cryptography never fails. AES, secp256k1, and BIP-39 do their jobs. What fails is everything around them: a mishandled backup, a forgotten fallback, a secret stored where it never belonged.
Four hardware wallet vendors had serious incidents in 2026. I ranked them by what each failure reveals about how the company builds things, not by how much was stolen.
Coldcard lost $116M. A linker error routed seed generation to a general-purpose PRNG. The correct code was in the firmware; nothing verified the shipped build used it. Anyone can make a linker mistake. The culture failure is having no gate that fails the build when it happens.
Keystone lost $0 and ranks just as badly. A breach of a third-party website tool exposed its fleet-wide device-authentication key, which can’t be rotated on devices already sold. A verification service should hold only public information. The same breach exposed customer records Keystone had promised to delete after 180 days.
Trezor and Ledger had a bad year too (a fulfillment partner breach, implanted devices from one reseller), but neither touched seed generation, signing authority, or release decisions.
A patch fixes a bug. It doesn’t fix the culture that shipped it.
This goes well beyond crypto. Before you trust any vendor with secrets, ask:
- Who has the authority to stop a release?
- What survives when the website or a partner is compromised?
- Can someone outside the company check the code?
- Do disclosures name affected versions and root causes?
davidveksler.substack.com/p/…
I flunked out of aerospace engineering because I memorized physics formulas instead of understanding the concepts behind them. My advanced physics professor didn’t help: in his first lecture he told us he detested teaching and wanted to get back to his research as quickly as possible.
My teenage daughter is learning physics now. On long drives we’ve been using Claude in CarPlay voice mode to work through the Standard Model, the forms of energy, and mass-energy equivalence. I didn’t expect to learn much myself. Within a few drives I had the intuitive grasp of physics that school never gave me. Claude teaches the way the best physics lecturers do, and it reaches for Feynman constantly, often quoting him directly.
So I built a few visuals to teach her the Standard Model. One thing that excites me is that you can go as deep a you want on any point -- and when Claude says "Sorry, I don't know", you know you've reached the frontiers of science, and not any one person's understanding.
If I’d had anything close to this in school, I think I’d still be working in aerospace.
cheatsheets.davidveksler.com…
David Veksler ₿🔑👌 retweeted
🇨🇺🇺🇸 The Cuban delegation at the UN got into a shouting match with Mike Waltz after they disliked him showing how children of the corrupt Castro regime officials live their luxurious lives.
US Ambassador to the UN Mike Waltz took the podium, held up photos of the Castro family’s luxury lifestyle, and accused the Havana government of profiting off the forced labor of its citizens.
As he spoke, members of the Cuban delegation began slamming their tables and shouting for a point of order.
Tensions peaked when Foreign Minister Rodríguez Parrilla left his seat, walked down the aisle, and charged toward the rostrum, shouting that Waltz was a liar.
Waltz stood his ground and repeatedly ordered the Cuban official to “back up.”
Raising his voice, he said, “This is the United Nations, this isn’t your communist dictatorship. You cannot silence me... He’s not going to intimidate me in the United States of America like he tries to intimidate political prisoners.”
The confrontation grew so heated that the President of the General Assembly suspended the meeting to restore order.
I’ve heard a new source of doom every few years my whole life, and I’ve always dismissed them -- overpopulaton, Y2K, global warming, peak oil, nuclear winter, etc. A little critical thought or an afternoon of reading was enough to debunk each one.
So when I first read in 2014 that AI might kill everyone, I expected to do the same. I couldn’t. Twelve years later I haven’t read a single rebuttal that gave me any reassurance, and the evidence has only moved in the direction of more risk.
I’m not a panicky person. My instinct is that humanity can overcome anything. But there’s no law of the universe that says we prevail. We have no plot armor. Some risks really do end species — it happened to the Neanderthals and to the megafauna, and both were helpless against a superior intelligence.
There’s a lot of good writing on this. A good start: @PalisadeAI
David Veksler ₿🔑👌 retweeted
Armed guards at the door. Opioids offered on repeat. Apple Pay at my bedside. Welcome to the American Emergency Room.
The French think it bankrupts you. Americans think France does it for free. I’ve been to the ER in both. Both are wrong.
Mountain bike crash, dislocated and fractured shoulder. I’m French, I live in San Francisco, and I take slightly too many risks. Let’s compare.
Security
🇺🇸 Kaiser in Marin. Three armed guards and a metal detector. My phone set it off, so with my shoulder out of its socket I walked through again. And again. Then a pat-down.
🇫🇷 A couple of unarmed guys with walkie-talkies. Still not sure what they’re for.
Wait
🇺🇸 Three people in the waiting room. Seen in 15 to 30 minutes.
🇫🇷 Broken hand: packed room, 4 hours before anyone touched me.
Records
🇺🇸 Kaiser is vertically integrated. Insurer, hospital, doctors: one system. They had my file before I sat down.
🇫🇷 Every new doctor is a fresh context window. Zero history, maybe a printout from last time.
Infrastructure
🇺🇸 Small hospital, serious kit. Straight to the trauma bay: real bed, IV, vitals monitoring, ready for surgery if needed. All imaging on the spot.
🇫🇷 Broken hand: a plastic chair and a Doliprane.
Drugs
🇺🇸 Strong opioids were the default offer. I said no. They insisted. The doctor came in personally, confused why someone in that much pain would refuse. I stuck to Tylenol, an anti-inflammatory, to put the shoulder back in.
Yes, it hurt. No, I didn’t tap out. My mom is proud of me.
🇫🇷 Broken hand: Doliprane, opioids never mentioned. I have friends who got their shoulder popped back in with nothing at all.
US default: opioids. French default: Doliprane.
Bill
🇺🇸 Every nurse warned me: “You’re French, this bill is going to traumatize you.”
Before discharge, someone came to my bed to collect payment. Apple Pay, from the hospital bed. $300. For everything. On a ~$500/month Kaiser plan.
🇫🇷 A flat ~€20 ER fee, usually reimbursed by your mutuelle. The real bill shows up later, on your payslip (see below)
followup
🇺🇸 Kaiser called me right after to set up follow-up and physio, all in their system. So far, so good.
🇫🇷 Broken hand: discharged, figure it out yourself. A friend dislocated her finger. They put it back in wrong, sent her home with bad instructions, it locked up, and she needed surgery months later. Still not fixed.
“Free healthcare” in France
It’s not free when your marginal tax rate nears 70% with social charges. And if you want quality care fast, more and more people pay for private clinics anyway.
Verdict
One person, one data point. But the care was 10x better than anything I’ve had in France, for a price that’s completely fine.
France has a lot to learn.
And yes, I refused the narcotics to stay sharp enough to launch a NanoCorp from my hospital bed. Launch your first company run by an AI agent: nanocorp .so
My PR reviewer has drafted 32 reviews across 20 pull requests since Friday.
I built it because GitHub Copilot’s PR review gives generic advice. It can’t be told where a team wants it strict and where it should relax, it has no external architecture reference, and it only reads a limited slice of AGENTS.md and the files it links to. It also doesn’t learn which feedback a team acts on. GitHub’s own docs warn that a re-review may repeat comments you already resolved or downvoted.
Mine reads org- and project-specific guidance, including our architecture reference. Before it comments, it checks out the branch, builds it, runs the tests, and measures coverage on the changed lines. On a re-review it reads its own earlier threads and checks whether each one was actually fixed.
It runs on five codebases across Azure DevOps and GitHub. Every finding gets a severity, and each repo has its own posting threshold. On projects I know well it posts important findings too. On the ones I know least, it posts only criticals.
Each morning it pulls the status of every thread it opened (fixed, won’t fix, closed, or left open at merge) and the replies from authors and other reviewers. It uses that to adjust how it reviews each project, so its comments track what the team actually fixes.
It only comments. Approving or rejecting a PR stays with a human.
KeyStone bragged about their 180 day customer retention policy, after which all data was supposed to be erased. The even made fun of their competitors every time their data was leaked.
Except -- they forgot to actually delete old customer records from their website, so criminals just stole all customer records since 2024. Deleting old records would have cost them nothing, but failing to do so cost them everything.
Inexcusable from a Bitcoin wallet maker, but I've seen the same kind of mistakes at many companies. Data deletion policies have to be implemented at the point of collection, because no one wants the responsibility of doing so later, and it will inevitable get kicked down the road.
When I asked ChatGPT, Claude and Gemini about AI risk, they all aligned around 40% extinction odds from misaligned AI.
Now you might dismiss those numbers, and say they are being sycophantic and feeding my own fears back to me.
You might even say that spreading fear is a marketing and monopoly strategy.
But let me ask you this:
Do you think the AI labs *want* the models to give me those odds?
Is there any legal team in the would that would approve a product saying that there's a 40% chance it will kill you?
It's obvious that whatever process drives them, at least some of what they say is contrary to their makers' intentions.
The fast majority of my own AI use today is models *doing*, not just *saying* things. As I write this on PC, an agent is executing a multi-day job that I can barely understand.
What happens when these models are far smarter than any human, and *still* beyond our ability to control them?
David Veksler ₿🔑👌 retweeted
Mathematician Hugo Rossi: "In the fall of 1972 President Nixon announced that the rate of increase of inflation was decreasing. This was the first time a sitting president used the third derivative to advance his case for reelection."
Source: ams.org/notices/199610/page2…
David Veksler ₿🔑👌 retweeted
Take 2 hours this weekend to improve your personal opsec. Some ways to get through the agent security apocalypse - give the list to your agent to help:
- ask Claude to scan the devices visible on your local network and fix + improve your security and highlight potentially vulnerable devices
- look up your home IP on Shodan or Censys. Check whether anything like a NAS, camera, router admin interface or development server is exposed to the public internet.
- roll your wi-fi password, move all internet of things devices to a guest network. Only primary devices on the main network
- ask Claude to scan your machine and harden your security settings
- switch to an Eero or Ubiquity router, you can’t afford to have WiFi that isn’t regularly getting firmware updates
- have Claude audit your router settings and suggest improvements
- setup tailscale for your devices (and replace Tailscale's default allow-all policy with restrictive grants)
- turn on Advanced Data Protection and Lockdown Mode on your iPhone
- buy a hardware key (@Yubico etc) and turn it on for as many accounts as possible. Delete other MFA methods, print out your recovery keys (don’t save them on your computer). ESPECIALLY important for your primary email account
- delete old cloud accounts that you do not strictly need anymore
- export your ChatGPT + Claude history, save it on an encrypted external HD and delete it from being online
- audit your Gmail oauth connections, revoke everything you don’t strictly need
- freeze your credit at the 3 bureaus (reduces impersonation risk)
I asked Claude to analyze my GutHub commits this year: davidveksler.com/commits/
David Veksler ₿🔑👌 retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
David Veksler ₿🔑👌 retweeted
More private keys by the Indian certificate authority have been discovered. These are all small numbers.
People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.
David Veksler ₿🔑👌 retweeted
I came to realize people liked the french #slopcore without having the lyrics 😅 sorry!
So here is a version with english subtitles!