Joined October 2023
- Tweets1.7K
- Following1.6K
- Followers283
- Likes21.3K
cyberphunk retweeted
It’s not meant to be endlessly interesting. It’s meant to be predictable and simple. What grabs and sustains our attention is unpredictability. You can’t solve the biggest problem of all, broken money, with something that’s unpredictable.
cyberphunk retweeted
I know multiple people who basically quit working on Bitcoin because of how stressful it is to maintain software that handles money nowadays.
I tell them all the same thing: What do you think will happen if we all quit and become gardeners? Are we just going to give up on the internet? Do we just accept fiat as the end game? Are we just going to let go of the dream of an internet that doesn't exploit your humanity and take away your rights to privacy and self-determination?
I know, fuck, it is hard. But you're not alone.
We must fix this. Nobody else is there to do the necessary work. If we stop doing this, we're 100% doomed. I can guarantee it.
But if we continue, we have a chance.
I incidentally migrated away from Ledger yesterday, but thought I’d open up my Nano S and check…
Glad to see it’s barren inside, tiny board.
Got it directly from ledger.fr in 2017 and all I had to pay for it was the product price + the threat of a wrench attack.
cyberphunk retweeted
Finally, the American justice system joins the proud ranks of al-Qaeda, Taliban, and Los Zetas cartel.
Breaking news: The firing squad execution of Fort Hood shooter Nidal Malik Hasan will be live-streamed, the Defense Department said.
“People need to understand that there’s serious consequences for these types of things,” Defense Secretary Pete Hegseth said. wapo.st/4hNxK0C
cyberphunk retweeted
There are a couple of reasonable observations buried in this. A classical break of ECDSA is arguably a more interesting tail risk than the imminentQDay slop, and address reuse is bad practice regardless and not a problem for most bitcoin users. Exchanges are probably the most conspicuous offenders and should have stopped reusing keys long ago.
But none of that gets you anywhere near _months, not years_ away from breaking ECDSA 🤡
Progress on integer multiplication, 3SUM, or the Erdos unit-distance problem provides zero evidence that an efficient algorithm for elliptic-curve discrete log problem is around the corner. No new attack is presented here. No complexity bound has changed. No meaningful reduction in the work factor against secp256k1 has been demonstrated. We have simply gone from "AI produced surprising mathematics" to "therefore perhaps ECDSA collapses within months."
the existence of Shor's does not constitute evidence for an efficient classical analogue. It establishes that such speculation isn't logically impossible, which is a fucking low bar for declaring "bunker mode."
None of this is an argument against sensible precautions. Don't reuse addresses. Rotate exposed keys where practical. Develop and test post-quantum migration mechanisms. Those were good ideas yesterday and remain good ideas today.
But attaching a months-long countdown to ECDSA without presenting a single cryptanalytic result that changes its security is _fearmongering slop_ at it's finest
And I'm certainly not going to fall victim to Brandolini's law every time the Ethereum Foundation LARPs its way into a new cryptographic apocalypse.
Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.
Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase).
Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets.
IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster).
Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot.
Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time?
Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.)
Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once.
Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case.
I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026).
Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS.
Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security.
The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.
cyberphunk retweeted
Of course, we can’t prove that EC discrete log is hard, since we haven’t been able to prove P neq NP. But just throwing out - AI is doing amazing math so elliptic curve hardness is in danger has no logical basis whatsoever. 3/n
cyberphunk retweeted
Superbacked 2 is open source and absolutely packed with features you won’t find anywhere else. Check it out! youtube.com/watch?v=0rEqaUnW…
cyberphunk retweeted
.@signalapp just take Lightning payments and stop messing around.
Signal is testing a major privacy feature:
You can create a Signal account without a phone number.
The new numberless registration uses an Account ID and Account Key, with an optional username.
There’s a small catch: it requires a one time fee of around $3 to help prevent spam.
The payment isn’t directly linked to your Signal account. Signal says it uses the same zero knowledge proofs as its donation system to ensure there’s no link between the payment and the account.
For now, the only payment method is Google Play, which requires Google Play Services. Signal says it plans to add other payment methods in the future.
A pretty significant step for privacy, even if the current implementation still has a Google dependency.
Would you use Signal without a phone number?
community.signalusers.org/t/…
#Signal #Privacy #OpenSource #DeGoogle
cyberphunk retweeted
People killed by AI: zero
People killed by governments: millions
Let's give control of AI to the governments and call it safety
cyberphunk retweeted
SEPTEMBER 11
The smell is still in my nose.
Twenty-five years later, if I think about it, I can still smell the electrical and chemical fire smoke from that morning.
cyberphunk retweeted
In case you didn't know and windered why bitcoin doesn't have confidential tx:
hidden inflation bugs in monero have always been the concern.
Liquid hack explained.
Liquid has confidential transactions that hide the amounts for improved privacy. A bug in how these transactions are validated caused inflation of Liquid BTC (L-BTC) and allowed hackers to empty the entire side chain.
Liquid nodes don't see the amounts of a confidential transaction, so to make sure that the transaction is still valid and doesn't cause inflation nodes check something called a balance proof and a range proof.
The balance proof establish that sum of the input amounts equal the output amounts, i.e., that "x L-BTC going in and x L-BTC going out". But there's a catch. Only relying on a balance proof isn't enough. You also need the range proof.
The range proof establishes that a hidden output amount falls within a positive range. That means a valid output must be at least 1 L-sat and at most 2^64 − 1 L-sats. Range proofs make sure that you can't mint "negative L-BTC".
Why is this even necessary? Remember, the amounts are hidden and a hidden negative amount would allow extra positive outputs to balance against it. Without a range proof, a transaction could say "I've put 1 L-BTC in, and I'm taking two outputs out: one with 4000 L-BTC and one with -3999 L-BTC)."
This is going to cause a disaster in a little bit.
Once the balance proof, the range proof, and other validations pass, a transaction is regarded as valid and can pass consensus. However, because especially the range proof is computationally expensive, Liquid nodes cache the result of a successful range proof in memory. Essentially, the node remembers "I saw this range proof before and it was valid, all good!".
In order to recognize the same range proof later on, you need to assign a label to it. This is called a cache key. This cache key is the actual cause of the bug.
The way this cache key was constructed allowed two different transactions to collide on their cache key. Essentially, one valid transaction (1 L-BTC in, 1 L-BTC out) had the same cache key as an invalid transaction (1 L-BTC in, 4000 L-BTC out).
Here's the hack: the attackers submitted the valid transaction (1 L-BTC in, 1 L-BTC out) first. Liquid nodes verified this transaction successfully, created a cache key called REKT and stored it in their cache. Then the attackers carefully crafted a second invalid transaction with (1 L-BTC in, 4000 L-BTC out) that created the same cache key REKT.
Instead of validating the second transaction and realizing that it printed money out of thin air, Liquid nodes found it in their cache and said "hey I saw this transaction before, everything is fine" and that caused the inflation.
The attackers then took their 4000 L-BTC and withdrew 4000 BTC onto the Bitcoin base chain.
Note: I might have gotten some details wrong, and I'm aware that I simplified quite a bit. I wrote this post to help people understand what happened. Please feel free to correct me in the comments or add more details below.
cyberphunk retweeted
They've been doing it for a long time. I pressed @LawrenceLepard on this Monday on Café. What's different now? My summary, Larry can correct me: previous prints in the past several decades have been done to rescue sectors of the economy. The difference now is that it's not just a sector of the economy, it's the money itself.
cyberphunk retweeted
For years we've been screaming from the mountain tops about how insanely dangerous mandatory ID verification is.
Now that half the country is doxxed, it would be a good time to take note of the politicians who didn't listen.
Try quitting the app. It crashed on Apple TV and now it restarted, it's no longer stuttering.
I didn't have this problem yesterday.
@F1Help the latest TV update introduced video stuttering and audio-video sync issues
cyberphunk retweeted
Flock takes their privacy very seriously.
But the ethical gray area in surveillance technology works both ways.
Under no circumstances should elected officials or public servants enjoy an expectation of privacy when spending tax dollars to attend a surveillance lobbying event.
cyberphunk retweeted
Flock routinely rewards themselves for being the most transparent company in the industry.
Last week they banned ticket-holding journalists from their Flock Forward event.
Then, they quite literally had an employee contact a hotel on my behalf and cancel my room reservation.
cyberphunk retweeted
It appears to be @DocHex based on gpg sigs! But otherwise that persona was a complete unknown, seemingly a one-off for working on the libngu repo
cyberphunk retweeted
I haven't told the full story yet, but I came to the same conclusion back in May 2025 when I started doing an audit of `coldcard/firmware`.
I wanted to figure out conclusively where the CC RNG was getting sourced from, and found that it backed up to some shady library called libngu (github.com/switck/libngu) that had literally 6 stars on github and was maintained solely by a pseudoanon tranny.
I knew from past experience that linking to libsecp256k1 from Python was pretty easy, which seemed to be the stated purpose of the library use, and so I was confused about why it was there.
I sent a report to the CC team that I had doubts about whether the true RNG was actually in use, and pointed out that the hardcoded yasmarang constants in libngu were sloppy. I advised they rip the whole thing out and link against libsecp256k1 directly.
I was told that if something was wrong "we'd already know about it by now" and that everything was properly configured for the real boards.
I didn't follow up rigorously, which was a horrible mistake on my part.
