Do Everything Right, Lose Everything: The Coldcard Catastrophe

Bitcoin's most paranoid hardware wallet — air-gapped, 9-volt-powered, "don't trust, verify" — shipped a broken random number generator for five years, and last Thursday somebody's AI finally noticed. Tyler owned the exact device and walks the whole Greek tragedy: the copyleft license fight that made Coldcard rip out working Trezor code, the 4-letter commit ("runs") that swapped in the broken RNG, the pseudonymous committer who turned out to be the CTO's alter ego, and why his own coins survived (100 dice rolls). Then: if frontier models can find these bugs, who gets the frontier models? We stress-test Anthropic's Glasswing program, invent the rent-a-Mythos audit, and game out the extortion equilibrium. Meanwhile Perp of Fortune goes long SK Hynix at 10× in solidarity with Korea's margin-called masses, and the live board bleeds out while we argue about frontier labs flexing. Chapters: Cold open (0:00) · The boys are back (1:34) · Perp of Fortune: long SK Hynix 10× (2:31) · The Coldcard catastrophe (5:16) · The "runs" commit (14:57) · Is self-custody cooked? (17:30) · The 2×2 from hell (22:38) · Glasswing (25:55) · Rent-a-Mythos (30:36) · Perp check-in (35:54) · The frontier-model pissing contest (40:31) · Book-scanning & distillation (51:01) · Wrap (55:01) Recorded fully remote — three cameras, one live perp dashboard. Our opinions are our own, not our employers'. NOT financial advice; Perp of Fortune is a small real-money account we run for entertainment. If you hold funds on a Coldcard Mk III, move them now. Glossary: Coldcard Mk III = the air-gapped Bitcoin wallet whose RNG was broken from March 2021, seeds guessable, wallets drained. The "runs" commit = the four-letter commit message on the change that broke it, committed by the CTO under a pseudonym during a license-fight code migration. Dice rolls = adding your own physical entropy at seed time; it saved Tyler. Glasswing = Anthropic's program giving select orgs Mythos-class access; the episode's 2×2 puts open source in the worst quadrant. Kimi K3 = the open-weights model the attacker presumably used ("find me a vulnerability and make me a millionaire"). Subscribe for next week: agentic commerce, finally — for very specific bad reasons.