The Chopping Block: ColdCard's $100M RNG Hack, AI-Powered Security & Ethereum's Staking Yield Taper
The Chopping Block: ColdCard's $100M RNG Hack, AI-Powered Security & Ethereum's Staking Yield Taper
1 hour agoUnchainedLaura Shin
Podcast1 hr 3 min
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights

If you currently use a Coldcard hardware wallet, immediately generate a new key and move your Bitcoin (BTC) to a secure address to avoid potential exploitation from a historical random number generation vulnerability. Monitor the community debate surrounding Ethereum (ETH) and proposed staking yield changes via EIP-8361 before locking up capital in long-term staking strategies that could disrupt decentralized finance yields. Capitalize on shifting retail momentum by exploring high-growth alternative trading sectors like event contracts and prediction markets on platforms such as Polymarket or Kalshi. Diversify your portfolio beyond traditional crypto spot trading as market volatility cools and retail volume migrates toward these emerging platforms.

Detailed Analysis

Bitcoin (BTC)

  • Coldcard Hardware Wallet Vulnerability: A major security exploit was discovered affecting Coldcard, a minority Bitcoin hardware wallet vendor holding approximately 1% to 2% market share. Nearly $100 million in Bitcoin was drained from user wallets.
  • Root Cause of the Hack: The vulnerability stemmed from a random number generation (RNG) bug introduced five years ago via a C++ firmware change. The devices fell back to a weak software-based RNG instead of using robust on-device hardware RNG, allowing attackers to easily crack and generate insecure keys.
  • Exploitation via AI: Threat actors utilized AI models to scan the open-source code and locate the vulnerability in a matter of minutes, highlighting how artificial intelligence drastically changes the economics of cybersecurity and open-source auditing.
  • Maximalist and Self-Custody Backlash: The incident sparked heavy industry discussion regarding the hubris of the Bitcoin maxi community surrounding open-source audit complacency and the viability of traditional self-custody practices.

Takeaways

  • Review Wallet Security: If you used a Coldcard hardware wallet during the affected five-year period, you must immediately generate a new key and move your funds to a new address.
  • Rethink Open-Source Trust: Open-source code no longer guarantees safety against third-party attacks in the era of AI, as malicious actors can easily leverage frontier models to discover zero-day bugs faster than human white hats.

Ethereum (ETH)

  • Proposed Staking Yield Taper (EIP-8361): A new Ethereum Improvement Proposal co-authored by developers like Pintail and Justin Drake aims to taper ETH staking yield to zero if more than 50% of the total supply is staked.
  • Community Backlash and Economic Concerns: The proposal faced severe community criticism regarding the disruption of nominal yields, the erosion of monetary policy credibility, and the potential to break decentralized finance (DeFi) protocols that rely on baseline staking returns.
  • Stablecoin Competition: The podcast noted that the stablecoin and Real World Asset (RWA) yield complex is currently much stronger and preferred by retail and neobank users over volatile asset staking.

Takeaways

  • Monitor Governance Risk: Sudden changes to monetary and staking policies can severely impact DeFi protocols and leveraged staking strategies. Watch for community sentiment and developer alignment before committing capital to long-term staking lockups.

Prediction Markets and Alternative Volatility Assets

  • Rise of Event Contracts: Non-crypto prediction markets and event contracts (such as those on Robinhood, Polymarket, and Kalshi) have seen massive surges, with Robinhood reporting event contract revenue outpacing crypto revenue.
  • Crypto Volatility Lull: Traditional retail crypto trading volumes have cooled significantly amid a broader lull in crypto asset volatility, pushing market participants toward alternative high-volatility products like prediction markets and equity growth sectors.

Takeaways

  • Diversify Trading Strategies: Consider looking beyond traditional crypto spot trading into high-growth alternative sectors like prediction markets, which are capturing a larger share of retail volume and fee generation.
Ask about this postAnswers are grounded in this post's content.
Episode Description
This week we dissect ColdCard's ~$100M RNG exploit that Claude Code cracked in 8 minutes, debate whether AI just killed open-source security and Bitcoin maximalism, tear apart Ethereum's EIP-8361 staking-yield taper, and unpack Leopold Aschenbrenner's 67% Situational Awareness blowup and CLARITY Act's ethics fight. Welcome to The Chopping Block – where crypto insiders Haseeb Qureshi, Tom Schmidt, Tarun Chitra, and Robert Leshner chop it up about the latest in crypto. No guest this week, just the four of them working through a week where AI quietly rewrote the economics of both security and human psychology, and crypto happened to be standing in the blast radius. This episode: ColdCard, NVK's Bitcoin-only hardware wallet, got drained of nearly $100M thanks to a random-number-generation bug that a one-word commit buried five years ago, and Claude Code sniffed it out in 8 minutes (an open model with no internet found it in 20, for about two bucks). The crew debates whether AI just killed open-source security, whether Nic Carter is right that this is 'the death of Bitcoin maximalism,' and why Tarun thinks maxi devs are 'the RFK of security practices.' Then they take a blowtorch to Ethereum's EIP-8361 staking-yield taper (Tarun: 'the proposal reads like shit'), unpack Leopold Aschenbrenner's 67% Situational Awareness blowup while 4x levered, and wade into the CLARITY Act's ethics fight where a single amendment is the whole ballgame. Listen to the episode on Apple Podcasts, Spotify, Pods, Fountain, Podcast Addict, Pocket Casts, Amazon Music, or on your favorite podcast platform. Show highlights 🔹 ColdCard's Bitcoin-only hardware wallet drained of nearly $100M after a five-year-old random-number-generation bug silently fell back to weak software RNG. 🔹 A single dev swapped C++ macros with a one-word commit message, seemingly just to get NVK's code to compile, and doomed years of keys. 🔹 Claude Code found the ColdCard bug in 8 minutes; open model GLM 5.2, no internet, found it in ~20 for about $2. 🔹 Tarun calls Bitcoin maxi devs 'the RFK of security practices' who 'don't do audits,' branding ColdCard's lack of hardening 'incredibly delinquent.' 🔹 Haseeb warns AIs 'are much less diverse than humans,' so security now scales with AUM while North Korea spends thousands in compute. 🔹 Nic Carter calls it 'the death of Bitcoin maximalism' as Haseeb reads posts from holders who scrimped for three Bitcoin and woke up wiped. 🔹 EIP-8361 from Pintail and Justin Drake tapers ETH staking yield toward zero above 50% staked; the community is 'vomiting all over' it. 🔹 Tarun torches EIP-8361 as 'a truly horrendous post,' arguing constantly changing policy means Ethereum is never credible hard money. 🔹 Leopold Aschenbrenner's Situational Awareness AI hedge fund blew up ~67% while 4x levered, with Robert drawing Archegos comparisons. Hosts ⭐️Haseeb Qureshi, Managing Partner at Dragonfly ⭐️Tom Schmidt, General Partner at Dragonfly ⭐️Tarun Chitra, Managing Partner at Robot Ventures ⭐️Robert Leshner, Founder & CEO of Superstate Disclosures Timestamps 00:00 Intro 01:03 ColdCard's $100M Exploit 05:46 AI, Audits & Bitcoin Maxi Security Failures 12:07 Open Source vs Closed Source in the AI Era 23:21 EIP-8361: Ethereum's Staking Yield Taper 30:34 Hard Money, Post-Quantum & Central Bank Chaos 35:54 Aschenbrenner's Situational Awareness Blowup 44:41 Robinhood Prediction Markets Boom as Hyperliquid RWAs Flip Crypto 51:54 Korea's Bloodbath & the Death of Retail Volatility 55:17 CLARITY Act: Ethics Provisions Are the Linchpin Learn more about your ad choices. Visit megaphone.fm/adchoices
About Unchained
Unchained

Unchained

By Laura Shin

Crypto assets and blockchain technology are about to transform every trust-based interaction of our lives, from financial services to identity to the Internet of Things. In this podcast, host Laura Shin, an independent journalist covering all things crypto, talks with industry pioneers about how crypto assets and blockchains will change the way we earn, spend and invest our money. Tune in to find out how Web 3.0, the decentralized web, will revolutionize our world. Disclosure: I'm a nocoiner.