Uploaded August 2026 | Updated September 2026, 2 weeks ago
🚨 CHECK OUT TBL PULSE: research.thebitcoinlayer.com
In this episode, Demian welcomes back Stacie Waleyko, a bitcoin developer with the Bitcoin Dev Project, on the Coldcard entropy vulnerability and the ongoing theft of funds. Stacie explains how hardware wallets are supposed to source randomness, why affected devices fell back to a weaker software path, and why anyone with funds from a post-2021 Coldcard should move them now. She covers the suspicion that attackers used an open weight model to grind through the reduced key space, how a licensing switch removed the Trezor library that had worked, and why she now points people toward multi-vendor multisig. They also get into covenants and why she argues self custody is not dead.
Get Nik's weekly bitcoin and macro research: thebitcoinlayer.com/subscribe
The Bitcoin Layer is proud to be sponsored by SOUND HSA. A Health Savings Account is the most tax-advantaged account in the US tax code: contributions are tax-deductible, growth is tax-free, and withdrawals for qualified healthcare expenses are tax-free too. But most people leave their HSA sitting in cash, losing purchasing power year after year. SOUND HSA lets you hold real bitcoin inside your HSA instead. Not an ETF, not a paper claim, but real bitcoin secured in multi-institutional, multi-signature cold storage. Use code TBL to waive the fifty-dollar setup fee. Transfer an existing HSA or open a new one today: soundhsa.com
Timestamps:
00:00 What happened with Coldcard
00:48 The entropy failure and which Coldcards are affected
02:50 Why randomness is hard and where chips actually get it
05:07 Move your funds if they came from a post-2021 Coldcard
05:56 The suspicion that an open weight model brute forced the keys
08:03 Open source, the license switch, and the removed Trezor library
11:11 The volunteer red team auditing open source bitcoin projects
12:36 Why single sig is brittle and what non technical users should do
13:56 Multi vendor multisig and racing an attacker in the mempool
16:32 Covenants explained: transaction introspection and spending rules
19:09 Hybrid custody with BitKey, Casa, Unchained, and Anchor Watch
20:37 Self custody is not dead and how to avoid a costly mistake
21:37 Where to find Stacie and the Bitcoin Dev Project
📊 The Bitcoin Layer is a bitcoin and global macroeconomic research firm.
▶️ Subscribe and turn on notifications for TBL on YouTube.
🎙 Subscribe to The Bitcoin Layer on your favorite podcast platform.
🐦 Follow TBL on X: /thebitcoinlayer
Nik Bhatia's Twitter: /timevalueofbtc
Researcher Demian Schatt's Twitter: https://x.com/demianschatt
Lead Statistician Augustine Carrasco Twitter: https://x.com/AugustineCarrB
🚨 CHECK OUT TBL PULSE: research.thebitcoinlayer.com
In this episode, Demian welcomes back Stacie Waleyko, a bitcoin developer with the Bitcoin Dev Project, on the Coldcard entropy vulnerability and the ongoing theft of funds. Stacie explains how hardware wallets are supposed to source randomness, why affected devices fell back to a weaker software path, and why anyone with funds from a post-2021 Coldcard should move them now. She covers the suspicion that attackers used an open weight model to grind through the reduced key space, how a licensing switch removed the Trezor library that had worked, and why she now points people toward multi-vendor multisig. They also get into covenants and why she argues self custody is not dead.
Get Nik's weekly bitcoin and macro research: thebitcoinlayer.com/subscribe
The Bitcoin Layer is proud to be sponsored by SOUND HSA. A Health Savings Account is the most tax-advantaged account in the US tax code: contributions are tax-deductible, growth is tax-free, and withdrawals for qualified healthcare expenses are tax-free too. But most people leave their HSA sitting in cash, losing purchasing power year after year. SOUND HSA lets you hold real bitcoin inside your HSA instead. Not an ETF, not a paper claim, but real bitcoin secured in multi-institutional, multi-signature cold storage. Use code TBL to waive the fifty-dollar setup fee. Transfer an existing HSA or open a new one today: soundhsa.com
Timestamps:
00:00 What happened with Coldcard
00:48 The entropy failure and which Coldcards are affected
02:50 Why randomness is hard and where chips actually get it
05:07 Move your funds if they came from a post-2021 Coldcard
05:56 The suspicion that an open weight model brute forced the keys
08:03 Open source, the license switch, and the removed Trezor library
11:11 The volunteer red team auditing open source bitcoin projects
12:36 Why single sig is brittle and what non technical users should do
13:56 Multi vendor multisig and racing an attacker in the mempool
16:32 Covenants explained: transaction introspection and spending rules
19:09 Hybrid custody with BitKey, Casa, Unchained, and Anchor Watch
20:37 Self custody is not dead and how to avoid a costly mistake
21:37 Where to find Stacie and the Bitcoin Dev Project
📊 The Bitcoin Layer is a bitcoin and global macroeconomic research firm.
▶️ Subscribe and turn on notifications for TBL on YouTube.
🎙 Subscribe to The Bitcoin Layer on your favorite podcast platform.
🐦 Follow TBL on X: /thebitcoinlayer
Nik Bhatia's Twitter: /timevalueofbtc
Researcher Demian Schatt's Twitter: https://x.com/demianschatt
Lead Statistician Augustine Carrasco Twitter: https://x.com/AugustineCarrB
