We're not a True Crime podcast. Backdoors that look like accidents are technically interesting, but I find it too implausible to even bring up.
Nobody denies that Coinkite (employees, contractors, CTO) wrote the code. The use of pseudonyms didn't cover anything up.
Now, if this is ever proven in court, or crosses some other evidence bar that makes me take it seriously, I'm happy to do another episode.
quotingAnd they would not have used an API to gather information. Plenty of time to set up such infrastructure locally.
nevent1q…3h47
You can't have someone sophisticated enough to hide underhanded C in a sloppy commit for give years, have that much patience, yet not rug everyone at once.
The game theory just doesn't work: anyone else could have found the bug in the mean time, and their sweep would come as a total surprise to the original exploiter.
A well prepared rug pull by the founders would have had to continuously maintain multiple alternative sweep transactions, in order to fee bump whatever a surprise third party attacker was doing.
I would also expect an attacker with five years of preparation to have immediately coinjoined, spread the loot across utxos and quickly exit some of it.
They would have keep to these logistics secret too for years, yet spend time continuously maintaining it, not accidentally revealing expertise in this, etc.
That's why I consider this a classic conspiracy theory. People look for supporting evidence and clues, assume an all powerful "they", and then either ignore practical logistics like I describe above, or come up with another complicated explanation how that could be avoided.
Meanwhile the simpler explanations remain: some 15 year old in his bedroom with an LLM, someone with a bit more expierence in hacking, or even the North Korea crew that wants a break from hacking shitcoin smart contracts. All of them would simply take the money as quickly as they can. The latter two would realize that people will notice the attack, so they have to make a big sweep first. And that someone else might find the bug too, or even that their LLM provider was eavesdropping and might rat them out, so they can't prepare a total sweep.