Don't Trust. Verify.
The Coldcard exploit isn’t just a vendor failure. It’s a community failure.
The code was available, and everyone trusted the reputation, the marketing and the assurances—but too few of us actually verified.
With AI-assisted auditing, nearly anyone can now examine open-source software and help find bugs like this. Instead everyone vibe coded new toys.
Open source only protects us when we inspect it.
It's a harsh lesson. Our hearts go out to everyone who has lost sats.
npub1v6…jj4rp
2026-07-31 13:27:03 UTC
Author Public Key
npub1v60thnx0gz0wq3n6xdnq46y069l9x70xgmjp6lprdl6fv0eux6mqgjj4rpSeen on
wss://nos.lolPublished at
2026-07-31 13:27:03 UTCEvent JSON
{
"id": "a5a46b709f6034f92e79d70c9ff4749fab90d3c8bb908b54f1e7258e360e836c",
"pubkey": "669ebbcccf409ee0467a33660ae88fd17e5379e646e41d7c236ff4963f3c36b6",
"created_at": 1785504423,
"kind": 1,
"tags": [
[
"r",
"wss://lnb.bolverker.com/nostrrelay/666"
],
[
"r",
"wss://relay.artx.market/"
],
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://nostr.chaima.info/"
],
[
"client",
"Primal Web"
]
],
"content": "Don't Trust. Verify.\n\nThe Coldcard exploit isn’t just a vendor failure. It’s a community failure.\n\nThe code was available, and everyone trusted the reputation, the marketing and the assurances—but too few of us actually verified.\n\nWith AI-assisted auditing, nearly anyone can now examine open-source software and help find bugs like this. Instead everyone vibe coded new toys.\n\nOpen source only protects us when we inspect it.\n\nIt's a harsh lesson. Our hearts go out to everyone who has lost sats.\n",
"sig": "df2768232d8edabc1b08e330438651b93ef7413f954264dce51812b70d2cba1b91d0691fde3d5c101f052a4dd7a88e121f8f766bc8999bafcb80f8889c35b108"
}