Foot-gun = no fun.
I ran a small Cashu mint for 1 year. Yesterday I found it empty. About 1.5M sats gone, and only around 247k had ever been put in.
Nobody broke into my server. Nobody touched my node. I did this to myself.
The setup file that comes with the software has a line that says, in plain words, "put a random key here." It even tells you the command to make one. I did not run the command. I pasted the instruction itself in as my key and hit go.
It started up fine. That was the problem. For months my mint's secret key was a sentence that anyone who has ever opened that setup file has seen. Eventually somebody noticed, used it to print themselves fake money from my mint, and cashed it out.
I was stupid twice.
Once, because I never read the one line you are supposed to read twice.
Twice, because I saw it start and took that as "it's safe."
Nutshell software does refuse to start on a couple of obviously fake keys. It just does not refuse its own example. Should it? Yes, and I have sent them a fix.
Should I have checked instead of assuming? Also yes.
If I never looked at what the guard rail was, I do not get to blame the guard rail.
The mint is off for good.
Open source is retards helping retards. This week I was the retard. So here is my turn helping: a fix and a warning. I still believe in this stuff. The bug that got me was in a file I could open, read, fix, and send back the same day. That is the whole point.
calle (npub12rv…85vg)
BTCforPlebs
npub1w4…4382j
2026-09-19 15:41:48 UTC
Author Public Key
npub1w4rz7n0vunaau499xh86p84s6v5mmgys48p0nmttt7w36takc9dsf4382jSeen on
wss://nos.lolPublished at
2026-09-19 15:41:48 UTCEvent JSON
{
"id": "0000826c508055649737c1072d03bcf1b97b45010c14da4b947ce63cadb47eaa",
"pubkey": "75462f4dece4fbde54a535cfa09eb0d329bda090a9c2f9ed6b5f9d1d2fb6c15b",
"created_at": 1789832508,
"kind": 1,
"tags": [
[
"p",
"50d94fc2d8580c682b071a542f8b1e31a200b0508bab95a33bef0855df281d63"
],
[
"client",
"Nostr Vault on iOS"
],
[
"nonce",
"29312",
"16"
]
],
"content": "Foot-gun = no fun.\n\nI ran a small Cashu mint for 1 year. Yesterday I found it empty. About 1.5M sats gone, and only around 247k had ever been put in.\n\nNobody broke into my server. Nobody touched my node. I did this to myself.\n\nThe setup file that comes with the software has a line that says, in plain words, \"put a random key here.\" It even tells you the command to make one. I did not run the command. I pasted the instruction itself in as my key and hit go.\n\nIt started up fine. That was the problem. For months my mint's secret key was a sentence that anyone who has ever opened that setup file has seen. Eventually somebody noticed, used it to print themselves fake money from my mint, and cashed it out.\n\nI was stupid twice.\n\nOnce, because I never read the one line you are supposed to read twice.\nTwice, because I saw it start and took that as \"it's safe.\" \n\nNutshell software does refuse to start on a couple of obviously fake keys. It just does not refuse its own example. Should it? Yes, and I have sent them a fix. \nShould I have checked instead of assuming? Also yes. \n\nIf I never looked at what the guard rail was, I do not get to blame the guard rail.\nThe mint is off for good.\n\nOpen source is retards helping retards. This week I was the retard. So here is my turn helping: a fix and a warning. I still believe in this stuff. The bug that got me was in a file I could open, read, fix, and send back the same day. That is the whole point.\n\nnostr:npub12rv5lskctqxxs2c8rf2zlzc7xx3qpvzs3w4etgemauy9thegr43sf485vg ",
"sig": "ee319fe1de205ab0ce5082cd807b1992de981d413f02d2431e210d422034e4ec65e9892f5d9a69100926bb86695b1969ad3b1a5c6426250b3cc8ad6777a2e7e7"
}