Bitcoiners, Where Do We Go From Here?
Article brought to you by:
Open a new health savings account or transfer from an existing HSA.
Use code TBL to waive the $50 setup fee.
Learn more at SOUNDHSA.com
Dear Readers,
It feels like a death. That’s the most fitting way to describe the feeling that I felt over the weekend, soaking in the facts of the case. Reading the first-hand accounts of theft victims. I’ve witnessed and experienced ups and downs along this journey, but this one stings in a way that is difficult to describe. As a writer, I will do my best to capture what can be said in this moment, and I hope that today’s letter is able to help the Reader in some way.
Likely hundreds or thousands of people have lost large sums of bitcoin, currently valued around $100 million but that number is fluid. Some of the questions we are all asking ourselves in this moment include:
Is bitcoin going to survive the AI era?
Is bitcoin private key generation vulnerable at large?
Is the COLDCARD bug and theft this cycle’s capitulation moment, wherein a cohort within bitcoin give up and leave?
Who is responsible ultimately for this loss?
Were there signs?
Should we give up on self custody?
Let’s try to answer each of these questions, but they are meant to be open-ended.
My journey with self custody bitcoin
Increasingly, I feel that it is my responsibility to share with people my own practice. Over the years, I have advocated for a diversification of storage techniques, essentially what I practice for myself. That means custody is split between self custody and custodians in a way that suits me and my family. I have given many people the advice to buy and hold on exchanges, some of which I regret recommending. I have told many to simply buy IBIT as an ETF in a brokerage account is an easy way to allocate to bitcoin for most traditional investors.
On self custody, The Bitcoin Layer has been sponsored in the past by Foundation, the maker of a hardware wallet (we’ll come back to Foundation shortly). We have also been sponsored by Blockstream in the past and marketed their hardware wallet as well. I am extremely quick to admit that aside from character and industry reputation, I do not have any secret methodology or in-house expertise to technically audit products that have come to us for advertising opportunities. In short, if this bug happened to have been in another device made by a company that sponsored my company, I wouldn’t have known.
Readers then might, and rightfully so, point blame at me for presenting them a product that led to severe financial loss. Just knowing this could have happened is haunting me, and imagining what others must be going through who presented COLDCARD to their viewership hurts.
During the FTX saga of November 2022, I was out of the country when I panicked about a particular storage method I had chosen (not self custody). Using the blockchain outside of your controlled environment is downright scary. There are other situations I’ve been through that still haunt me. All this is to say that using bitcoin can be stressful and complicated to those with lots of experience. Bitcoin is nothing like dollars, gold, or any paper asset tied to the legacy financial system, and this brings about a risk vector that keeps most people away.
I grew up in a bitcoin era where self custody was much more important than it is today…for the majority of Americans that don’t believe an asset seizure is likely. For those that do, or even those who believe it is the realm of possibility, yours truly included, self custody is important. For many outside the United States, not only is self custody important, it is the only value proposition of bitcoin.
With a global audience, and a readership that stretches across generations, TBL has never been a one-size-fits-all approach to bitcoin. But as of today, the days of “trusting” yourself with self custody are seemingly over in an era in which AI agents can exploit bugs to a catastrophic degree.
In the spirit of providing transparency because I think it is important during a time like this, I write to tell you that I too used the blockchain this weekend. Out of pure fear and additional diversification of storage. This reminds me of 2022 because I didn’t necessarily have to but wanted to. In 2022, it was removing custodians from the picture. In 2026, it turned out to be involving custodians to a greater degree. My IBIT position is untouched, but I am thinking about increasing it due to a stronger desire to harness the value of the underlying capital for income generation through the options market (TBL Model Portfolio is designed to help both me and you achieve stronger returns).
Hopefully this dance between custodians and wallets gives you some perspective on where I’m coming from today. Now for some opinions on what has unfolded.
There were signs
Stories from victims are trickling out. No, we don’t know for sure if all these stories are real, but there are real victims that are reaching out publicly to share their stories. Here is one I stumbled upon:
It is so sad to read, and there are many such cases. If you want a solid overview on what we know so far, this morning I recorded an episode with Galaxy’s Alex Thorn to help us understand some of the logistics of what went wrong and how these criminals operated.
We also plan to interview a veteran bitcoin developer this week for additional technical information, so please make sure you are subscribed on YouTube (or Apple Podcasts or Spotify).
The sad and scary thing in all of this is that there were many signs that Coinkite wasn’t a good citizen, but the industry at large completely failed to bubble this up to the top. But the only individual person that I can consciously assign any blame to in this entire saga is Rodolfo Novak, CEO of Coinkite. Novak is also known as “NVK,” his Twitter handle.
Quickly, here is the mainstream news picking up the story if you are looking for the headlines before continuing.
I don’t know Novak, never met him, spoke with him, or appeared alongside him on a podcast. I’ve never owned a Coinkite product. We obviously have never taken a sponsorship from them or else we would have to immediately admit fault and reach out to every reader that might have possibly purchased a COLDCARD.
With that being said, I have always considered COLDCARD one of the top hardware wallets in the industry because people said it was. Without verification, because how am I supposed to understand the entropy process within a hardware wallet on my own? Of course I am not expected to know, but that is also why private key generation and storage is such a sacred practice that should be saved for the capable. As this week passed, my confidence in such a practice is severely diminished, and that is coming from somebody who has used all sorts of bitcoin wallets, from software wallets, to paper wallets, to devices which ended up being simply not to my taste.
Even though they are not my favorite way to custody bitcoin, I realize that they are practical for many people and that self custody and hardware wallets go hand-in-hand for many if not most. So when looking for sponsors for The Bitcoin Layer, we connected with Foundation, a company whose CEO, Zach Herbert, has a long history with NVK and Coinkite. I will let Zach tell his story, and I include it here because I think it is important background to the idea that this was possibly avoidable. While a “bro” culture developed around NVK, COLDCARDs, and the people who recommended them left, right, and center, people like Zach waved a red flag at the behavior and business tactics of Coinkite. Specifically, the language used by NVK was at times flagrant that it could have raised caution to potential customers.
In the end, Zach’s warnings on how people were behaving proved to be the difference maker for me. At the time, I believed that Foundation had identified a bad actor, and I did my best to steer away. That does not make me some grand visionary, but we have to listen to our gut and trust the human interaction and first impressions when assessing who we associate with.
In case you thought that NVK was some hero on a pedestal in the bitcoin industry, he wasn’t, and the record shows this. Thank you to Zach Herbert for telling his story, something that I didn’t want to have to recount myself years later in a second or third hand way.
Don’t blame people who bought a COLDCARD. I don’t think most that promoted the product deserve any blame, while I hope they are reaching out to their audiences with the appropriate caution. I don’t think the investors are to blame as long as they themselves weren’t vouching for the technical prowess of Coinkite products. My point is there is always blame to go around, but people make mistakes. As far as NVK goes, however, it is fairly clear to me that there was some extremely shady behavior going back several years. Based on my judgment and reading everything I could have over the past few days, it appears as if this entropy bug could have been addressed but problems were swept under the rug by laziness, hubris, and this bro culture of protecting the personality and reputation of NVK himself. That is my takeaway in the early days here, that Coinkite’s CEO is the most obvious fraud in the history of bitcoin hardware wallets. It is not only sad but infuriating. A guardian angel (literally) sent me Zach Herbert years ago (you know who you are dude! ❄️), and for that I am grateful. I count my blessings, but I know that it could have swung the other way.
NVK must face justice, and hopefully the justice systems of the United States and Canada can find a way to provide it to the victims, whether it is a monetary restitution or something beyond. I cannot straight accuse NVK of criminal activity because that would be too categorical, but my oh my is he going to have some explaining to do. I genuinely believe it will be with a lawyer by his side in front of government employed prosecutors. And I pray people get their money back. Their bitcoin back.
Open ended questions
I appreciate you getting this far, as today’s letter has been a chance to explain, vent, speculate, blame, and just get it out on the page. While nobody has personally reached out to me with a disaster tale, it doesn’t change the fact that I feel pain. It’s a pain felt for the individuals who have lost their life savings, but it also stretches beyond that loss. There is a black mark on bitcoin now, but our job is to determine whether that black mark resembles previous ones such as the FTX collapse, the legacy of bitcoin as a currency for narcotics on the Silk Road, the Trump family crypto money grab of 2024-2025, and others. Or, is this black mark more of a permanent clouding?
I do believe that bitcoin will shake this one off, but there is an AI danger that creeps below the surface that makes this week’s exploit feel different from other thunderstorms in bitcoin’s history.
Now, let’s try to answer some of these big picture questions before we part ways.
Is bitcoin going to survive the AI era?
We don’t know. There is the quantum angle, wherein computers gain the capability of cracking bitcoin’s encryption algorithm family called SHA-2 which was invented by the NSA years before bitcoin was created. AI doesn’t necessarily help achieve quantum encryption by itself, but if AI becomes capable of greater scientific discoveries, it might become an engine on the quantum front. If we reach quantum encryption as society, bitcoin will have to adapt or die. That is a risk, but this lowly rates analyst finds it difficult to assign probabilities to something so far beyond my core expertise.
Is bitcoin private key generation vulnerable at large?
This is the scariest thing for me. What type of random number generation did my wallets use? How can I know that my seed won’t be brute force duplicated? I don’t know, and this by itself was reason enough for me to move some balance away from self custody this weekend. I was not the only one, and I’m curious how people are approaching this post-COLDCARD.
Is the COLDCARD bug and theft this cycle’s capitulation moment, wherein a cohort within bitcoin give up and leave?
I have a suspicion that people will leave bitcoin and never come back, but that this bug probably affected too small of a cohort for it to trigger a mass capitulation. Those events are usually price driven, meaning that it is after bitcoin’s famous 80% declines that you face this type of “giving up” event. Perhaps, and this is my opinion, we already saw our capitulation wave earlier this year as we saw many folks give up bitcoin for the AI world.
Who is responsible ultimately for this loss?
NVK. Others are apologizing for promoting Coinkite, and we should do our best to forgive where we can and unfollow who we choose.
Should we give up on self custody?
Maybe, for some. This is a reminder that bitcoin is a technical phenomenon, and the truth is that the United States has moved to protect bitcoin as a form of property that enshrines it into the traditional financial system alongside shares, bonds, and other commodities. Even real estate. That means that many Americans can allocate to bitcoin via registered products (ETFs) or keep coins on regulated exchanged domiciled in the United States (Coinbase) with more of an assurance of property rights than when I started in bitcoin 10 years ago. Self custody bitcoin now must require a new, higher responsibility regime, and you must ask yourself if you are up for the challenge.
Bitcoin will make it through this saga, but confidence has been shaken across the board. Keep your heads up, and remember that price is truth. Bitcoin’s price has essentially gone unchanged for several days, which is a sign that this event is not the catastrophe for the market that it has been for individuals and families out there.
Until next time,
Nik
Disclaimer
The TBL Model Portfolio, TBL Liquidity Indicator, and all TBL research outputs reflect Nik Bhatia and team’s analytical positioning for the macro and bitcoin environment. They are published for educational purposes only and are not investment advice, not a solicitation to buy or sell securities, and not a recommendation tailored to any individual’s portfolio. The Bitcoin Layer is not a registered investment advisor and does not manage client money. Please consult a professional financial advisor and conduct independent due diligence before making investment decisions.