Autor Cointelegraph by Charles Bennett

Bitcoiners turn to dice throws as self-custody setups are re-evaluated

In light of the catastrophic low-entropy bug in Coldcard hardware wallets, linked to publicly observed thefts beginning on July 30, Bitcoin holders have started to re-evaluate the trust assumptions in their hardware wallet setups. How Coldcard’s entropy flaw workedThe Coldcard devices were equipped with apparently functional STM32 “true random number generators” (TRNGs) that rely on physical processes to produce an unguessable seed phrase.However, after Coldcard creator NVK decided to initiate a firmware rewrite to switch from a GPL-licensed free software model to a read-only model, a serious vulnerability appears to have been introduced.Starting with firmware version 4.0.1, released in March 2021, the device used MicroPython’s Yasmarang PRNG instead of properly using the STM32 hardware RNG.Random number generation is an unsolvable problem in computer science, which is why the generation of secure, unguessable private keys always has to rely on external physical processes to a degree. The use of the Yasmarang PRNG was widely characterized by analysts in the space as a pre-programmed fallback. However, Coinkite has now disputed this characterization in a recent X post: The conjecture that Coldcards were programmed to default to an obviously insecure method of seed generation has also sparked speculation on X about whether this was a deliberately placed backdoor. Investigative Bitcoin journalist Hodlnaut speculated that the bug stemmed from careless development practices and efforts to suppress errors through random changes.Coinkite estimated that Mk2 and Mk3 devices generated seeds with 40 bits of entropy, while the Mk4, Mk5 and Q achieved around 70 bits. Both are well short of the 128 bits required for a secure 12-word seed phrase.Ever since then, attackers have been successfully brute-forcing private keys, stealing over $100 million worth of BTC. How likely a wallet is to be found depends on whether or not additional dice entropy was added, or a BIP-39 passphrase and non-standard path were used. Related: Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixersSince then, James O’Beirne has set up a website with honeypot addresses, titled cktripwire,  in order to estimate which types of wallets attackers are effectively sweeping.Honeypots tracked by cktripwire. Source: cktripwire.comHow physical entropy saved some walletsThe Coldcard exploit has once again painfully driven home one of the community’s core principles: Don’t trust, verify.Those users who did not rely on an opaque piece of engineering to generate entropy for the most security critical part of the process, but used a sufficient number of dice throws, saved their coins from the exploit. Rolling dice is a simple, visibly transparent process an ordinary user can audit themselves and understand intuitively. Verifying the TRNG, on the other hand, would require detailed physical inspection of the electronics and examination of the firmware.   While some have used recent events as a pretext to declare the end of self-custody, following this best practice leaves very few options for a remote attacker.If the seedphrase is generated through physical entropy without relying on the security of the hardware wallet, the only true single point of failure in wallet generation is removed.Related: Do the Coldcard attacks mean all hardware wallets are now insecure?The xpub and receiving addresses derived from the seed can be cross-checked by importing it into other devices.Nonce exfiltration through an airgap can also be caught by checking if two devices generate the same RFC 6979-compliant signature when given an identical unsigned transaction. Secure entropy generation is thus the absolute prerequisite for a secure wallet. Various methods and proposals for generating it have been making the rounds on X since the Coldcard exploit was made public. The most popular method is to cross-check the device’s ability to correctly convert die faces into a BIP-39 seedphrase by applying a SHA-265 hash. Using upwards of 100 dice throws then suffices to generate entropy for a 24-word seed. Simple paper methods, such as the table published by Bitbox, partition the space of BIP-39 seed words so that a combination of six dice rolls and a coinflip can directly be assigned a seed word without using electronics. More sophisticated templates such as the codex32 dice de-biasing worksheet use a van Neumann extractor that can be computed by hand to generate a secure seed phrase even with biased dice.An alternative to throwing dice is to print out the BIP-39 seed words, cut them up into equally sized small pieces of paper, shuffle them thoroughly and then draw random 24 words. Products such as Seedsticks or Entropia make this more convenient and robust.Specialised hardware such as Frostsnap attempts to verifiably distribute entropy generation across devices.  Some users have taken to designing their own physical entropy devices that can generate a seedphrase nearly as quickly as a piece of electronic hardware. Related: Do the Coldcard attacks mean all hardware wallets are now insecure?

Čítaj viac

US Treasury yields rise as TIPS challenge the inflation narrative

Key points: Bond yields have been going up since the beginning of the Iran war, widely attributed to inflation expectations due to energy pricesHowever, the five-year inflation expectation priced into Treasury Inflation-Protected Securities is 2.2% and trending down since MayThe driver appears to be rising real yields with bearish implications for yield-free assets like Bitcoin Continuation of Q2 bond sellingAfter yields reached local lows in early March, US government debt has been undergoing a multi-month sell-off. This week, after the most recent meeting of the Federal Open Market Committee (FOMC), 30-year Treasury yields made headlines by reaching the highest level since 2007. In line with the two-year yield rising 76 basis points (bps) in this window, a September rate hike by the Federal Reserve is priced into the markets at 63%, according to CME FedWatch.2Y, 10Y and 30Y US Treasury Yields. Data Source: Treasury.govWith rates at these elevated levels, government bond investments are, for the first time since 2019, more profitable than cash-and-carry trades in the crypto markets, as per Glassnode’s latest research. 2Y US Treasury yield and crypto futures carry trade. Source: GlassnodeThe mainstream inflation narrativeThe reason for the bond sell-off is commonly taken to be the inflationary pressures from higher commodity and energy prices. The multi-month bond sell-off coincides with the start of the Iran war and resulting closure of the Strait of Hormuz. Furthermore, the daily closes of the two-year US government bond yield, West Texas Intermediate (WTI) and Brent Crude have correlated since March at a coefficient of r=0.44:Daily closes of WTI and Brent Crude against 2Y Yield. Data Sources: fred.stlouisfed.org, EIAWTI briefly rose once again above $85 a barrel on Thursday after President Donald Trump threatened Iran and bonds sold off leading into the FOMC. Nothing about the conflict suggests a near-term resolution, which has led some to argue that higher rates are being caused by inflation expectations.WTI (West Texas Intermediate) oil price chart. Source: Tradingeconomics.comThis has driven loud inflation scares through the mainstream financial press, with recent Bloomberg headlines, such as “Global Bonds Are Reeling as Oil Surge Rekindles Inflation Threat”, “US Yields Hit Two-Month High as Oil Sparks Inflation Risk” or “Global Bond Selloff Worsens as Rising Oil Prices Spook Investors”. Among the ever-inflation-aware crypto and precious metals audience, this narrative is popular, too: Market commentator and Bitcoin influencer The Wolf of All Streets recently posted on X:However, the way other Treasury securities trade does not support the inflation-driven narrative for bond yields.TIPS say rate rises are ‘real’While most analysts and commentators focus on regular Treasury yields for their analysis, Treasury Inflation-Protected Securities, or TIPS, have offered clear signs against the inflation narrative.A Treasury Inflation-Protected Security (TIPS) is an ordinary treasury bond for which the principal payment is adjusted upward in line with the Consumer Price Index for All Urban Consumers (CPI-U). In addition to the inflation-protected principal, each TIPS carries a fixed coupon rate. Thus, unlike for a regular bond, both principal and interest payments are inflation-adjusted.By comparing the yield of a TIPS with a regular, equally dated Treasury, the expectation of future CPI inflation can be estimated as the so-called breakeven rate. And although Treasury yields have been rising, the five-year breakeven rate has gone down sharply since May. Five-year breakeven inflation rate. Source: fred.stlouisfed.orgAt roughly 2.2%, the five-year breakeven expects the Fed to achieve its 2% target in the medium term. However, more telling is that the breakeven rate has been moving in the opposite direction to the nominal treasury yields.While the five-year nominal yield rose 33 bps, TIPS data suggests this was the result of an 84 bps rise in the real yield, partially offset by a 51 bps decline in expected inflation. While the inflation narrative remains a compelling story, the marketplace says otherwise. The real story ought to be a rise in real yields. What it may mean for cryptoGenerally, rising “real” investment returns on bonds and stocks in terms of CPI make non-yielding assets such as Bitcoin relatively less attractive to certain investors. Beyond this, the impact on the crypto market depends on the explanation for higher real rates, of which several are available. Reserve liquidation — No clear impact on Crypto. Higher oil prices widen trade deficits for Asian energy importers. As oil is generally priced and settled in US dollars, shortages in the local eurodollar markets in Asia have occurred, which has put their exchange rates under pressure. The Japanese yen (JPY), Philippine peso (PHP) and Indian rupee (RBI) have all required central bank intervention to defend their exchange rates. As these measures are funded by the sale of US Treasury reserves, this puts upward pressure on bond yields. HSBC’s Frederic Neumann is on record attributing the bond sell-off to FX pressure rather than a verdict on the dollar.Demand destruction — Bearish for Crypto. An oil shock that persists long enough stops being inflationary and starts triggering a recession. Neuberger Berman argued in its second-quarter outlook that investors are underpricing the hit to output from sustained energy prices. The credit contraction that coincides with a recession would be bad for equities and Bitcoin by severely restricting liquidity. In a real sign of recessionary credit events, credit spreads are expected to widen. Cointelegraph reported on possible first signs of this on Wednesday.Related: Cost to insure AI debt reaches record high amid Asian semiconductor tumbleInvestment demand — Likely bearish for Crypto. Real rates may have also responded to expected growth and the demand for capital from the AI sector. Government bond issuance is increasingly competing with the record issuance of corporate bonds from AI hyperscalers. Goldman Sachs Research projects roughly $755 billion of AI capex in 2026 and about $920 billion in 2027. UBS has raised its 2026 investment-grade issuance forecast to $1.8 trillion, with technology supply lifted to $360 billion on hyperscaler guidance. As crypto is competing for a similar pool of capital and investor cohort, this is likely to suppress the sector.

Čítaj viac

Cost to insure AI debt reaches record high amid Asian semiconductor tumble

Key points: KOSPI’s back-to-back circuit breakers wiped $620 billion in two days, worsened by leveraged retail betsHyperscaler CDS jumped from 115 basis points to 162bps in recent months, implying ~12% five-year default odds, with Oracle’s OpenAI exposure the biggest red flagHynix posted a record 60.54 trillion Korean won profit but still missed the 64 trillion won estimateKorea sees two-day, $620 billion wipeoutKorean equities saw the second day of a historic sell-off on Wednesday with market-wide circuit breakers again halting trading. Combined with Tuesday’s drop, the KOSPI has now shed nearly 17%, wiping out $620 billion in market capitalization. This has prompted the government to convene an emergency meeting of its financial authorities. The initial trigger for the sell-off was SK Hynix’s Q2 earnings miss. The stock was down another 4% today, extending Tuesday’s 15% drop. Taken together with Samsung Electronics, the company makes up nearly half of the Korean index. Related: Trade.xyz to cover SK Hynix perp liquidation losses tied to price anomalyCurrent KOSPI sell-off on a high timeframe. Source: Kobeissiletter, Tradingview Among a generation of Koreans priced out of housing and squeezed by a tightening labor market, all-or-nothing bets on high-risk instruments are increasingly popular. This week’s sell-off is hitting risk-loving young Korean retail traders, who have historically had an affection for the crypto sector, but flocked to AI and semiconductor equities in recent months. Korean crypto volumes are down 28%, while the KOSPI remains up 31% year-to-date. With the approval and launch of single-stock leveraged exchange-traded funds for retail trading in May, those retail investors were drawn into the market and have added additional leverage. The assets under management of these products crossed $50 billion in July. After hefty losses in recent days, top policymakers have now apologized for the decision and called for a renewed ban on retail trading for these instruments. The sell-off is a further sign that semiconductor and AI stocks are priced for flawless execution, leaving substantial downside if the sector’s aggressive growth targets are not met. Although Hynix brought in a record 60.54 trillion won ($41.25 billion) operating profit, up 557% year-over-year, this figure fell short of the 64 trillion won analyst consensus. Bond vigilantes eye AI tradeThe semiconductor sell-off is consistent with broader signs of fatigue in the AI trade. The uncertainty accruing in the sector has swept over from equity to credit markets. 5-year credit default swaps on a basket of the five largest US hyperscalers — Amazon, Meta, Microsoft, Google and Oracle — have jumped from 115bps to 162bps in recent months and is now at a record high. These instruments let a bondholder pay a periodic fee to a counterparty in exchange for a payout if the underlying borrower defaults. When compared to equal-dated government bonds, the resulting credit spread paints an even more concerning picture. The market currently implies default odds of 12% for these companies within five years. Sage Advisory said hyperscalers have more than doubled their collective dollar debt footprint since September to more than $360 billion as free cash flow turns negative.The biggest contributor to the credit risk is Oracle after its aggressive AI investments. While the company boasts a massive contract backlog, a significant percentage of it is tied to OpenAI as a single customer, which has struggled to generate cashflow and delayed its IPO.Combined 2026 capex guidance from Alphabet, Microsoft, Amazon, and Meta is now tracking toward $725 billion-$730 billion. Even Alphabet posted its first cash burn on record in the second quarter, at $5.9 billion, despite its cloud unit posting 82% growth. Meta is slated to report Q2 results later today after US markets close.Related: Bitcoin lows pierce $63K as Asia chip-stock crash spreads to Wall Street

Čítaj viac

HYPE falls as crypto funds queue nearly $150M in locked tokens for withdrawal

Key points: Funds queue ~$150M of HYPE for unstaking, $116M from MulticoinHYPE falls 8% to ~$58; withdrawals dwarf thin spot marketSale intent unclear — Jain denies selling, Selini exit tied to HIP-3 shutdownHyperliquid’s HYPE token slid to around $58 on Wednesday in the face of large unstaking events initiated by crypto funds. Data obtained from hedge fund and analytics platform Block Liquidity shows Multicoin Capital holding a combined $138.78 million in staked HYPE, of which roughly 83% — about $116 million — sits in pending withdrawal. That’s as Selini Capital and Galaxy Digital have queued HYPE tokens worth $4.4 million and $29.4 million, respectively, for withdrawal. In addition, a Multicoin-linked wallet also deposited roughly 167,000 HYPE, worth $11.2 million, to Coinbase, possibly to be sold. As of publication, the price had recovered some of its decline, last trading hands at $59.19, according to CoinGecko data. Trading volume in the past 24 hours was more than $415.4 million. Withdrawal queue dwarfs daily spot turnoverThese bulk unlocks will be processed in five to seven days and will result in a nearly $150 million overhang in HYPE’s liquid supply. While perpetuals for the tokens trade around $400 million daily, the spot market for HYPE is significantly smaller. Block Liquidity’s flow tracker recorded just $72.8 million in HYPE spot volume across the roughly 28 hours to Wednesday morning, with 1,463 unique buyers against 982 sellers. Wintermute was the largest net buyer at over $9 million, while the top net seller offloaded $5.2 million.Top buyers and sellers during HYPE’s plummet to as low as $57.39. Source: Blockliquidity.xyzA withdrawal queue nearly double the daily spot turnover helps explain the recent apprehension in the market. HYPE has fallen about 11% over the past week. However, whether the unlocked tokens are about to be sold into the market is far from clear. The unstaking by Selini Capital appears to be linked to the shutdown of the HIP-3 CASH perpetuals markets run by DreamCash. Like many recent HIP-3 deployments, DreamCash’s USDt (USDT)-based markets struggled to attract liquidity, especially as USDC (USDC) became more deeply entrenched in the Hyperliquid ecosystem. Recent: Bitcoin analysis eyes ‘serious volume’ after Binance sees 9K BTC daily outflowLaunching a builder-deployed perpetuals marked under HIP-3 requires staking 500,000 HYPE as a slashable security bond, which can be refunded when the market goes defunct. Selini Capital may decide to sell this HYPE allocation through an OTC desk.Wallet associated with Selini Capital invoking StakingTransfer Method. Source: HypurrScan.io Sale or HIP-3 war chest?While Selini’s recent HYPE unlock represents the shutdown of a HIP-3 market, Multicoin’s HYPE may at least partially be headed for a new deployment. Last week, the firm made its first Hyperliquid ecosystem venture bet by leading a $1.75 million seed round into Trasia. The latter is an Asia-focused, noncustodial trading platform that plans to launch perpetuals for Asian equities. Managing partner Tushar Jain said on X that Trasia is targeting “net new users” unfamiliar with Hyperliquid. He claimed in an X post later on  Wednesday night that the unstaked HYPE was not intended for selling. The market will watch where funds will flow on the July 28 unlock. Although absorption by new HIP-3 deployments or mere asset reallocation remains the base case, HYPE has not yet recovered to its recent highs.Multicoin Capital managing partner Tushar Jain issues clarification. Source: X.com

Čítaj viac

Získaj BONUS 8 € v Bitcoinoch

nakup bitcoin z karty

Registrácia Binance

Burza Binance

Aktuálne kurzy