6 entries tagged security. All writing.
SEPTEMBER 10, 2026 A Jar Is Not a Vault: Reading My Friend's Lightning Wallet Before I Recommend It A friend of mine spent six months building a self-custodial Lightning wallet that runs in a browser, and he'd be the first to tell you it has no audit. I trust him — which is exactly why I shouldn't ask you to trust it on my say-so. So I read the code, checked the served binary against the published hashes, and worked out what the trust model really is. Along the way, the thing every Lightning wallet review should say and mostly doesn't: what a Lightning wallet is for, and what it is not. SEPTEMBER 10, 2026 The Phishing Email Really Was From Trezor On September 9th roughly 347,000 people got an email from help@trezor.io warning them about a chip flaw in their wallet and pointing them somewhere to check it. It was a phishing attack — and it came from Trezor's real domain, passed every authentication check a mail server performs, and borrowed its cover story from two vulnerabilities that are genuinely real. This is Trezor's second breach in a month and its third this year, and not one of them touched the device. SEPTEMBER 9, 2026 "Not Your Keys, Not Your Coins" Just Grew a Second Half Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning node software, that could let an attacker who reaches an exposed control panel send your bitcoin out from under you. The twist worth sitting with is the timeline — the fix shipped over a year before the warning did — and what that gap actually tells self-custody Bitcoiners about the setting they should have checked already. SEPTEMBER 9, 2026 "Coded and Audited by AI," and the Longer Story Underneath That Sentence A beta Bitcoin wallet's own README says, in one sentence, that it was coded and audited by frontier AI models. Taken alone that sentence would worry me. Taken alongside the actual security document and the actual changelog, it turns out to be shorthand for something more specific, more human, and more interesting than the sentence lets on. SEPTEMBER 6, 2026 Nearly Four Thousand Bitcoin, and Why I Uninstalled Aqua A federation that was supposed to hold every L-BTC one-to-one in real bitcoin just watched roughly four thousand bitcoin walk out the door in a single afternoon. The working theory is an inflation bug in Liquid's confidential transactions, and the functionaries signed the withdrawal anyway — because from where they sat, it looked completely normal. AUGUST 4, 2026 A Twenty-Five-Minute Window, and Why I Split the Key A firmware bug sat undetected for five years, then drained over a hundred million dollars from Coldcard wallets in one week. Why I have never trusted a single device with all of mine, and what my Bitkey actually does.