Afilini 2085269060028170742
afilini-2085269060028170742
Latest reviewed change
source content difference between and
4 new post record(s) (reply) entered the capture, each first posted after the previous capture ran; no record left the capture.
media: 0
body:
Does my tweet sound like I’m defending them?
+
+post: 2088230096306065429
+role: reply
+author: lukechilds
+name: Luke Childs
First lines only. The complete diff is in the timeline below.
- Author
- @afilini
- Organisation
- independent
- Evidence role
- independent-technical-analysis
- Posted
- 6 Aug 2026, 07:37 UTC
- Capture status
- capture held
Alekos Filini's 6 August view on what Coinkite could reasonably have done: he does not think better entropy testing would have caught this, and argues that building a proper emulator might have. From the author of the migration analysis at afilini-seed-rng-migration-report and the threads at afilini-2085028027499413710 and afilini-2085021651918332071. Registered as a polled thread so the replies, where the disagreement about what is testable plays out, are held with it.
This post is registered as evidence and has a locally held capture. The original remains the canonical publication. Last checked .
Also held inside a captured conversation
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Public privacy boundary
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
The conversation
Captured . 5 continuation posts, 7 replies held. Posts are in the archive's own order, oldest first, not the order X ranks them in.
-
capture taken
Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue
-
capture taken
The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom
-
capture taken
For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed
-
capture taken
This was before AI, it was a pain in the ass but that allowed me to run the exact same binary on device and in the emulator. Not cycle perfect, but still same exact instructions
-
capture taken
Why I think that could have caught the bug? The UID would have likely been fixed to some constant like 0xB00B5 (yeah engineers do that all the time) and while developing there’s a good chance they might have started getting collisions and seeing the same mnemonic multiple times
-
capture taken
I’m not the first to point out the sloppy work (I consider the one-letter commit messages in libngu also sloppy work) and this just adds to that
Replies are unmoderated third-party material, reproduced here as part of
the record. Inclusion is not endorsement, and nothing in them has been
checked by this project.
Replies held in this capture (7)
Low-signal replies are collapsed to one line, never removed. A reply is collapsed only on mechanical grounds: fewer than 40 characters, no text, mentions only, no letters or digits, a bare link, or text identical to another reply in the same capture. What a reply argues is never a reason. Each one says which rule collapsed it, and its screenshot is one click away.
-
capture taken
No need to write an emulator. Just design a TRNG that you can actually test and independently verify on real hardware: https:// petertodd.org/2014/push-butt on-rng … Everything else can be done deterministically.
show the capture
capture taken
-
capture taken
Yes they could have. I took an afternoon after the new firmware was released to test the old and new firmware - specifically to test that the hardware rang was being used, by testing the firmware on a real device (I just added some debug functions that allowed me to query what the hardware was doing).took me a few hours to do. No emulator needed.
show the capture
capture taken
-
capture taken
Yes but that is very specific instrumentation added for one single feature. And presumably you removed them after confirming it worked. An emulator allows ongoing checks as the codebase progresses
show the capture
capture taken
-
capture taken
Having a proper emulator would have been great but the issue could have been caught in several other ways. For starter better development flow, including PR reviews and generally more eyes on the code. They could have hired a security firm to do an audit or at least use an LLM.
show the capture
capture taken
-
capture taken
1000%
show the capture
capture taken
-
capture taken
Thanks to coinkite, some people lost decades of hardwork money. Your defense is meaningless.
show the capture
capture taken
-
capture taken
Does my tweet sound like I’m defending them?
show the capture
capture taken
The remaining 0 replies
What this capture did not reach
This capture reached the end of the conversation as X served it: it stopped because nothing further loaded, not because a limit was hit. X decides what a reader is shown, so that is not the same as a guarantee of every reply.
Held captures
-
4 new post record(s) (reply) entered the capture, each first posted after the previous capture ran; no record left the capture.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 44 lines
media: 0 body: Does my tweet sound like I’m defending them? + +post: 2088230096306065429 +role: reply +author: lukechilds +name: Luke Childs +created: 2026-08-14T11:43:47Z +media: 1 +body: +*slaps roof of trezor* + +This bad boy can fit so many pre-signed transactions in it + +post: 2088278202078699936 +role: reply +author: Rob1Ham +name: Rob Hamilton +created: 2026-08-14T14:54:56Z +media: 0 +body: +I know I've spent the last 2 weeks crashing out about being restricted in accessing cyber programs from the American frontier AI labs. + +For about a day now I've had access to +@OpenAI +'s Daybreak Blue, and its the best model by far I've interacted with for security research. + +post: 2088305623318298903 +role: reply +author: intangiblecoins +name: Alex Thorn +created: 2026-08-14T16:43:54Z +media: 0 +body: +an update on the coldcard investgiation, including top-line numbers, victim reports, location of some funds moving onchain + +and i give my high level thoughts on the impact of the event on bitcoin culture going forward + +post: 2088331320074314204 +role: reply +author: stutxo +name: stu +created: 2026-08-14T18:26:00Z +media: 2 +body: +come and take it (like actually pls)Extracted text as captured
thread: 2085269060028170742 url: https://x.com/afilini/status/2085269060028170742 author: afilini post: 2085269060028170742 role: focal author: afilini name: Alekos Filini created: 2026-08-06T07:37:40Z media: 0 body: Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue post: 2085269063517839714 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:41Z media: 0 body: The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom post: 2085269067099701267 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:42Z media: 0 body: For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed post: 2085269070350328032 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:43Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
AdineyBIP110BLAKE2b's display name changed to 'Adiney BIP110 BLAKE2b'; the four replies that disappeared were not collected because the latest capture stopped at 8 scroll rounds versus 10.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 61 lines
post: 2085530373337804976 role: reply author: LucasBean91 -name: AdineyBIP110BLAKE2b +name: Adiney BIP110 BLAKE2b created: 2026-08-07T00:56:02Z media: 0 body: media: 0 body: Does my tweet sound like I’m defending them? - -post: 2087893343590113547 -role: reply -author: mikegermano -name: Mike Germano -created: 2026-08-13T13:25:38Z -media: 1 -body: -Nothing more comical than watching BIP-110 maxis drop thousands on new mining hardware after complaining that an $80 hard drive would centralize Bitcoin - -post: 2087931686600454337 -role: reply -author: arkade_os -name: Arkade -created: 2026-08-13T15:58:00Z -media: 1 -body: -Lightning is back. - -A recent outage exposed the risk of having so much depend on a single provider. - -We felt it, you too. We’re working to ensure this never happens again. - -Today we are launching Intents, a shared market interface for payments & exchange, built on Bitcoin. - -post: 2087941044608331901 -role: reply -author: callebtc -name: calle -created: 2026-08-13T16:35:11Z -media: 0 -body: -we're all bitcoin red team - -post: 2087959120515101035 -role: reply -author: BtcpayServer -name: BTCPay Server -created: 2026-08-13T17:47:01Z -media: 1 -body: -Today, we are releasing BTCPay Server v2.4.3-rc4, a security update addressing vulnerabilities reported by the Bitcoin Red Team, -@ProjectLoupe -, -@MagicGrants -, -@Premai_io -, and independent researchers. - -This release follows several days of nonstop work, review, and testing. It was built from our temporary private security repository, but to make these security fixes available as quickly as possible, we are releasing the Docker image publicly now. - -This is a release candidate, so bugs may still be present. NFC is now opt-in, and the Phoenixd plugin is temporarily incompatible with this release. Please report any issues to the team. We will document behavioral changes within the main release. - -Despite its RC status, we strongly recommend upgrading now using the standard process: - -Server Settings > Maintenance > Update -or run or run btcpay-update(.)sh from the command line, removing the parentheses - -If no significant issues are reported, the release candidate will be tagged as v2.4.3 and fully open-sourced within the next 48 hours.Extracted text as captured
thread: 2085269060028170742 url: https://x.com/afilini/status/2085269060028170742 author: afilini post: 2085269060028170742 role: focal author: afilini name: Alekos Filini created: 2026-08-06T07:37:40Z media: 0 body: Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue post: 2085269063517839714 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:41Z media: 0 body: The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom post: 2085269067099701267 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:42Z media: 0 body: For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed post: 2085269070350328032 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:43Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
4 new post record(s) (reply) entered the capture, each first posted after the previous capture ran; no record left the capture.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 65 lines
media: 0 body: Does my tweet sound like I’m defending them? + +post: 2087563898392395927 +role: reply +author: stutxo +name: stu +created: 2026-08-12T15:36:33Z +media: 1 +body: +bro is on coingecko page 60 looking at shitcoin charts and posting bip110 hopium + +there has never been a crash out like it + +post: 2087619577484046470 +role: reply +author: Schnitzel +name: Michael Schmid +created: 2026-08-12T19:17:48Z +media: 1 +body: +~90% of ASICs run one vendor's closed-source firmware. Almost nobody has audited it. + +We at +@256FOUNDATION + do. + +Introducing the 256 Red Team — the 256 Foundation's firmware security program. On hardware we own, in an isolated lab, under coordinated disclosure. + +post: 2087648218393858456 +role: reply +author: Rob1Ham +name: Rob Hamilton +created: 2026-08-12T21:11:36Z +media: 1 +body: +I have now set up my 2 councils. Monitoring the situation. + +Red Team: +Deepseekv4 Pro +Kimi K3, +GLM5.2 + +Blue Team: +GPT 5.6 Daybreak Blue +Grok 4.6 +Fable/Opus + +All made possible by +@opencode + +post: 2087683189489779164 +role: reply +author: jamesob +name: James O'Beirne +created: 2026-08-12T23:30:34Z +media: 1 +body: +Attackers are working through the honeypots on +http:// +cktripwire.com + +Our theft frontier is at 11 bits of added entropy on top of the weak mk3 seeds. + +All of +@ColeTU +'s external honeypots have been swept. We just lost our first one-word passphrase UTXO.Extracted text as captured
thread: 2085269060028170742 url: https://x.com/afilini/status/2085269060028170742 author: afilini post: 2085269060028170742 role: focal author: afilini name: Alekos Filini created: 2026-08-06T07:37:40Z media: 0 body: Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue post: 2085269063517839714 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:41Z media: 0 body: The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom post: 2085269067099701267 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:42Z media: 0 body: For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed post: 2085269070350328032 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:43Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Four new replies appeared, from callebtc, Mike Schmidt, Peter Todd and Alekos Filini, all posted on August 11 after the previous capture on August 7.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 77 lines
media: 0 body: Does my tweet sound like I’m defending them? - -post: 2087102876371841435 -role: reply -author: callebtc -name: calle -created: 2026-08-11T09:04:36Z -media: 1 -body: -The sacrifice to end the bear market has been offered to the Bitcoin gods. - -post: 2087179372247576800 -role: reply -author: bitschmidty -name: Mike Schmidt -created: 2026-08-11T14:08:34Z -media: 0 -body: -Bitcoin Core v32.0 is targeted for release in October: - -- Up to 3x faster initial sync. Block validation now fetches transaction inputs from disk in parallel instead of one at a time - -- The libevent external dependency is fully removed, continuing Core's push to cut third-party dependencies - -- Max peer connections raised from 125 to 200 to have more open slots for new nodes to sync from, faster block propagation, and a harder network to eclipse or partition - -- Mempool-based fee estimation to cut fee overestimation (in progress) - -- Transaction relay rate limiting is now global instead of per-peer, keeping a node's CPU and memory usage steady when transaction volume spikes - -- Ships with features from libsecp256k1 0.8.0 with verification up to 11% faster, plus the new Silent Payments module (BIP 352) - -- PSBTv2 (BIP 370) support, now the default for PSBT-creating RPCs for better coordination of unsigned transactions for multisig and hardware wallet setups - -- New exportwatchonlywallet command to export a wallet as a watch-only file, no private keys, and restore it on your online node - -- Core now enables Tor's proof-of-work DDoS defense on the onion service it creates for your node, where the Tor daemon supports it - -Additional tests, bugfixes, and features included as well. - -Feature freeze is ~August 20, rc1 ~September 10, final release targeted for ~October 10. (Test the release candidates when they ship!) - -post: 2087194653019746734 -role: reply -author: peterktodd -name: Peter Todd -created: 2026-08-11T15:09:18Z -media: 3 -body: -tl;dr: -@lukedashjr - decided to use a testnet4 block hash as the random beacon to pick BIP-110-chain's new PoW function. - -An absolutely batshit decision. It's clearly possible to manipulate that by just mining blocks with the right hash. Mining a testnet4 block has a trivial cost. So mining one with a specific last byte in the block hash – thus forcing a particular PoW choice – also has a trivial cost. - -When Zcash did something similar for a trusted setup, they picked a Bitcoin block in the future, and they specified that the block hash would in turn be re-hashed 2⁴² times¹ to ensure that absolutely no-one could possibly pick the value in advance (that's a 2-3 weeks of sequential computation). - -There's two possibilities here: - -1) Luke is incompetent. -2) Luke is malicious, and is trying to pick a specific PoW. - -The possibilities are not exclusive. - -1) -https:// -zips.z.cash/protocol/proto -col.pdf -… - -post: 2087233919070429349 -role: reply -author: afilini -name: Alekos Filini -created: 2026-08-11T17:45:19Z -media: 1 -body: -Extracted text as captured
thread: 2085269060028170742 url: https://x.com/afilini/status/2085269060028170742 author: afilini post: 2085269060028170742 role: focal author: afilini name: Alekos Filini created: 2026-08-06T07:37:40Z media: 0 body: Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue post: 2085269063517839714 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:41Z media: 0 body: The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom post: 2085269067099701267 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:42Z media: 0 body: For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed post: 2085269070350328032 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:43Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The thread gained five additional replies covering development process, a BIP-110 fork critique, and Bitcoin Core v32.0 release notes.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 86 lines
body: Yes but that is very specific instrumentation added for one single feature. And presumably you removed them after confirming it worked. An emulator allows ongoing checks as the codebase progresses +post: 2085320165265211513 +role: reply +author: portolan0f +name: V +created: 2026-08-06T11:00:45Z +media: 0 +body: +Having a proper emulator would have been great but the issue could have been caught in several other ways. For starter better development flow, including PR reviews and generally more eyes on the code. They could have hired a security firm to do an audit or at least use an LLM. + post: 2085348260122677395 role: reply author: FreedomIsntSafe media: 0 body: Does my tweet sound like I’m defending them? + +post: 2087102876371841435 +role: reply +author: callebtc +name: calle +created: 2026-08-11T09:04:36Z +media: 1 +body: +The sacrifice to end the bear market has been offered to the Bitcoin gods. + +post: 2087179372247576800 +role: reply +author: bitschmidty +name: Mike Schmidt +created: 2026-08-11T14:08:34Z +media: 0 +body: +Bitcoin Core v32.0 is targeted for release in October: + +- Up to 3x faster initial sync. Block validation now fetches transaction inputs from disk in parallel instead of one at a time + +- The libevent external dependency is fully removed, continuing Core's push to cut third-party dependencies + +- Max peer connections raised from 125 to 200 to have more open slots for new nodes to sync from, faster block propagation, and a harder network to eclipse or partition + +- Mempool-based fee estimation to cut fee overestimation (in progress) + +- Transaction relay rate limiting is now global instead of per-peer, keeping a node's CPU and memory usage steady when transaction volume spikes + +- Ships with features from libsecp256k1 0.8.0 with verification up to 11% faster, plus the new Silent Payments module (BIP 352) + +- PSBTv2 (BIP 370) support, now the default for PSBT-creating RPCs for better coordination of unsigned transactions for multisig and hardware wallet setups + +- New exportwatchonlywallet command to export a wallet as a watch-only file, no private keys, and restore it on your online node + +- Core now enables Tor's proof-of-work DDoS defense on the onion service it creates for your node, where the Tor daemon supports it + +Additional tests, bugfixes, and features included as well. + +Feature freeze is ~August 20, rc1 ~September 10, final release targeted for ~October 10. (Test the release candidates when they ship!) + +post: 2087194653019746734 +role: reply +author: peterktodd +name: Peter Todd +created: 2026-08-11T15:09:18Z +media: 3 +body: +tl;dr: +@lukedashjr + decided to use a testnet4 block hash as the random beacon to pick BIP-110-chain's new PoW function. + +An absolutely batshit decision. It's clearly possible to manipulate that by just mining blocks with the right hash. Mining a testnet4 block has a trivial cost. So mining one with a specific last byte in the block hash – thus forcing a particular PoW choice – also has a trivial cost. + +When Zcash did something similar for a trusted setup, they picked a Bitcoin block in the future, and they specified that the block hash would in turn be re-hashed 2⁴² times¹ to ensure that absolutely no-one could possibly pick the value in advance (that's a 2-3 weeks of sequential computation). + +There's two possibilities here: + +1) Luke is incompetent. +2) Luke is malicious, and is trying to pick a specific PoW. + +The possibilities are not exclusive. + +1) +https:// +zips.z.cash/protocol/proto +col.pdf +… + +post: 2087233919070429349 +role: reply +author: afilini +name: Alekos Filini +created: 2026-08-11T17:45:19Z +media: 1 +body: +Extracted text as captured
thread: 2085269060028170742 url: https://x.com/afilini/status/2085269060028170742 author: afilini post: 2085269060028170742 role: focal author: afilini name: Alekos Filini created: 2026-08-06T07:37:40Z media: 0 body: Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue post: 2085269063517839714 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:41Z media: 0 body: The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom post: 2085269067099701267 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:42Z media: 0 body: For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed post: 2085269070350328032 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:43Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Six new replies to the X thread, including OpenSats announcing Code RED red-team support, Jason Hughes (wk057) posting private node-crawler BIP-110 statistics, ZEUS reporting its Lightning Address service back online, and afilini asking whether his tweet sounded like a defense of Coinkite.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 96 lines
media: 0 body: 1000% + +post: 2085363706255573313 +role: reply +author: OpenSats +name: OpenSats +created: 2026-08-06T13:53:46Z +media: 0 +body: +Code RED is live. Priority support for people red teaming Bitcoin software, including reimbursement of past LLM token costs. + +post: 2085479707445789137 +role: reply +author: wk057 +name: Jason Hughes +created: 2026-08-06T21:34:43Z +media: 0 +body: +Since we're about 48 hrs away from the BIP-110 "mandatory" signaling height, I wanted to quickly share my private node crawler stats. + +Over the past several weeks, I gave a program of mine more spending power than is probably reasonable. It spent a not insignificant amount of BTC deduplicating nodes. Enjoy. + +Raw node counts (% of total) + Total: 131,762 + Bitcoin Core: 99,401 (75.4%) + Bitcoin Knots: 30,755 (23.3%) + Other: 1,606 (1.2%) + +Raw BIP-110 signaling counts (% of total) + Bitcoin Core: 17 (0.01%) + Bitcoin Knots: 19,388 (14.7%) + Other: 0 (Unknown) + Total: 19,405 (14.7%) + +Nodes found to be duplicates (% of version) + Bitcoin Core: 17,892 (17.8%) + Bitcoin Knots: 18,049 (58.7%) + Other: Unknown + Total duplicates: 35,941 (27.2% of total) + +Deduplicated node counts (% of unique) + Bitcoin Core: 81,672 (85.1%) + Bitcoin Knots: 12,706 (9.6%) + Other: 1,606 (1.7%) + Total unique: 95,984 (72.8% of total) + +Of the 19,388 Bitcoin Knots BIP-110 nodes discovered signaling for BIP-110, 71% of them were eliminated as duplicates, above average for the Knots nodes, leaving only 5,663 BIP-110 signaling nodes. + +That puts non-duplicate BIP-110 signaling nodes at 5.9% of non-duplicate nodes. + +My criteria for deduplication includes the basics (same IP) and some additional more advanced sleuthing of available data. Additionally, you may have already surmised from my intro that part of it also involves strategically sending real transactions. + +Will keep the exact details private so that it can't be easily gamed in the future. It is impossible to find ALL duplicate nodes, however false positives are somewhat unlikely with my methodology. If my software has flagged a group of nodes as duplicate, there's an extremely high probability that its either the exact same node (with multiple IPs) or in the exact same location. + +If a node wasn't able to be tested thoroughly enough to be confident for whatever reason, and isn't deemed duplicate by conventional means (same IP, for example) then it isn't considered a duplicate and gives it the benefit of the doubt. + +If I get more time, I may start publishing some more detailed stats more regularly, since it seems my crawler successfully finds a large amount of nodes beyond those listed every public crawler. Unfortunately it's not cheap to handle the deduplication aspect, so will need to figure out how feasible that is to continue. It also involves operating from dozens of IPs to get connected to a supermajority of the network, which is pretty bandwidth intense. + +Anyway, figured I'd share, since I don't think anyone is actually doing this at all at this level. There's a lot more to this, too. Some of it might scare privacy conscious people... so I'll probably keep my publicly shared info limited to node stats. + +post: 2085530373337804976 +role: reply +author: LucasBean91 +name: Adiney BIP-110 +created: 2026-08-07T00:56:02Z +media: 0 +body: +Thanks to coinkite, some people lost decades of hardwork money. Your defense is meaningless. + +post: 2085546037633007716 +role: reply +author: niftynei +name: nifty, ideas guy +created: 2026-08-07T01:58:17Z +media: 0 +body: +the last few months have been a lot + +post: 2085565765189505095 +role: reply +author: ZeusLN +name: ZEUS +created: 2026-08-07T03:16:41Z +media: 1 +body: +UPDATE (Aug. 6, 2026): ZEUS Pay Lightning Addresses are back online. + +ZEUS White, block source, and graph data services remained operational throughout the incident. Currency exchange rate services experienced brief disruptions but are now fully stable. + +post: 2085618516112097433 +role: reply +author: afilini +name: Alekos Filini +created: 2026-08-07T06:46:17Z +media: 0 +body: +Does my tweet sound like I’m defending them?Extracted text as captured
thread: 2085269060028170742 url: https://x.com/afilini/status/2085269060028170742 author: afilini post: 2085269060028170742 role: focal author: afilini name: Alekos Filini created: 2026-08-06T07:37:40Z media: 0 body: Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue post: 2085269063517839714 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:41Z media: 0 body: The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom post: 2085269067099701267 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:42Z media: 0 body: For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed post: 2085269070350328032 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:43Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Four new replies to the X thread: Peter Todd linking his TRNG design post, bigshiny0 describing real-hardware RNG testing, afilini on emulator-based checks, and a one-line endorsement from FreedomIsntSafe.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 42 lines
media: 0 body: I’m not the first to point out the sloppy work (I consider the one-letter commit messages in libngu also sloppy work) and this just adds to that + +post: 2085311458879971338 +role: reply +author: peterktodd +name: Peter Todd +created: 2026-08-06T10:26:09Z +media: 0 +body: +No need to write an emulator. Just design a TRNG that you can actually test and independently verify on real hardware: +https:// +petertodd.org/2014/push-butt +on-rng +… + +Everything else can be done deterministically. + +post: 2085315585479483716 +role: reply +author: bigshiny0 +name: Shiny +created: 2026-08-06T10:42:33Z +media: 0 +body: +Yes they could have. I took an afternoon after the new firmware was released to test the old and new firmware - specifically to test that the hardware rang was being used, by testing the firmware on a real device (I just added some debug functions that allowed me to query what the hardware was doing).took me a few hours to do. No emulator needed. + +post: 2085316907658330372 +role: reply +author: afilini +name: Alekos Filini +created: 2026-08-06T10:47:48Z +media: 0 +body: +Yes but that is very specific instrumentation added for one single feature. And presumably you removed them after confirming it worked. An emulator allows ongoing checks as the codebase progresses + +post: 2085348260122677395 +role: reply +author: FreedomIsntSafe +name: LazyNinja +created: 2026-08-06T12:52:23Z +media: 0 +body: +1000%Extracted text as captured
thread: 2085269060028170742 url: https://x.com/afilini/status/2085269060028170742 author: afilini post: 2085269060028170742 role: focal author: afilini name: Alekos Filini created: 2026-08-06T07:37:40Z media: 0 body: Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue post: 2085269063517839714 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:41Z media: 0 body: The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom post: 2085269067099701267 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:42Z media: 0 body: For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed post: 2085269070350328032 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:43Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
thread: 2085269060028170742 url: https://x.com/afilini/status/2085269060028170742 author: afilini post: 2085269060028170742 role: focal author: afilini name: Alekos Filini created: 2026-08-06T07:37:40Z media: 0 body: Seeing lots of people say coinkite should have tested entropy better. I don’t think they could’ve done much there. What I think they could’ve done was to build a proper emulator. That might have caught the issue post: 2085269063517839714 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:41Z media: 0 body: The existing coldcard emulator runs micropython on Unix (Linux / macOS) systems. It’s not emulating the hardware at all. For entropy, it just reads it from /dev/urandom post: 2085269067099701267 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:42Z media: 0 body: For Portal, which compared to the scale of coldcard is effectively a garage toy project, I took the time to fork QEMU and implement a few missing STM32 peripherals I needed post: 2085269070350328032 role: self-thread author: afilini name: Alekos Filini created: 2026-08-06T07:37:43Z media: 0 body:Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
4 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
- +0 -44 Four reply records from Aug 14 left the capture; capped remained false and the newer capture was shallower (8 scroll rounds versus 10, 7 replies observed versus 11), indicating under-collection rather than deletion.
- +43 -97 Several visible replies were replaced by different ones, but both captures observed 17 posts/11 replies at 10 scroll rounds, so the change is reply-ranking churn.
- +108 -60 Four replies left the capture and four entered while the depth record stayed unchanged (10 scroll rounds and 11 replies observed, capped false); two entering replies predate the previous capture and two postdate it, so the composition change is ranking churn rather than reliable deletions or new posts.
- +0 -78 X reply-load variance: the four replies added in the previous capture (OpenSats announcing Code RED, wk057 posting BIP-110 node-crawler statistics, niftynei, and the ZEUS service update) are absent again with unchanged bodies and timestamps. Same varying-reply-subset pattern as the other X thread captures; nothing demonstrably deleted.
How to check this yourself
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
How to check this yourself
Compare the screenshot or a quotation against the original while it is available.