BR093 - ECDSA Key Extraction, ESP32 Security Concerns, COLDCARD, Cove Wallet, Krux, Nunchuk, Invalid Mining Jobs, Javascript Injection Attack, CTV Back on the table? + MORE ft. Rob & Vivek

Update: 2025-03-13

Description

I'm joined by guests Rob Hamilton & Vivek to go through the list.

Housekeeping
(00:01:18 ) Unleashed.chat rebrands to dataMachine

Urgent Vulnerability Disclosures
(00:01:52 ) Private key leak via malformed ECDSA input
(00:09:12 ) ESP32 Security Concerns
(00:21:32 ) Coinos revokes NWC connection secrets

Vivek's Corner
(00:22:51 ) Invalid mining jobs by AntPool & friends during forks

Bitcoin
• Software Releases & Project Updates
(00:37:44 ) COLDCARD
(00:52:47 ) Sparrow Wallet
(00:54:33 ) Lark
(00:55:03 ) Krux
(00:56:37 ) Cove Wallet
(00:59:09 ) Nunchuk Desktop
(01:00:32 ) BTCPayServer
(01:00:44 ) Bitcoin Keeper
(01:01:25 ) BlueWallet
(01:02:08 ) Bitcoin Safe
(01:03:15 ) Bitkey App
(01:04:05 ) libwally-core
(01:06:00 ) Bisq2
(01:06:04 ) RoboSats
(01:06:08 ) Boltz Exchange
(01:06:10 ) Zaprite
(01:06:13 ) Blockstream Explorer API
(01:07:22 ) Mempal
(01:07:29 ) Iris Wallet desktop
(01:07:31 ) Utreexo
(01:07:34 ) ESP Miner

• Project Spotlight
(01:07:38 ) Reorg Calculator
(01:07:51 ) Bitcoin Core Config Generator
(01:09:05 ) Bitcoin Core Snapshots
(01:09:11 ) Boot Protocol
(01:09:18 ) multisig-backup
(01:09:58 ) Wallet backup
(01:10:04 ) regtest-in-a-pod

Vulnerability Disclosures
(01:11:56 ) JavaScript injection attack
(01:15:05 ) Malicious PyPI package 'set-utils' steals Ethereum private keys
(01:16:57 ) OpenSSH vulnerabilities expose clients and servers to attacks
(01:17:05 ) USB side-channel attacks
(01:17:37 ) Cellebrite
(01:17:49 ) Messengers vulnerabilities
(01:17:56 ) GitVenom
(01:18:10 ) Stablecoin payment firm Infini loses $50M in exploit
(01:18:18 ) Five dollar wrench attacks
Audience Questions
(01:20:00 ) Comment on a flaw in Bitcoin Core regarding mining pools and their vulnerability against block withholding attacks

Nostr
• Project spotlight
(01:22:32 ) 24242.io
(01:22:49 ) nostr.media
(01:22:58 ) Frostr
(01:23:33 ) nostr-double-ratchet
(01:23:44 ) DVMCP
(01:23:53 ) Samiz
(01:24:00 ) Welshman
(01:24:09 ) Norma
(01:24:20 ) Wallet Relay
(01:24:27 ) Nostr0
(01:24:35 ) nAuth Protocol
(01:24:43 ) Hostr

Boosts
(01:25:36 ) Shoutout to top boosters @sean, @pink monkey, @Anonymous, @martinbarilik, @Momo Tahmasbi & @jespada.

Links & Contacts:
Website: https://bitcoin.review/
Substack: https://substack.bitcoin.review/
Twitter: https://twitter.com/bitcoinreviewhq
NVK Twitter: https://twitter.com/nvk
Telegram: https://t.me/BitcoinReviewPod
Email: producer@coinkite.com
Nostr & LN: ⚡nvk@nvk.org (not an email!)
Full show notes: https://bitcoin.review/podcast/episode-93

Comments

In Channel

BR097 - Cove Wallet, Harbor, ecash, Sparrow, Liana, Bull Bitcoin, JoinMarket, Hardware Wallets, Coinbase Breach, BitLocker Vulnerability, Lightning Phoenixd, LSP Legality + MORE ft. Praveen, Ben, Paul

2025-06-0501:12:48

BR096 - OP_RETURN Debate, Bitcoin Core Governance, Alternative Implementations, Future Soft Forks, CTV Prospects, Core Vulnerabilities, COLDCARD Hardware Design, Testnet vs Signet + MORE ft. Rob, Odell & Craig

2025-05-1501:06:24

BR095 - OP_NEXT Recap, COLDCARD, Bitcoin Core, Ephemeral Dust, Ephemeral Anchors, Pay-to-Anchor outputs, Taplocks, Electrum, Cove Wallet, Mempool.space, Liana, Bitcoin Privacy Accounting, ESP32.Review + MORE ft. Rob & Rijndael

2025-04-2301:37:00

BR094 - COLDCARD KeyTeleport, Harbor, Ark, Cove Wallet, Zaprite, Bitcoin Core, OMEMO, Knots, Vibe Coding, Trezor Safe 3 Attack Vector, Coinbase Phishing Campaign, Bitcoin Business Software + MORE ft. Rob & Paul

2025-04-0201:28:49

BR093 - ECDSA Key Extraction, ESP32 Security Concerns, COLDCARD, Cove Wallet, Krux, Nunchuk, Invalid Mining Jobs, Javascript Injection Attack, CTV Back on the table? + MORE ft. Rob & Vivek

2025-03-1301:28:17

BR092 - Nostr Wallet Connect, DeepSeek, AI Coding, Sparrow, Bitcoin Keeper, Maple AI, Calculating Tx Sizes + MORE ft. Future Paul

2025-02-1101:29:06

BR091 - AnchorWatch Trident Vault, Ledger Co-founder Kidnapped, Blue Wallet, M17, The Case for Multi-vendor Setups, Tails removes HWW Support + MORE ft. Craig & Rob

2025-01-2401:16:21

BR090 - COLDCARD, BullBitcoin, Bitcoin Safe, miningpool-observer, Zero Fee/P2PK Playgrounds, Tangem Private Keys Exposed, Proton Wallet Vuln, Signatures Explained, "Not Enough UTXOs!" + MORE ft. Rob

2025-01-0301:23:15

BR089 - Lark, Security Tradeoffs Masterclass, Bitcoin Quantum Risks, WabiSabi Deanonymization, Core Txn Broadcast, Better Wallet Migration, Scaling Bitcoin, Bullish Sentiments + MORE ft. Craig & Rob

2024-12-1302:03:22

BR088 - AnchorWatch, Bitkey, Krux, Primal, Proton Wallet, Kagi, Debifi, Namecheap $73M bitcoin revenue + MORE ft. Livera, Rijndael & Ben

2024-11-2701:07:39

BR087 - ColliderScript, BTCPay Server, OpenSecret, Matrix, Lottie player JS Attack, the Bullish Case for Vaults, LN Payment Censorship , EmailBTC, secp256k1-node vulnerability + MORE ft. Justin & Paul

2024-11-1301:30:36

BR086 - Electrum, Wasabi, Bitkey, Bitcoin Safe, Spark, Bitcoin Keeper, OP_CAT Privacy, FROST X nostr, btcd FindAndDelete bug + MORE ft. Rijndael & Ben

2024-10-3101:12:39