Café Bitcoin | Self-Custody Is Not Dead, the Custody Spectrum, and Owning Is Not Operating | Day 15 of 50

Dice rolls are now confirmed safe. Portland HODL published a full verification, independently cross-checked by James O'Beirne, Block's engineering team and Rob Hamilton: the Coldcard did use dice entropy rather than falling back to the pseudo-random generator. Fifty or more rolls was sufficient. Still rotate anyway. The prevailing view on the show was that dice-generated seeds are safe but worth rotating as hygiene. Separately, no other hardware wallet firmware vulnerability has surfaced yet from the red-team sweep. The red team is scaling. Rob Hamilton's group, now joined by other Bitcoin developers, is pointing Kimi K3 and other frontier models at repos across the ecosystem. Critical vulnerabilities have been found and responsibly disclosed, none in hardware wallets so far. Cory rejects the "always more to learn" framing. He argued that line doesn't apply here: the entire point of code securing assets is that there can be no mistakes that put those assets at risk. He gave two press interviews on the exploit. The custody spectrum, with a chart in the nest. Cory laid out five positions: solo self-custody, guided self-custody via Swan Sovereign at $25 a month, collaborative multisig, delegated custody with OCC-chartered custodians, and multi-institutional custody, which Swan has been building since December. The real gap is knowing how to use your wallet. Alec, who spent the weekend on client calls, found people holding large amounts in setups they could not operate. Getting Bitcoin off an exchange is not enough. Practice moving it more than once. Jason on the false binary. People have been taught there is one right way to hold Bitcoin, and that it's the most esoteric one. His question: what is self-custody worth if you cannot move your coins in an emergency? Zach Herbert of Foundation. Self-custody is not dead, and he framed this as negligence by a single vendor rather than an indictment of every maker. His takeaway is free and open source software, shared libraries and engagement with auditors. He calls it the worst event for committed Bitcoiners since Mt. Gox. Boltz went dark. The Lightning swap provider shut down entirely, hit by automated attacks faster than a small team could patch, taking swaps in Zeus, Aqua and Blockstream's app with it. No user funds lost. Brady drew the line from Kimi K3's release through Coldcard to this. The AI incentive argument. Phillip's case: calls to regulate AI harder are moat-building, not safety, and defenders keep having to reach for open-weight models because the US frontier models refuse legitimate security work. Steve noted five figures a day in tokens is not a sustainable audit model.