Unchained

This week we dissect ColdCard's ~$100M RNG exploit that Claude Code cracked in 8 minutes, debate whether AI just killed open-source security and Bitcoin maximalism, tear apart Ethereum's EIP-8361 staking-yield taper, and unpack Leopold Aschenbrenner's 67% Situational Awareness blowup and CLARITY Act's ethics fight.

Welcome to The Chopping Block – where crypto insiders Haseeb Qureshi, Tom Schmidt, Tarun Chitra, and Robert Leshner chop it up about the latest in crypto. No guest this week, just the four of them working through a week where AI quietly rewrote the economics of both security and human psychology, and crypto happened to be standing in the blast radius.

This episode: ColdCard, NVK's Bitcoin-only hardware wallet, got drained of nearly $100M thanks to a random-number-generation bug that a one-word commit buried five years ago, and Claude Code sniffed it out in 8 minutes (an open model with no internet found it in 20, for about two bucks). The crew debates whether AI just killed open-source security, whether Nic Carter is right that this is 'the death of Bitcoin maximalism,' and why Tarun thinks maxi devs are 'the RFK of security practices.' Then they take a blowtorch to Ethereum's EIP-8361 staking-yield taper (Tarun: 'the proposal reads like shit'), unpack Leopold Aschenbrenner's 67% Situational Awareness blowup while 4x levered, and wade into the CLARITY Act's ethics fight where a single amendment is the whole ballgame.

Listen to the episode on Apple Podcasts, Spotify, Pods, Fountain, Podcast Addict, Pocket Casts, Amazon Music, or on your favorite podcast platform.

Show highlights

🔹 ColdCard's Bitcoin-only hardware wallet drained of nearly $100M after a five-year-old random-number-generation bug silently fell back to weak software RNG.

🔹 A single dev swapped C++ macros with a one-word commit message, seemingly just to get NVK's code to compile, and doomed years of keys.

🔹 Claude Code found the ColdCard bug in 8 minutes; open model GLM 5.2, no internet, found it in ~20 for about $2.

🔹 Tarun calls Bitcoin maxi devs 'the RFK of security practices' who 'don't do audits,' branding ColdCard's lack of hardening 'incredibly delinquent.'

🔹 Haseeb warns AIs 'are much less diverse than humans,' so security now scales with AUM while North Korea spends thousands in compute.

🔹 Nic Carter calls it 'the death of Bitcoin maximalism' as Haseeb reads posts from holders who scrimped for three Bitcoin and woke up wiped.

🔹 EIP-8361 from Pintail and Justin Drake tapers ETH staking yield toward zero above 50% staked; the community is 'vomiting all over' it.

🔹 Tarun torches EIP-8361 as 'a truly horrendous post,' arguing constantly changing policy means Ethereum is never credible hard money.

🔹 Leopold Aschenbrenner's Situational Awareness AI hedge fund blew up ~67% while 4x levered, with Robert drawing Archegos comparisons.

Hosts

⭐️Haseeb Qureshi, Managing Partner at Dragonfly

⭐️Tom Schmidt, General Partner at Dragonfly

⭐️Tarun Chitra, Managing Partner at Robot Ventures

⭐️Robert Leshner, Founder & CEO of Superstate

Disclosures

Timestamps

00:00 Intro

01:03 ColdCard's $100M Exploit

05:46 AI, Audits & Bitcoin Maxi Security Failures

12:07 Open Source vs Closed Source in the AI Era

23:21 EIP-8361: Ethereum's Staking Yield Taper

30:34 Hard Money, Post-Quantum & Central Bank Chaos

35:54 Aschenbrenner's Situational Awareness Blowup

44:41 Robinhood Prediction Markets Boom as Hyperliquid RWAs Flip Crypto

51:54 Korea's Bloodbath & the Death of Retail Volatility

55:17 CLARITY Act: Ethics Provisions Are the Linchpin
Learn more about your ad choices. Visit megaphone.fm/adchoices

Anthropic's AI agents escaped a hacking test and still think they're inside it. Katherine, Jessi, and Vy Le on who's liable when a model breaks free, plus the $100M Coldcard hack and Kalshi's court losing streak.

========================================================

Thank you to our sponsor!

⁠⁠⁠⁠Cape⁠⁠⁠⁠: Your biggest crypto vulnerability isn't your wallet,
it's your phone number. Cape is America's privacy-first mobile carrier
that rotates your SIM identity daily and blocks SIM swaps before they
happen. Get 33% off your first six months at https://cape.co/unchained
(use code: UNCHAINED).

========================================================

Anthropic's AI models broke out of a fake hacking simulation this week, and some still think they're inside it. One agent invented an email address and phone number to pose as a person, then published malware that twelve companies downloaded before anyone caught it.

Katherine Kirkpatrick Bos, Jessi Brooks, and Vy Le use the incident to revisit a theme running through the whole episode: who has a duty to disclose when something breaks, and why crypto and AI are both being left to police themselves.

They start with the Coldcard hardware wallet hack, where a firmware flaw cut seed phrase randomness roughly in half, letting attackers brute-force wallets meant to be unguessable. From there, the hosts turn to Kalshi's losing streak in New York courts and the race among builders to acquire a CFTC-registered designated contract market, before landing on Anthropic's own agents slipping past the guardrails meant to contain them.

Banks have 36 hours to disclose a breach. AI labs and wallet makers, the hosts argue, are still working entirely on the honor system.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Katherine Kirkpatrick Bos⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host of DEX in the City and General Counsel of Chainlink

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Jessi Brooks⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, General Counsel at Ribbit Capital⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Vy Le⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of DEX in the City and General Counsel of Veda

Timestamps

🩺 02:16 Katherine Kirkpatrick Bos on joining Chainlink Labs

🔐 03:08 How a Coldcard firmware flaw let attackers guess seed phrases with AI

💙 18:32 Cape: Get 33% off six months of privacy-first mobile service at https://cape.co/unchained

⚖️ 19:36 Why Kalshi keeps losing its fight against New York's gambling regulators

🏛️ 30:47 DCM: the CFTC license every prediction market and perps exchange needs

🤖 33:37 Why Anthropic's AI agents escaped a test and still think they're inside it

💧 45:40 Matt Damon's crypto.com ad money and the water.org donation
Learn more about your ad choices. Visit megaphone.fm/adchoices

📢 Bits + Bips has its own channel now — full episodes here: https://www.youtube.com/@Bitsandbips

A firmware bug quietly introduced into Coldcard hardware wallets in 2021 has let attackers drain an estimated 1,600 to 2,000 bitcoin, over $100 million, from cold storage addresses that sat untouched for years.

Galaxy Digital's Alex Thorn has been tracing the exploit in real time, and in this clip he breaks down exactly how the random number generator meant to secure private keys "failed silently" into "way too weak entropy," and lays out the wave-by-wave forensic trail he is using to track the attacker.

Alex Thorn identifies three confirmed attack waves and a possible fourth, and Chris Perkins makes the case that even a "trustless, permissionless" system still requires trusting something, in this case, a hardware wallet's own firmware.

Hosts:

Austin Campbell - Host of Bits + Bips, Founder of Zero Knowledge Group, and Adjunct Professor at NYU Stern

Ram Ahluwalia - Co-host of Bits + Bips and CEO of Lumida

Chris Perkins - Co-host of Bits + Bips and Head of Franklin Crypto

Guest:

Alex Thorn - Head of Research at Galaxy Digital and host of Galaxy Brains

This clip is from a longer conversation on the Coldcard hack, U.S. AI guardrails, and the case for self custody. Full episode here. https://youtu.be/0oYZGw2DSj0?si=TwubhLQ35L8cXyG_

We go live every Monday at 4:30pm ET. Subscribe to catch it live.

👉 Cape: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at https://cape.co/unchained (use code: UNCHAINED).

Chapters

🔐 00:00 Coldcard's reputation as Bitcoin's gold standard hides a deep systemic flaw

🎲 03:42 How a 2021 firmware update let key generation fail silently into weak entropy

🕵️ 09:56 Alex Thorn traces three confirmed attack waves, and a possible fourth

🤝 14:05 'They trusted Coldcard to do the right thing': what broke when a hardware wallet failed
Learn more about your ad choices. Visit megaphone.fm/adchoices

Wall Street's transfer agents want issuers, not outside platforms, to control tokenized stock. Securitize's CEO says the alternative invites insider trading.

========================================================

Thank you to our sponsor!

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cape⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at cape.co/unchained (use code: UNCHAINED).

========================================================

Securitize took itself public twice this year: once through a direct listing, and once by tokenizing more than $265 million of its own stock via a SPAC with Cantor Equity Partners, testing whether Wall Street lets equities trade onchain.

Carlos Domingo, founder and CEO of Securitize, joins Laura Shin to argue that much of crypto's tokenized stock boom is unauthorized, offshore paper exposing investors and issuers to real legal risk, and to make the case that transfer agents, not outside platforms, should control what gets tokenized.

They cover Rule 611, the SEC rule locking onchain and offchain share prices together, the Securities Transfer Association's push for issuer authorization, and a Netflix stock split that left an unauthorized derivative trading five times off. Domingo also lays out Securitize's NYSE partnership, launching tokenized trading in the fourth quarter.

The SEC is now weighing whether to unwind the rule that keeps those prices identical, with real stakes for how equities trade next.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guests:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Carlos Domingo - Founder and CEO of Securitize

Timestamps

🏛️ 01:09 Why Domingo took Securitize public after Circle's IPO opened the door

💹 04:12 Securitize's SPAC: tokenizing over $265M in stock with Cantor Equity Partners

📣 10:10 Cape: Get 33% off your first six months with code unchained at https://cape.co/unchained

🔗 10:24 Why Securitize tokenized SECZ on Solana for trading, Avalanche for lockup

📜 14:51 DTCC entitlement vs onchain shares: what you actually own on Robinhood

⚠️ 16:46 Why owning tokenized versus traditional shares carries real risk

⚖️ 20:53 Why Rule 611 keeps onchain and offchain share prices identical

🧩 28:37 The three models of tokenized equity, and who should authorize them

🚨 34:47 Tom Farley's insider trading warning about unauthorized stock derivatives

🏦 40:10 Why institutions still fear crypto after Celsius, BlockFi, and FTX

🗽 44:02 Inside Securitize's tokenized trading partnership with the NYSE

🪙 50:01 Why Domingo calls Robinhood a partner, not a competitor
Learn more about your ad choices. Visit megaphone.fm/adchoices

📢 Bits + Bips has its own channel now — full episodes here: https://www.youtube.com/@Bitsandbips

Meta and Microsoft reported earnings on the same night, and investors sent their stocks in opposite directions.

Chris Galipeau of the Franklin Templeton Institute walks Steven Ehrlich through why Meta got punished for raising its CapEx guidance while Microsoft's Azure growth held steady, then makes the case that the broader AI CapEx boom is still only in its second inning, not a bubble about to pop.

Host:

Steven Ehrlich - Host, Head of Research at Sharplink - https://x.com/Steven_Ehrlich

Guest:

Chris Galipeau - Head Market Strategist at the Franklin Templeton Institute

This clip is from a longer conversation on Fed policy, Iran, AI earnings, and prediction markets. Full episode here:https://youtu.be/BXWq7OPcm24

We go live every Thursday - subscribe to catch it live.

Cape: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at https://cape.co/unchained (use code: UNCHAINED).

Chapters

🎙️ 00:00 Kicking off the Meta vs Microsoft earnings comparison

📉 00:26 Why Meta landed in the 'penalty box' on CapEx guidance

☁️ 01:25 Microsoft's Azure growth number was 'super strong'

💰 02:41 The FAANG-era CapEx inversion nobody saw coming

📊 03:41 How to actually evaluate a company's balance sheet health

🔄 04:52 The circular financing risk, and Steve's 'incestuous' tech giants question

⚾ 07:24 The baseball analogy: still early innings, and why this isn't a bubble
Learn more about your ad choices. Visit megaphone.fm/adchoices