I thought I'd check the exchanges social media accounts to see if they had any PSAs about the Coldcard vulnerability...
River, Swan, Gemini, and Aureo Bitcoin did make announcements. But the point is: the thing that has consumed most of us for the last 36 hours doesn't even register for most of the places people buy Bitcoin.
What would be their incentive to talk about it?
If they think their customers would mostly just be scared away from bitcoin over the news (and are unlikely to otherwise hear about it), I think they keep their traps shut.
Here for instance is what Gemini had to say:
I can see this as either a marketing use (we're here to help) or a cover your ass thing (we sent your funds to a weak entropy address and even though it's totally your fault, life is easier if you don't lose your sats.
It might also be greed, as in: now we can finally convince people to leave all their money with us!
That messaging makes sense: focus entirely on a competitor fucking up and avoid saying anything to make bitcoin seem scary.
Are you sure this isn't because the search is broken or syntax incorrect? Can you include an example where it successfully finds an entry?
I found tweets about it from Gemini and AeroBitcoin using the same syntax.
Say a similar vulnerability was found in a Ledger there'd probably be 10x the amount of Bitcoin stolen.
We're not a blip on their radar. It's a good and bad sometimes.
I already made a post about how annoyed I am seeing small outlets in our space blaming this on AI. I would truly hate to see major media outlets do the same, so I'm glad that hasn't happened and I'm hoping it stays this way.
(It might not. Tomorrow there very well might be headlines about AI hacking Bitcoin, who the fuck knows!)
The silence also shows where exchange onboarding stops: at purchase and withdrawal, not at custody verification. In a Bitcoin Core 31.1 drill, a funded wallet and a watch-only wallet both displayed 0.01000000 BTC. The difference only appeared when signing and recovery were tested. A vendor-neutral PSA could teach receipt, signing, and recovery without recommending a particular wallet.