I want to know where the Stackers fall on conspiracy vs incompetence. I could completely see something like a Retirement Attack happening. I could also just see a complete comedy of errors.
My running theory is that the maintainers could have had an "Office Space" style bug that gave them a little bonus. Others have pointed out that (there were reports of funds swept in 2022). Then some 18 year old gets a hold of Kimi K3 and blows this exploit wide open.
Not totally sure where I fall yet but I am leaning more toward conspiracy than toward incompetence actually. It's just so obvious and it was there for FIVE years. Where do you fall?
Easy bug to have been missed by average programmer(s).
Not that it was any excuse. Just that it's not obvious what is happening simply by glancing over the code. It looks like the code is doing what it's supposed to do. So comes across as a simple enough of a mistake by someone who has a bad habbit of using debug functions named as the same names as those in production (debug/local development features should be gated by explicit logic that checks the environment, not relying on function names; on firmware like this they should have removed all debug code from the production release for good measure).
So to me this was a nasty bug, a painful lesson and a reasonable legitimate (mulit million dollar) mistake.
I could see that but I could also see a sophisticated and determined actor inventing a bug that looks plausible. The fact that he contributed the code under a nym and sock puppets with it only adds fuel to the fire.
I think they put this poison pill in and they were waiting for the proverbial Order 66 but got beat to it by an 18 year old with Kimi K3 on Openrouter that went hog wild.
The founder was the one who committed the code though if I'm not mistaken ? The code is auditable so we know who made the commit.
The coins were not mixed and tumbled like the usual suspect hacker operations do, but consolidated onchain, so my guess would be strategic Bitcoin reserve.
I could definitely see state actor. I could even see CCP doing it to deny predominantly American/Western people from having the bitcoin.
Update: I am now on team Retirement Attack:
@justin_shocknet
👀
Optics aren't great
I find it hard to believe someone could be that dumb but also know enough to do this, but stupidly finds a way
Adding their response, or lack thereof, to those reports from years ago does paint a pretty damning picture.
Yeah, that didn’t age well.
I lean into a joke which didn't end well.
Also people are angry and want a scapegoat. Combine the two you get this.
I was happy at first when I saw the coldcard bug because I wouldn't hear about nvk in the near future. But now when I see the scale of the disaster I would not like to be in his shoes, psychologically it must be tough.
Inside job is what I have been thinking too.
are you saying nvk is 18 yo?
Biggest argument against it is they should also be sophisticated enough to know there's no great way to wash those coins, might be the most toxic coins ever with customers all over the globe and therefore law enforcement risk anywhere you go.
The business destroyed and potential legal costs likely outweigh whatever small amounts that could be dripped out at a time.
Around the time of that post he had a hair across his ass for Foundation, who had only recently pivoted from shitcoin scamming. Understandable. The persona fits someone who believed in what they were selling more than just marketing, but was ultimately just too busy huffing their own farts.
Let me update my database of phrases. That's a keeper!
My reading of this question is not that there would have been a decision from the top, but rather someone who worked on the code wrote it this way so they could exploit it if need be.
Still pretty sophisticated to bury it so, being able to pull that off and not know how damned near impossible it will be to cash out seems unlikely... but if it was an off-shore wagie maybe they're content to drip small amounts and aren't bearing the cost of the legal/business destruction.