Unchained - Inside the Coldcard Hack That Drained Over $100 Million in Bitcoin: Uneasy Money

Episode Date: August 7, 2026

A hardware wallet's 5-year-old randomness bug just let hackers drain over $100 million in Bitcoin. How many more waves are coming? Plus, Ethereum's fight over cutting ETH issuance. ======================================================== Thank you to our sponsors! ⁠⁠⁠⁠⁠⁠Cape⁠⁠⁠⁠⁠: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at ⁠https://cape.co/unchained⁠ (use code: UNCHAINED). ======================================================== A firmware randomness bug buried in Coldcard's code since 2021 surfaced last week and has already drained over $100 million, an estimated 1,600 to 1,800 Bitcoin, across four attacker waves. Taylor Monahan makes the case that the culprit is not North Korea but professional GPU crackers, and explains why the dice-rolling ritual many early victims trusted still left them exposed. Sonya Kim, co-founder of 3F Labs, and Mike Silagadze, founder and CEO of ether.fi, debate where DeFi's responsibility ends after trade.xyz's SK Hynix perp swung from $1,128 to $917 on a thin premarket print, then turn to Ethereum's own monetary policy fight. That fight centers on EIP-8361, a proposal to cut ETH issuance that opened with only 48 hours for public comment, reviving the minimum viable issuance debate Sonya once worked through at Steakhouse. Silagadze calls cutting issuance economically unsound and warns it could push billions of dollars of ETH out of staking, while Kain Warwick argues the resulting chaos is good for an Ethereum governance culture that had grown too quiet. The conversation covers Coldcard's entropy failure, the dice rolls that did not save early victims, trade.xyz's oracle mispricing, and Ethereum's issuance fight. Hosts: ⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix ⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert Guest: ⁠⁠⁠⁠⁠⁠⁠⁠Sonya Kim - Co-Founder of 3F Labs ⁠⁠⁠⁠⁠⁠⁠⁠Mike Silagadze - Founder and CEO of Ether.Fi Timestamps 🔓 01:17 Coldcard's 5-year-old entropy bug resurfaces, over $100M in BTC stolen 🕵️ 10:26 Taylor argues it's not North Korea: this hack needs compute, not scams 🎲 21:00 The dice roll debate: why 50 rolls barely saves your seed phrase 📱 27:14 Cape: Get 33% off your first six months with code 'unchained' at https://cape.co/unchained 📉 27:39 SK Hynix oracle glitch on trade.xyz reignites the platform-responsibility fight 🔗 42:24 Aave retreats from multichain sprawl as EIP-8361 issuance fight erupts 🧠 51:26 Mike on why cutting ETH issuance would push billions of dollars of ETH out of staking 🔥 53:05 Sonya's fix: burn fees for the same effect without cutting issuance 🌀 01:05:20 Kain's take: fragmenting the EF into chaos is actually healthy for ETH Learn more about your ad choices. Visit megaphone.fm/adchoices

Suddenly your yield goes down to, you know, 20 basis points, which is probably, you know, where it will end up. Like, okay, so now you're going to have tens of billions of dollars of ETH unstaked and, you know, out there in the market. So clearly, like, if you're worried by ETH price, which is one of the arguments, that this is going to be worse, this is actually going to be much worse. I think the argument, and I would not, again, I would not make the argument to increase issuance, but the argument to increase issuance is in my, I'm actually stronger than the argument to decrease it. But the strongest thing is just don't f*** it. Hey, everyone. I'm Kane Warwick and welcome to uneasy money because what happens on chain never stays on chain. Before we begin, here is a word from the sponsors that make this show possible. This episode is brought to you by Cape, America's Privacy First Mobile Carrier.

Same premium service you'd expect from any other carrier, but designed so your number, your location, and your data actually stay yours. Get 33% off six months at cape.co slash unchained. All right. Hey guys. I'm here with my co-host Taylor Monaghan, security expert, and we have a special guest this week. Sonia Kim, co-founder of Free F Labs. Welcome.

All right. Our first segment, let's jump straight into it. The cold card tear down. So for those of you who are not aware, I'm going to hand this over to Tay in a second to give us the full debrief here. I guess she's been deep in. in this, but Cold Card is was a hardware wallet, one of the minor hardware wallet players out there.

And they had a small issue which basically wrecked everyone. So yeah, Tay, why don't you walk us through the details of exactly what are all here. Yeah, so the most, I guess, basic way I can put this is that one of the critically important jobs of the wallet is to generate a secure private key or seed phrase. And the way that you do that is with a thing called entropy, which is just randomness. It's just, but it has to be like truly random. And this is just like a cryptography math thing. It's not super important.

You understand exactly what it is. It is important to know that you absolutely need it, like desperately need it. Um, for those who have been around for a while, you, you might have heard of like the profanity bug. That was also like an entropy issue. And so basically if you don't do the math, good enough, then everyone gets wrecked. And like, like this is this is not even like profanity was another one. Uh, there's been a ton of them, right?

Like there's been a ton of these, these things. It's like you. Yeah. Yeah. Yeah. It happens quite a bit. It used to happen more when we were still like. rolling our own crypto and doing weird stuff.

Exactly. This thing goes back to 2021. And that's what makes this incident, I think, different and crazier than all the rest. First off, it's cold card is a hardware wallet. So they screwed up this, the way that they were getting randomness, they screwed it up in 2021. It got in the code base. It was used for five years before someone discovered it.

once that first attacker discovered it and started to exploit it, it's basically, that was like six days ago, seven days ago now, it's been a free-for-all since. Because there's basically five years of seeds and private keys that the various attackers are basically mining. And so like, how do I explain this? So when you don't have enough randomness, you don't have enough entropy, what happens is they,

they have to like mine. They have to like literally like throw massive amounts of compute out this stuff in order to get it to go. And once they do that, then they take all the funds. But it takes time. It takes energy. It takes compute in order to do this. So that's why we've seen. The thing that I think I was like the last time something big like this happened and maybe it's profanity.

we you know i was trying to explain it to my team at the time right and um you know when you get a vanity address right yeah um if you say i want you know and and we've talked about the uh the like address poisoning attacks where they like make an address that looks like yours or whatever yeah and you know the first four last four might take them like you know 10 seconds to to cook right but if they wanted to have the exact same address as yours, like with just one digit removed, it would take like, you know, a trillion years or whatever. Yes. Yeah.

And so, you know, if you want zero X, you know, whatever, dead or some address like that, right? It takes the more you want, the like more of the address that you're trying to get, right? Yeah. The longer it takes. and you can go to like these vanity addresses and be like, hey, I want like zero X, Tay is the best. And it'll be like, right, that'll take a week, right? Yeah.

And then if you're like, Tay is the best and the smartest. It's like now it's going to take like a century. It's like a century. It's like, oh man, I really wanted that like vanity address. Right. And this is this is kind of the same thing where like the reverse engineering. Exactly. You only got zero X TA.

And like that's not enough because that would take like a minute to. And so they're just like cycling through these things and waiting until they hit something. Yeah, exactly. And so that's why I always say like entry issues in wallets are the worst vulnerability, like the absolute worst. One reason is because the attacks play out like this where we are going to see losses for the coming weeks and even months. Right. The other reason is that these are non-consodial, the cold card. These are, like, pretty hardcore bitquiners.

Gold card specifically deleted all of their data. This is like a marketing thing, right? Like, they were like, we're not ledger. We don't keep any data. So now they have this five-year-old bug that's wrecking everyone, and they have no way to warn people to, like, move their money, right? Like, it's just so painful. We're, I think, okay, so to talk about numbers really quickly,

Galaxy research has been doing Alex Thorne. He has been doing an amazing job. He's been doing what I usually do. I'm just onlooking this one. Poor guy. He's been doing so good, though. So he's collecting victim reports on the one side, and then he's also doing some crazy on-chain analysis to find all these different clusters,

and they're calling them waves. At this point, we're looking at like, okay, so last check, I think we have four waves. So a wave is sort of like a set of movements. And we're kind of assuming at this point that each wave is like a distinct, it's a distinct cluster of activity. They're probably, they're probably, I won't say probably.

It's possible that it's four separate threat actors. Right. But it's also possible that like waves one and two are the same threat actor. And we're not like 100% sure yet. And so he's doing, he's doing like you get a victim or, courts, you find the pattern, then you find the other things, you combine it, you find all these waves. Total numbers right now are, it's like over $100 million stolen. It's like 1600, 1800, Bitcoin, thousands and thousands of addresses, probably thousands of victims. Uniquely, like,

these are all super hardcore bitcoinsers who believe in self-custody and cold storage and hardware wallets and safety and that makes it too painful. Like, I, it's, you know, it's funny, like, I was, I was a Bitcoin maxi in the old days, right? And like, you know, hardware wallets, like, of course, like, you know, there, there was definitely a segment of, like, a hardcore Bitcoiners that were like, you should have a hardware wallet. They were the more pragmatic ones. Like, the actual hardcore ones were like, you should, you know, get out of deck of cards. Yeah, get out of deck of cards and, like, sit there for eight hours, like generating your own entropy, jizzle it on a tablet and like,

you know, put it in in a safe or something, right? Like, throw away the key. Um, like, you know, anything that was like, anything that touched the world or had firmware or whatever was like very much like not acceptable. Um, and, and so, you know, like, yeah, like, definitely it's Bitcoin maxis for sure because they were tarving that, that group. But like, yeah, Yeah, it's still You're still reliant on someone else's the software and and and and and But yeah, the The like bad seed phrase generation stuff is it's so bad

It's so bad So if anyone, by the way, let me just say If anyone listening to this, that's a cold card, uses the cold card, knows someone with the cold card, Please call them on the telephone like a boomer and Make sure there are shit Yeah. Like, don't mess around with this. Take your time doing so. They do not panic and go click the first Google result. But like, you know, like do it. Please, because this is, this is literally an ongoing thing. We are going to see losses from this continue to grow over probably like this week and this month. But even like far into the future as people like continue to use their, they're basically these weak ass hardware wallets at this point. And then I think it's also just worth talking about the other conversation or the other half of this is like who's behind the attack, is it AI?

All of those fun questions. Is it North Korea? All those fun questions. Oh, he's North Korea. It's not actually North Korea this time, guys. This is not a North. How do we know? Yeah, how do we know?

Okay. So North Korea just doesn't do these types of attacks. It takes a massive amount of compute. And there are guys that have been like, tracking and mining these things for ages. My best guess, based on the sort of distinct waves of activity and what I know about like prior intrepid attacks, I think the first wave was probably someone who found the issue in the code base, maybe with AI, maybe not.

Some people are like saying that AI can find this, but once the, once the exploits like public, the AI tends to learn from public reporting. So it's not as reliable to say like, oh, it can find this. Like there's a big post on Reddit right now that said Claude can find it in two minutes. It's actually not finding it in two minutes. It's finding other Reddit

posts about Drop can find it in 10 seconds, right? Yeah. Yeah. Exactly. Well, I saw on the Seeb's post, though. There was a post saying like, you know, put, you can put an agent in the sandbox like running in pie, like strip

tools or whatever. Yeah. And see. And I think even then, when pointed at the code base, someone was like, yeah, like stripped in a sandbox, it took 10 minutes or something like that for it to find it. So I don't know. I haven't tested that. Maybe I'll test that today.

Yeah, you should test it and let me know because I would trust you. It's a weird one because like the where the exact vulnerability is, this code base was a mess, guys. go look at your code bases that you're relying on. What's it written in? This is an old, this is old code. What's it written in?

Python, I think there's like some. Oh, okay. Yeah. There's something else though too. Python and C or Go or something. Okay.

But it hops. So basically you have, you have basically one repo and it hops to a whole other repo. And so you have to follow this chain. You have to be like, okay, it's getting the randomness from here. It's going to hop over here. And then you're like,

oh, what's this? And it's like, oh, okay, this is actually a completely different language and repo library. And you have to hop over to that. You have to then traverse the whole thing. And that's where the, that's where the confusion happens, right? It's like it's supposed to go here and it goes.

Yeah. This one thing that I saw, right? Like gave me like chills, right? Because I work with agents all the time. And one of the things that I have in all of my repos, like it's like number three. is no fallbacks, right? Because they will make a chain of pullbacks that makes it impossible to see what's going wrong. It looks like it's fine, but you don't know, right? Like, even when you're reading the code, it can be hard, right? But if you're not reading the code, it just, you look at the thing and it's like,

okay, you know, they're like, oh, we'll show an A here, you know, if something goes wrong, right? And then the thing goes wrong and it's like built a fallback so that like, oh, well, actually, you know, we won't show it because we're just going to like hide that thing. And they'll like especially codex, it will put in like five layers of fallbacks, right? And it's funny because it's one of those things where I'm like these fucking agents, but they learned from us. This is the first time that I'm like. And most times. So this is a thing. There is like an old old quote. I think that's a Matthew. quote from 2015 after the True Crypt audit. So TrueCrip was like another like super hardcore over a decade ago thing,

encryption cryptography thing, right? That ended up having a pretty nasty vulnerability in it that allowed. Because you're like, so this is supposed to be secret. And then the randomness was screwed up. And you have a great quote in there that has always stuck with me where he goes, like, if your code cannot get the randomness necessary or initialize the process, us like with any amount of confidence, then it should barf and catch fire. Yes.

Like the end. 100%. Throw an error. Stop hard. Like, you know. Exactly. And in this case, and we're going to see it with AI code as well, but humans do it too, that's actually kind of the opposite of what you want with code most of the time.

Most of the time, you don't, like error messages are bad. That's a bad U.X. You want fallbacks. If the API call doesn't work, you want to fallbacks to the other API so that people can get their balances, whatever. But with cryptography, you do not want that. You want it to be dead simple. It either works or it doesn't,

and you want to know when it doesn't work. And in this case, that's definitely one of the things that happened. Yeah, that it fell back to this, like, huge, high library. And nobody noticed.

Like, you know, there's conspiracies that the team did this, and they were insiders and it just on, like, I don't know. I have a question. I have a question. So I don't have any background in security or cryptography, but as like a user of a hardware wallet, this really concerns me.

And, you know, a defy founder, we've gone through like a whole host of the tax this year. Yes. Like being kind of the new vector. Are you worried at all about hardware wallets being like the new vector that this is maybe like one of the first that we're seeing? But then there'll be like more and more waves of other providers. that might be vulnerable to either this specific attack or like some others that we may not even be aware of? I'm not too worried.

I think this one definitely caught me off guard just because of how long it's existed. I think this is a, it is a bit of a perfect storm type situation. You have a complex code base. You have a small developer team. they seem to have antagonized a lot of security researchers and engineers. But there are people that are now coming out, very well-known Bitcoin doubts that are coming out and saying, yeah, I tried to talk to them because I didn't understand the code base or trying to understand the code base and they were dicks. So I didn't like keep looking or whatever.

But I don't know. Like I'm still in terms of like general broad risk, I would say you're more likely you're more likely. you're more likely to lose money from like an offset failure fishing, social engineering, than like this specific bug. This specific one is just scary because you can't. It's very hard for like, it's very hard to give end users any advice. And that's why it is painful. Yeah. Because I can tell you like, Sonia, don't get on random Zoom calls with North Koreans.

Okay. and you can you know you can you can take that advice and uh improve your life with that advice with barber waltz like i you know and especially this vulnerability it's like go read the code base right like that's what bitcoiners are saying right now read the code base i'm sorry that's like completely illogical um yeah you lost me there already yeah exactly exactly i would say i guess maybe one piece of advice that's like more realistic is um ask your teams about their audits, right? These guys didn't have a single security audit.

And then actually read those security audits, right? Look at even non-technical people can have discussions and look at codebases and notice things like, like, if it's one person committing directly to Maine without any peer review, without any process, usually a very bad sign. there's a lot of like signals like this that that even if you don't see the the literal issue or find the literal issue hidden in the firmware there's a ton of signals and a ton of red flags and if you were to go look at Treasers code base ledger's code base they don't like they do not operate like this

these are large teams it's organized they have processes they're processes in terms of how they commit code how they comment their code, how they peer review their code, how the build system works, right? On and on and on. And they, you know, that it's required. When you're predicting billions of dollars, like that's like bare a minimum.

And the fact that this team wasn't doing that and nobody noticed is it sucks, but I think it's also a failure of just like the community for trusting that these guys, because they're such hardcore bitcoins or whatever, that they had it on lock. and they clearly did not at all. Have it on luck. Not at all.

Yeah. Oh, and I didn't answer why we know it's not North Korea. North Korea, they do social engineering. That's it. They're very good at it. It makes them billions of dollars. They're very happily doing that. The guys that have the major compute and, like,

GPUs to crack these types of things have been doing so for jacket. they don't only crack private keys in bad entry. They crack databases. They crack passwords. They crack. Like, they're just doing this 24-7. They're very good at it. Their scripts are all, like, super optimized.

And they're just, like, sort of like turning knobs on the, they'll, like, write the exact script for, like, this new type of entry issue. But then it's just a matter of turning the knobs on how much compute, right? To make sure that they're profitable. So, yeah. So that's a, in terms of like who it is, I would say there's a possibility of the first wave is like a normal type dude, like Lone Wolf found this with AI. It's possible. It's also possible that it's, you know, someone that's hunting these for a living and has been for a while.

I think the later waves, though, are definitely more like professional crackers. Like the people that just like brute force these things. on and on and on and on. So yeah, presently not North Korea, but. What the one thing before we, before we go to ads, is the dice thing. There was also some thing here where like they had some suggestion that like on top of the like firmware based entropy you should also roll 50 dice to add.

had like some off-chain entropy, just like classical Bitcoin, like, you know, don't trust. Get all your dice on, guys. So, so, so what's, what's the deal with that? Like that, like that, okay.

So basically what they're saying is, okay, so entropy is randomness. It's like the noise in the world, right? Cloudflare famously has a wall of lob blablanth in their office. and this is like one way that they generate entropy because they have this camera on the lava lamps, right? And it's like, and there's mirrors behind the lava lamps too. So basically they get the entropy from this thing

because it'll never be the same and you can't go back and calculate or whatever. That's entropy. So one way to do it is like, you know, you trust the firmware, which in this case was a terrible idea. Another way to do it is you build like a huge massive wall and algorithms of lavalance and fancy shit like that. Another way to do it is with dice.

So basically if you roll, you roll a set of die 50 times and then you take that input and use that input to contribute to like the entropy pool, the randomness pool, then you're going to be more secure. However, I want to caveat this because I think almost all of the early cold card victims, meaning the ones that came forward prior to the last week. So the people that came forward and had their cold card attack in. 2021, 2022, 2022, 2023, 2020, 2020, or 2025, right? They're not a huge number of reports, but there are reports.

You can find them on Reddit. I've looked at them on chain. I've had these victims before, right? In almost all cases, those people were the dice rollers, okay? So the problem with the dice rolling, and I'm not actually sure, hold card might have fixes.

The problem with the dice rolling is that if you don't roll the dice enough, then you still don't have enough entropy, and it's right it was trivial trivial uh trivial to crack those um and so I think they're saying 50 plus is probably safe probably like do you really like really are you the advice is to roll the dice 50 as a Bitcoin maxi yes like this is like the type of shit to say well right like yes this is what they love so everyone says roll the dice 50 times and then people like actually some people like very few people but some people

like actually try to do that. And then they didn't roll them 50 times. And then they got half before this wave. Amazing. So, you know, it's, we have to make it easy for users. There are a few insane people. I think there was a tweet about specifically the Korean Bitcoin community. This is like actually like, they're like, they're like, we're rolling 500 times.

We don't care. Yeah, yeah. Apparently they were very good at actually rolling the dice. But as an American. over here. And I know my American friends. I'm just saying, if you tell American rule on dice 50 times,

they're not rolling. They're going to get three times and they're doing it out. They're like, ah, this is actually boring. I'm done. Exactly. So, I don't know. Maybe, like,

I mean, we do know that Koreans are very dedicated and disciplined. So, you know, maybe it's okay. But, you know, as you can say, a theme from my last very much. I'm actually Korean. So, yeah. Do you agree with this?

Probably. Probably. Yeah. Although I'm a bit of a hybrid. I'm a Korean-Canadian. So maybe the North American cultures. Yeah. You're like, you're 10 times.

I'll roll. I'll roll it like I stand by. I'm a lady. Not three. I'm not going to stop the three. I'm going to go to 10 and then I'll give up. But I mean, this is this is kind of the, you know, this is exactly what we're talking about.

with like many addresses, right? Three letters, you're like, ah, three letters, that's fine. No, like that's not fine. That'll take, you know, these things are like exponential curves, right? So, three letters take five minutes, four letters takes 20 and, you know,

20 letters takes like a day. Yeah, exactly. You know, it's funny. There's a Neil Stevenson book where they, like, in the book, they describe like this way of like using a deck of cards. to create passwords.

Yeah. And it was actually in Korea. I was in South Korea in like 2003 or something. And I was reading the book. And like this is like even before like good password managers and stuff. So so I basically sat there for like I think it was like two hours or something. Like so this is like so autistic. And like dealt the cards out and like came up with like 10 different passwords and then

memorize them so that I could like use them interchangeably for for my podcast. passwords from then on because I was like, oh, this entropy thing, it's going to get me. So, um, I don't know, I wasn't, I wasn't, I wasn't secure. Today, uh, yeah, I probably could. Yeah. Yeah, I probably could. Um, yeah, I have, I have, uh, like, and so I used to have like variants of, like, you know, the core posthoid and like five, uh, five extra characters or whatever variance. Um, uh, weaponized autism. Um, so, all right, Let's go to ads. Before we continue, let's take a quick commercial break and we will come back and talk about the another Korean thing, weirdly. Let me get out of attention today. Yeah, this is like a lot of Korean angles here to this. We're going to find out how Samani's Korean suit. All right. Let's go to ads and we'll come back and talk about trade.ex.Z.

If you hold crypto on your phone, your biggest vulnerability isn't your wallet. It's your carrier. AT&T, Verizon, and T-Mobile have been breached again and again, and SIM swaps are still one of the easiest ways for attackers to drain accounts. That's where CAPE comes in, America's Privacy First Mobile Carrier. Same premium service, but CAP rotates the identifier on your SIM every 24 hours, deletes your call and text metadata after a day, and protects against SIM swaps with a 24-word recovery phrase that only you control. You also get two middle-to-end encrypted secondary numbers for banking and sign-ups, so you stop handing your real number to every app that asks.

Go to cape.co slash unchained and use code unchained for 33% off your first six months. All right, we were back. So there was a PIRP issue, an Oracle issue, Oracle's and PURPS, one of my favorite topics, last week where S.K. Hynix, perp on trade XYZ fell from $1128 to $917, $917, and then almost immediately recovered.

it. So this was like some thin pre-market print that happened. It was a real trade and then a bunch of people got wrecked which again like

oracles. Actually we have a special guest another special guest who's going to just join us. Mike from Ethan Fy so let's pull him up on stage. We're going to talk Ethereum later.

So I think let's let's get this rolling. So welcome. Thanks for joining us. So yeah, trade.xyZ. I think the maybe most interesting part about this is that they were like, actually, sorry, we're going to make you guys whole. And then they were like, well, but just this one time, like never again.

This is not a precedent. Like, don't come crying to us if this happens again, which it absolutely will. So, yeah, I don't know. Takes on this Oracle problem. But yeah, so I think, you know, the other thing that was quite interesting that this was a Kobe post that came out around about the same time as this, where he's like trade that xyz is not raising money which is always like a weird like whenever cobi tweets something randomly like you know that there's some like chaos going on in the background

that like some some crazy shit going on so so basically the the setup here is you have hyperliquid and then you got trade dot xyz and trade dot xyz is a call it ecosystem participant that offers RWA perps right um and you know RWA perps are maybe like a little in in the gray if that still exists in this day and age um in terms of like what you can get away with doing um so uh so you know Hyperliquid has like core crypto assets and then they've got all of these like other ecosystem partners that offer like different um different different other asset classes and trade types, you know, options, et cetera.

But again, you know, the challenge with Ottawa is that you don't have to the same extent with like Bitcoin is someone has to tell you what the price of this thing is. And RWA's stop trading at random times for random reasons. Like when synthetics was building this, like this took us like a year of dealing with Oracle providers like Chainlink and and a bunch of people. Chain links people that they were talking to had no, they're just not, they're like when the market is shut down, the market is shut down. Like why would we care about the like outside of market times, right? Um, but pre market closed markets. Um, it's it's a really challenging thing, uh, to manage. And so like a real trade happened in pre market that someone dumped all of their SK Heinix. Uh, which maybe was a good trade actually in hindsight. And, and,

you know, that's the price. Right. Like, and, and so there's, you know, even the fact that trade XYZ was like,

okay, this probably shouldn't have happened for reasons, whatever, even though it was a real trade, is like itself a pretty opinionated take on asset pricing. Right. And, you know,

whenever, I mean, this, you know, to Mike, like, what is the price of E versus Rapti? Is it the same thing? Like, what about when it dislocates for some weird reason? Like, is it still that price? Like, you know, or like LFTs, LRTs, right?

Like, you know, this is, this is the thing that you must lose sleep over, right? Like, you know, not all slavery. I mean, we're somewhat of a preview. We're going to make trading a lot better in Etherfi over the next couple of weeks. And it is something actually right now, you know, we're beta testing and some of this functionality. And yeah, we actually had the exact same situation where a couple of trades went through. We're, you know, not massive sums of money, but like users lost a bunch of money because they were allowed to do something that I think reasonably we should have not allowed them to. do. Now, if somebody goes to Uniswap,

right, goes to the UI, pick some, you know, low liquidity token. You know, this happened not that long ago, right? With AVE, someone went to the UI. Yeah, yeah. I want to say $50 million for 500 bucks. Right. It's just madness. Now, on the one then you could say, look, sorry, bro, this is

permissionless smart contract. Like, you press the proof. You saw an A.U. But, like, I think if you're hosting the UI and you're, you know, I don't want to say facilitating the trade because we're not facilitating the trade, but you're playing some role. Yeah, you're involved. You're playing some area, right? I think ethically, and I do mean ethically, like you have a responsibility. I mean,

you have a responsibility to prevent the user from doing something that's just like wildly insane. I think that's how brokerages operate. Again, not that, you know, we're brokerage, but if I go to interactive brokers, and I do try to do some insane thing. It does, you know, it's laser order. And I think, I think Uniswap should do that. I think, you know, we're planning to do that as we roll some of this stuff out. And I think trade XYZ should have should have done that. Like, this isn't, you know, this isn't rocket science, right? It's actually, it's not that hard to know, hey, somebody tries to do a trade with 70% price impact or some crazy slippage. You probably shouldn't just shouldn't let the user do that.

Forget warnings and red text. Like, you just shouldn't let them do that. What if they really want to? What if they really need? This is, you know, this is the thing, right? Like, what if that kind of really needed? Well, they can do it somewhere else. Yeah.

Go to Ether scan. Go to Ether scan. Yeah. Like contracts, right? Yeah. This feels like the same conversation that we've had before with. We have it all, we have it like every few weeks. Oh, okay.

So it is. It's not, this is literally the same. This is like what is there's like a philosophical epistemological question of like what is the price of something right? Yeah. Like there is no price. The price of SK Hynix was like, was it the closing price like 12 hours before? Is that the real price? Or is that like what some idiot on a Saturday wants to sell because they're like getting liquidated on something else and they need to, you know, like.

There is no such thing as the price of an asset, right? It is like a, some kind of a construct. So you need to have a set of rules that says, and, you know, the, like, if someone is willing to sell enough SK Heinex at $1, like, is that the price for that five-minute period where they're, like, just dumping into the market, right? And, and, like, these are, these are, like, non-trivial problems. You can't solve it because markets just do weird shit, right? And so, you know, I think trade.xy Z, like, part of the UX is like if something goes wrong as the venue and, you know, NASDAQ does this, right?

Like we were supposed to have, you know, like stop triggered on this and it didn't or it happened three times and we're just going to roll back the trades. Or like, this thing happened. Someone fat fingered a thing. It's not the real price. We decide what the real price is. the challenge for a defy is like you're not even supposed to be involved with this right like it's supposed to be contracts and stuff and all of a sudden you're like making post hoc judgments about what the real price was it's okay for the NASDA to do it I don't know about about like trade dot XYZ that's well what could say like if you're operating a wallet right like whether let's say metamask or phantom and a user tries to interact with a known malicious contract like it's the same kind of argument you could say well listen Listen, it's permissionless, man. Like just the user should be able to do whatever they want. But the fact is, look, you're operating an app. You have a list of malicious contracts. At minimum, there should be a multi-stage thing that tells you, if you do this,

you're just absolutely going to get destroyed. And in the end, I think it's a discretionary call to say, no, we're just not going to let you do this. No matter what, someone steals your phone, tries to do something. We're just not going to let you do that. And I think either decision is right. but sort of throwing one's hands up in the air and saying like, hey, listen, it's not our responsibility.

Like, look, just objectively, to some extent it is. You're running the site. You're providing some responsibility. Exactly. Yeah. I mean, you know, let's not, let's let's be realistic, though. Like part of the reason that people were like, eh, I have no responsibility or like, I can't do things or whatever, like we talked about this lot.

It's like, you know, if you said, yes, I'm going to stop people from doing something, there was a guy called Gary Gensler who would show up your house and blow your brains out. And so everyone learned some Bitcoin maxis who are going to like come. Yeah, there were like two groups of people that would come. The philosophers are going to come and happen. But yeah, so all right, let's let's go. I was going to add one thing.

This actually reminds me of when I was at Steakhouse, we implemented this thing. called meta-orical. Mike, you might be familiar with us. I remember, yeah. You know, in London Protocols, when you integrate an asset, there's a question of, do you use the fair market value, which can, you know, whiplash around like we've seen here, or do you use the primary redemption value? Or do you use both and try and figure out when there are deviations?

So it's a real, I mean, you know, in different lending protocols, stable coins, stable coins have been hard-coded at $1. Is that right? You know, there's so much different opinions around this. And I think it's quite prudent to have, you know, like a meta-oracle, like the one that Stakehouse had implemented on Morpho, where you actually get notified and there's a deviation, when there's a great enough deviation, then you can kind of switch off between the two. So the challenge is, right, with articles, everything you do creates like downstream consequences, right?

Like you make that design decision, right? And it's like, oh, that's good, you know, okay, we don't want people to get wrecked in this case, which is like, let's call it, you know, the like two sigma case, right? But then you switch that thing on and then in the three sigma case, everyone dies, right? Like there's just, you know, like, like, it's like, ah, okay, I see why that was a mistake now, right? Like, it's, it's really, really hard to fuck with oracles and not have layers of consequences that are, like, built into all those decisions that, like, as you get further out into the tail of, like, you know, possibilities, like, increasingly bad things happen, right? Like, you know, we, we used to talk about this all the time of, like, what happens? happens if everyone tries to get out and the exit queue.

Meanwhile, it was actually the problem is like the entry queue was that was going to be the like limiting factor, right? You're like, oh, like people are going to want to get out of staking, right? Now we'll talk about this in a second, right? Now we're like, actually, what if we stop this entry queue? This entry queue is actually like really annoying. There's too many people trying to get in, right? And so oftentimes the thing that you're trying to prevent ends up not actually being the real thing. It's some other thing

that you didn't think about and then the consequences of that are like significantly worse than the thing that you were worried about it and trying to prevent. So yeah, mechanism design is hard, I guess, right? So let's let's go to

let's go to this next topic. Oh, hey, Kane, two birds. I got a hop off because real life. real life is hitting me. Oh, okay.

But I want to say thank you to both the guests for being here, obviously, and definitely, like, keep talking about this crazy shit. I'll be listening. I just have to go deal with some life. It's really quick. All good. But I'll see you next week. Thank you guys.

All right. See ya. Usually it's like some horrible hack is going on, right? When Tay gets dragged. I'm taking dragged off stage. It's like, usually someone's lost a lot of money. Maybe we'll hear about it on CT tomorrow. Yeah. Yeah.

Hopefully it's not. Hopefully it's not that. So let's talk about these two topics here that are both kind of tied to Stani from Avey. So Avey has started to pull back from the, you know, the Everywhere play that they were running. one of I think the first projects and I think it helped them right that like they were kind of operationally capable enough and and organizationally capable enough to like very

rapidly roll out to new chains in a way that like a lot of other protocols struggle with and and you know they were able to kind of be everywhere the like full core press mode that that they had you know where like every L2 random you know, L1s that you never heard of and you go there for the worst time and like standing's like, hey, welcome. And you're like, what, that? Why are you doing here? So, so they've now, I think, gone to the point where they're like, okay, this is negative BV to be everywhere. There's a bunch of like risks that we're taking by being on these chains and, you know, the tradeoff is not worth it, right? And starting to pull back. But I think there's

maybe the more interesting Stanley related story was him pushing back on EIP 8361 so Mike maybe you can walk us through

what is EIP A361 why should we care about it what's what's going on here? Yeah so I mean just every aspect of this was terrible So there's this EIP. So let me actually, let me start with this.

There's been a lot of discussion over a long period of time, I don't know, years really, about ETH issuance. And isn't this a problem? Like in other words, in particular on stakers who, you know, deposit their ETH to help secure the network. And the reward they get on that is about, I guess, like two and a half percent these days. That's a blended rate of, you know, NBV and actual staking rewards. But whatever, let's call them about 2.5%. To a half percent. Risk-free rate is 2.5%.

Yeah, I mean, I wouldn't call it risk-free, but objectively, the risk is quite a lot. Sorry, sorry. That was a joke. That was a joke. People get very sensitive when you call it the risk-free rate. But, look, objectively, it is low risk. That's why I do it, because it's fun. You know, very low-risk rate.

you know, two and a half percent. And, you know, I guess for some people, this is just a burning issue. Like, this is the big problem of Ethereum. It's not that there's no privacy or the interop is non-existent or block times. They're ridiculous, you know, 12 seconds or gas prices are still probably 10 times higher than they. No, these are, no, the main problem is that there's like an extra, like, one percent of issuance. Exactly.

Just, you know, so anyway, so there's the CIP that's been proposed. with the 48 hours to provide comments before it basically goes into, you know, consideration or vote for inclusion and, you know, the next or the upcoming hard fork of Ethereum, which in itself was just, I don't know, I want to say offensive. You know, like I'm, whatever. I'm, you know, I'm a random guy, but hey, I'm like, you know, myself and my team are builders in Ethereum or one of the more important protocols I would stay in the space. but not just us, but nobody was consultant on this.

Like not a single, you know, DM message. Nobody was asked like, hey, do you think this is a good idea? What are some consequences that might happen here? But just, you know, 48 hours notice this thing goes up. And so that rubbed people the wrong way. A lot of people were just flabbergasted like, hey, if you gave us a month's notice, okay, fine, that might be reasonable. But this is just, you know, just madness.

And it just, it also speaks to a level of, frankly, just immaturity. Like, this is a serious, this is a, what, $500 billion network, you know, not trillions, but many billions of dollars of assets are secured on this thing. And like this kind of behavior, I mean, can you imagine any serious institution, financial or otherwise, just with this level of, you know, whatever, I can. Soviet Russia. is the good. That would be important.

Like, hey, here's the new plan, guys. What do you think? Yeah, that's an app comparison. Sorry, yeah, go ahead. For what it's worth, my former colleagues at Stakehouse and I had been weighing in on this issue since 2024. So I don't know if you guys remember, but there was a whole debate about at that point, it was called MVI, minimum viable issuance. And at the time, Stakehouse was contributing to live. Lido, so we were, you know, very privy to the potential negative downstream impact of, you know,

issuance being reduced. I think, you know, LIDO would be very much impacted and the price action today really shows, shows that. You know, EtherFIFTs would be a lending protocols that would be impacted because ephlooping would be, you know, killed overnight. And if loopers, in many cases, you know, make up a big part of the DAP revenues. So the fact that, you know, we've been weighing on this, weighing in on this over two years ago, and then there was no consultations in the last two years. And then I woke up to just, you know, like a tag on Twitter from the user who said, thank you for weighing in on this issue.

So it really did feel like it came out of. of nowhere. And, you know, this is worse than like, at least FOMC has, like, a right structure and process and signaling that makes a whole system much more reliable. Kane, as you say, this is just, I don't know what. Okay. But I make, I make the joke about Soviet Russia, right? But correct me if I'm wrong.

This is what we asked for. Right. Everyone was like the EF, too concentrated, et cetera, et cetera. Everyone leaves the EF, starts their own organizations. And those organizations are supposed to be like more commercial thinking about things, whatever their mandates were. And one of the first things that one of those new orgs does is say, let's slash issuance. Right. So again, I would file this in like the be careful what you wish for. And, and, you know, like, to your point, Mike, like, why do they not care about other things? Because they're allowed to care about whatever they want because they form their own org, right?

Like, there's no longer the EF where they have a mandate to care about all of the things in Ethereum, which effectively means caring about nothing. But now you have people that are like opinionated caring about specific things that have their own orgs that can like, you know, make proposals and drive things through, which means, I think, you know, from a, from an Ethereum perspective, which is good. Like, the fact that people are up in arms talking about this stuff, like, you know, agitating, there was a, there was a kind of apathy of governance that had crept in through the last couple of years of the EF being both more active, but also like setting the narrative as well, I think, where it didn't feel like if you, you know, if you're outside of the

EF, you really felt like you had no chance, but now it feels like anyone can say things, right? And so there, there is now more of a debate that's open. And whether this like proposal is, is good or bad or accurate or dumb or whatever, people can just say things now. So we are in a new era, right? You can write your own proposal and be like, actually, let's jack. Issuans up to 5%. Like, you know, treasury is a 4.5. That's the real risk free rate. We need to be above that, right?

You know, there's, there's an argument that 2.5% is too low to justify the risks of, let's not forget, you have to hold either, which is why I make a joke, right? I like the risk free. Like, you, you can hedge it, I guess. Which is actually a very important point. I mean, there's, there are two sides of this where there's an argument. argument, and I wouldn't make this argument, but there is an argument you made that issuance should be higher. And there's a credible, you know, you can say a number of things that are actually improved

defy. It'll make ETH staking more attractive, which actually is helpful to ETH price, because each stakers don't sell EF. Like that's, this is the, the, the particularly brain damaged aspect of this proposal that somehow reducing the issue. It's going to happen to that EVE that gets Yeah, like, suddenly your yield goes down to, you know, 20 basis points, which is probably, you know, where it will end up. Like, okay, so now you're going to have tens of billions of dollars of ETH unstaked and, you know, out there in the market. So clearly, like, if you're worried by ETH price, which is one of the arguments,

that this is going to be worse, this is actually going to be much worse. I think the argument, and I would not, again, I would not make the argument to increase issuance, but the argument to increase issuance is in my, I'm actually stronger than the argument to decrease it. But the strongest thing is just don't fuck with it. This is just not, frankly, the worst important thing by a long shot. Unintended consequences, right?

Like, people, you know, there's a reason why the status quo is the status quo, which is not to say you shouldn't try things, of course, right? But given the smorgasbord of trying things, opportunities that we have in Ethereum land,

trying things with the, like, monetary policy feels not smart. So right. When there's nothing obviously broken. When it's like fine. Yeah. I mean, to your point. We can go out of this issue, right? We can achieve effectively the same effect by generating fees because the fees get burned. So that's a subtraction on the number of shares. I actually come from Chad Fies. So it's instructive to think about it.

I mean, but we had this. Let's not forget. We had this narrative, right? Like the the EIP-159 burn narrative, like ultrasound money. We had that for a while. But if you think about who the marginal buyers are, it's going to have to be Tradfai. And Tradfai loves yield. Trafai loves the growth story of like where do revenues come from. Tradfai loves buybacks.

So these things are all achievable, not through an austerity measure, like reducing issuance and potentially, you know, risking the security budget of Ethereum. But we can solve it by having a growth mindset of, how are we going to onboard new users? Do the block fees need to be revisited? You know, I was actually going back to Ribbit Capital did a Ethereum thesis

at the Saan Investment Conference 2024. This was before Protodont. dank shardings, though, Ethereum was... Rip. They called it owner's earnings, right? It's how much the network is making net of the reinvestment. It has to make to sustain itself. Owner earnings was like north of $7 billion.

What is $7 billion over current ETH market app? It's like... Like 3% or something. Yeah, 3%. Exactly. So if all of that is, you... to burn, ETH, then we can achieve the same effect without, you know, like, rugging solo stakers and, you know, kind of the downstream implications of the

austerity measure, which is centralization and compromised security budget. So I think I would also, yeah. Sorry, I would also argue that there's not a lot of economists out there. hardly any, they would argue that a zero percent increase in the money supply per year is a good idea. Like, that's a Bitcoin brainworm. That's not a sound economic policy. I've got some Bitcoin friends who would, like the money supply should expand with the growth of the economy. That's how money supply works. As more goods and services are produced, you need more money to account for them. Otherwise, you get deflation and deflation is bad. Like this ultrasound money thing

is not, I guess, it's not in mind with any economics, Austrian or otherwise. So the whole thing just makes no sense. So like let's just talk about like the practicalities, you know, like staking ratios, I think are something that people, it's really hard to reason about, right? Like how much eats should be staked. And, you know, we're just about to, Like Lido's about to like collapse all their validators to like five valid, you know, making it easier to not have to run one validator for every 30 to eat.

Like, you know, we are making it easier to stake. But there is a question of like how much eats should be staked. Is it, you know, 20%? Is it 50%? Is it 80%? You know, the more, the more eat you have stakes, the less there is to sell to your point, Mike. Right. So, you know, and the fact that I would.

argue a significant majority, even today, of East Stakers are not financially motivated. They are, they're ETH Maxis that, like, my validators, like, I made this joke on, on X last night. Like, I think my yield has been, like, 0.5% over, over the lot. Because my validators are going offline, and then they go back offline. I've been slash whatever, right? So, like, my yield has not been, like, 5% or whatever that, you know.

but it hasn't stopped me from staking because I'm like, whatever, what else am I going to do with that eat? I might as well steak. I don't think that your marginal eat staker is sitting there going, the yield is like the primary driver, right? Obviously, at the margins, there's going to be a bunch of people that if you lower yield will on stake

or if you increase yield, it would probably come in and stake. But it is like a, a really strong question of like, should we have 50% staked? 60%, 80%. I mean, most cryptoeconomic networks would kill to have more people who stake their token. Like they view that as a positive. Like I don't understand this argument.

Again, if you view, and some of this seems to be driven by this frankly bizarre dislike of liquid staking assets, if you view those as just intrinsically evil for some reason, okay, fine, I don't understand. And I think there's a lot of value that's actually created by these assets, putting aside your buy position. And frankly, staking isn't even like a material part of our business anymore. But putting that aside, if you, like, if you view those as intrinsically bad, okay, then I can see, okay, let's just like, let's really crunch this down.

I don't even think it's going to have that impact. Like, yeah, you might kill the LSTs, but like, okay, at the cost of like centralizing the network much more dramatically than before. So I just, I don't, I don't see the, you know, the argument there. But as I said, most crypto-economic networks would want, like, it's a representation of people actually buying into the asset, buying into the network. Yeah, it's a positive thing. You know, your North Star.

Like, if it goes to 80% stake, like, what is the problem with that? Like, why is that a bad thing? I'm not, like, how much, how many dollars, you know, imperfect analogy, but how many dollars they're just sitting there passively, you know, as like physical cash or in checking accounts. Like, not that many. Most dollars are put to work. They're either invested or they're in T-bills or they're in bonds or something. Like, having Eath put to work, so to speak, securing the network and getting some small

share of the fees of that network just seems like a pretty reasonable, you know, system to have in place. I don't, like, I'm not, I don't understand the... I think there's like, part of this comes from, again, you know, like, most of the... like Justin Drake, like the, you know, Jerome, these guys came from like, you know, EF land, right? Like, and, you know, what's interesting to me is you see what the internal tensions must have been like at the EF when they're inside. You know, there's a group of people that's like agitating for like, we should be more efficient. And I genuinely think this is like an argument for efficiency, right?

like Ethereum should have the absolute minimum amount of eat state that is required to secure the network. Like genuinely, like that's the philosophical direction of where this is coming from, right? That like we shouldn't leak value. We shouldn't be paying more for security. You know, and like this, like what's the security budget, right? Like what is the cost to secure the network? How much are we paying? And a lot of people have this view, right?

Like, you know, Bitcoin pays like a billion dollars a day that secure the network for, you know, $100 million of transaction or like some, some like very distorted number, right? And people look at that and go, that doesn't make sense. You know, there's not enough economic activity to justify the security budget. But I think that the efficiency kind of argument, I see how you get yourself there. but it ignores so many other considerations in the real world of like incentives and why people do things and like you know the directionality of incentives that it just

it's a bit nonsensical oh yeah and again going back no i hope not no no way so like i do think i think that like again this speaks to here's what happens if you fragment what was the unified front is now fragmented. You've split out all these people. You've ejected them out. They're now out of the world doing things, agitating for things, whatever.

You will get more chaos. You'll get more dissension. You'll get more of these things where everyone's like, whoa, what the fuck you guys talking about, right? And, you know, like, there's no way that these guys weren't in the EF being like, we should do this, right? And, you know, whoever it was like, you know, I. or someone being like, we should do nothing.

And they're like, ah, fuck, fine, whatever, we'll do nothing. We'll keep doing that. But now they're like, oh, no, no one can stop us from doing things. Let's go and do some stuff. Yeah, I would really encourage those involved to get out there. If the overall goal is to get Eith Price to go to the moon, I think some consultation from the, you know, the people who are already bought in,

as well as some, you know, consultation with the people who are likely to be the marginal buyers would be very helpful. I think it's not okay for academics to hide behind their computers, run some numbers, and have a theoretical, you know, answer to influence the downstream applications. you know, I'm reminded of the saying by either Charlie Munger or Warren Buffett, which is it's, you know, better to be roughly right than precisely wrong. And I think issuance is not correct. Like there is no such thing as correct, but I feel like it's just roughly right. And to try and be precisely, you know, like, turn the knob and be precisely right could result in it being precisely wrong.

And then so what if we do this upgrade and then realize that there's not enough security or, you know, we don't like the second order, the change that we made, then what, right? Then you have to keep updating and what does that do to the, like, one five, five, nine. Yeah. Like, let's not forget. 1-559 was not supposed to be about ultrasound money. It was a really good idea to make the fee market more stable in Vitalik's idea. Yeah, right, by the way. And it took like two years, like the people who were agitating for this, including me, you know, I helped raise money for like the audits that we ran on on one five, five vinyl. We were all poor back in like 2018, 2019. And, you know, the goal of it was the UX of a fee market that like oscillates wildly is terrible. We need to stabilize it. And then we launched it. And this like bird.

mechanism that was like not the primary thing became like the like primary narrative right it's like again you know if you touch something be prepared for it to touch you back is is basically the thing that I would say and and so you know again I think it's very unlikely that uh that this pauses just given but my my my other hot take is I think like more chaos in Ethereum and and less kind of, you know, this monoculture is probably good because people are talking about Eith. They're talking about Ethereum. They're talking about things. Like, even to your point, Mike, like, okay, you guys care about this. This is dumb. There's like 10 other things we could care about. Let's go. You probably wouldn't have that conversation today if it wasn't for this to be like,

hang on a second. Like, why don't we focus on something that's actually going to be impactful for Ethereum the network, you know. And so I think all of this, is probably a good thing in the end. That's a positive, positive way to look at. I agree. Yeah. Yeah. My hope, I mean, it would be pretty crazy if this ends up getting jammed through.

But I do think it will keep coming back because, I mean, bottom line is there's clearly people to care about this and they're just going to keep pushing it. Yeah. I don't know. All right. Thank you very much, guys. I think we can wrap it up here. appreciate you both joining the show and we will see you guys next week.

Thanks for joining us on this episode of Uneasy Money. Remember what happens on chain never stays on chain. We will be back with Tay. Hopefully nothing too horrible went wrong, although I'm sure something horrible going on in the intervening seven days it always does. But until then, do your own research before I begin. See you guys next week. Nothing you hear on Uneasy Money is financial advice.

We're just three builders talking about what's happening on chain, and we want you to always do your own research before aping in. You can find all our disclosures at UnchainCrypto.com slash uneasy money.