You're The Voice | by Efrat Fenigson - Trezor's CTO on the Cold Card Hack: Randomness, Trust, and What Comes Next - Tomáš Sušánka | Ep. 153

Episode Date: August 7, 2026

Tomáš Sušánka is the CTO of Trezor, where he has worked since 2017. Tomáš joins Efrat for an urgent, unscripted conversation days after the Cold Card hardware wallet hack, in which a flawed random number generator left seed phrases vulnerable and resulted in more than 1,500 bitcoin stolen from affected users. Drawing on questions submitted directly by the Bitcoin community, Tomáš walks through what entropy actually is, how Trezor's own four-source random number generation works, why open-source visibility alone does not guarantee security, and what practical steps everyday self-custody users can take to reduce how much they have to trust any single piece of hardware. → Please like, comment, share & subscribe, to help me beat the suppressing algo's. Thank you!– SPONSORS –→ Get your TREZOR wallet & accessories, with a 5% discount, using my code at checkout (get my discount code from the episode - yep, you’ll have to watch it): https://affil.trezor.io/SHUn→ Download the free report on second citizenships & setting up a plan B in another country with Expat Money: https://expatmoney.com/efrat→ Access liquidity without selling your Bitcoin with Ledn, get 0.25% off your first loan: https://ledn.io/Efrat    → Have you tried mining bitcoin? Stack sats directly to your wallet while saving on taxes with Abundant Mines: https://AbundantMines.com/Efrat - Claim your free month of hosting via this link– AFFILIATES –→ Get 15% off “Born To Be Free” all-natural, tallow-based skincare products on a bitcoin standard, using code EFRAT: https://oshi.link/1nvZYq  → Join me in these upcoming events & use code EFRAT for discounted tickets: https://www.efrat.blog/p/upcoming-events→ Get 10% off on Augmented NAC to detox Spike protein, with the code YCXKQDK2 via this link: https://store.augmentednac.com/?via=efrat (This is not medical advice, please consult your MD)→ Watch “New Totalitarian Order” conference with Prof. Mattias Desmet & Efrat - code EFRAT for 10% off: https://efenigson.gumroad.com/l/desmet_efrat– LINKS –Tomáš on X: https://x.com/tsusanka Tomáš on LinkedIn: https://www.linkedin.com/in/tsusanka/ Efrat’s X: https://twitter.com/efenigsonEfrat’s Channels: https://linktr.ee/efenigsonWatch on all platforms: https://linktr.ee/yourethevoiceSupport Efrat’s work: ⁠https://bit.ly/zap_efrat– CHAPTERS – 00:00 - Introduction: Tomáš Sušánka, Trezor CTO02:39 - What Happened with Cold Card: How Trezor Received the News09:17 - Origins of Cold Card: Forks, Licensing, and the Bitcoin-Only Split13:40 - Open Source vs. Source-Available: How the Bug Went Undetected for Five Years20:20 - Trezor's Response: Security Reviews and R&D Changes Since the Incident22:24 - How Trezor Generates Randomness: The Four Entropy Sources23:29 - Dice Rolling for Seed Generation: Necessary?28:30 - Reducing Trust: Practical Verification Steps 31:09 - Single Device vs. Multisig32:45 - BTC Sessions Clip: Ben and Nathan on Air-Gapped Wallets34:29 - Tomáš's Take: Why Air-Gapping Isn't What People Think39:49 - How Trezor's Design Differs from Cold Card's42:32 - 2026 Secure Element Laser Fault Injection Finding47:46 - Responsible Disclosure: Trezor's Protocol for Reporting Vulnerabilities49:29 - The Biggest Risks Facing Bitcoin Right Now51:01 - Short-Term Damage vs. Long-Term Lessons for the Community55:27 - Trezor Model One's 12th Anniversary and the Evolution of Hardware Wallets57:57 - Closing Thoughts and a Call for Continued Security Research

hello and welcome to another episode of viewer the voice i'm a frat this time online with thomas do i say it right shashanka well done yes hi everyone hi thomas how are you yeah i'm doing good thank you it's been yeah crazy couple of days but other than that i'm feeling good and thanks for having me on the show no you're welcome thank you for joining me in such a short notice um this is our first time chatting even though i've been uh working and spending time with trezor quite a bit in the last two to three years uh just a disclaimer trezor is a sponsor of my podcasts. So I am doing this not because it's under anything in my contract. We don't have to do this. I, in fact, Treasury didn't ask me anything. So everything I've done was under my

complete, you know, opinion and view. And so I reached out to Thomas and to the team and asked whether we can have this conversation because I felt like at a time like this, when everyone's going kind of crazy about self-custody and um there's a lot of damage to a lot of people and people are kind of freaking out although now a few days later i think we're after the the big hit but who knows what's what's around the corner uh even though i felt like trezor being probably the most OG company in the space, would be great to get your first-hand views, opinions, and also answers to questions that a lot of the community have. And therefore, I asked if I can ask the community questions, and they gave me many. So I put them together, including my own. And that's

what we're going to do today, go through people's questions and answer them to the best of our ability and who better than Thomas, if I may do a quick intro. And so Thomas, you're a CTO of Trezor, responsible for overseeing technological strategy and direction since 2017, when you first joined as a cryptography engineer. Is that right? Yeah, I am. Yeah. Passionate about open source security innovations, excelling in technical

problem solving and simplifying complex topics, which is exactly what we need today. So maybe we'll start with what actually happened a few days ago with cold card and, yeah, how did you receive the news? Yeah, so I'm wondering where to start because, yeah, there's a lot. So how did I receive the news? So, yeah, so we, you know, we discussed this in the company. So already on the, was it Thursday night, if I'm not mistaken, right? So already the word started to spread out. and you know at at night it was because it's always unclear you know when these kind of

things happen it always takes a few hours to realize like what is actually happening and then yeah in the morning on friday we realized that this is for real um so you know we we dig through it and of course we try to put a statement as soon as possible that you know treasure is not affected as we didn't didn't have the affected code so yeah yeah it was kind of a calm uh calm a bear market summer i would say uh until that point and of course yeah that's changed so uh yeah that's how i received the news um to the question of what happened so basically you know cold card had this software bug that where they accidentally haven't been using the random number generator that they should have been using so they they have a

special chip those secure elements or even the generic uh chips have those capabilities basically these chips are designed in a way that can generate randomness well if i you know simplify things that means like random enough right like to that it gives you uh random yeah that is just random right so maybe if you imagine rolling a dice if the dice is skewed towards number six and eighty percent of the time you are throwing number six that you know that's not right right and that that's that's not what you should use in a casino or whatever so this is exactly like this was the and basically yeah entropy is uh our fancy cryptographers word for uh basically randomness or maybe even better word is unpredictability you know so the fact that you cannot really predict

what the random numbers are and yeah in general the randomness is fundamental for computers computer science like in general or even games right like it's randomness is everywhere but in the context of cryptography or in the context of security is like you know especially important because some of the security properties then depend on the fact that the entropy and the randomness is random enough yes and so with cold card they weren't generating the sufficient level of entropy, which resulted in their seed phrase in some of the models that were supported by the firmware to not be safe enough. And for a software or a hacker to be able to then discover what the seed is and hack, right? Exactly, exactly. That's right.

Totally simple terms for people who don't know. But I really think that's, that's the gist of it. So like during the initialization of a hardware wallet, or it doesn't have to be hardware wallet actually, it's any self-custody wallet, right? Like you, you usually get those, uh, 24 words or it depends number, but you get those English words, which, uh, you know, is something that goes back to 2014 or something like that when we actually, or our co-founders like brought the standard. So it's something, you know, that we standardized.

and basically when you start the wallet you generate some random numbers and from those random numbers you then derive those english words right and that serves as a backup and even if you don't derive the english words that's like it's not not that important but the usual the important part is that from the randomness that you generated then all the other keys are generated right so if you mess up at the very beginning then it's kind of you know the whole thing is lost because whatever you do, the root of the thing is already broken, right? So if you mess up there at the beginning, unfortunately, there's not much you can do

because exactly as you've said, the attackers can go through all the options and then, yeah, there's not much you can do. So the goal is to have enough randomness, to have a big enough number that is random, if I, again, simplify to make sure that the attackers cannot do it. And usually you have this 128 bits of the entropy. So that's, you know, what usually people are doing

or 256, it doesn't really matter. But it needs to be a number at least in that area because if you do just 40 bits, for example, that's simply not enough. And the attackers can brute force it and, you know, we'll get to the random number that is then serving as the as the backup so this is basically what happened yeah right and so in light of that we started seeing uh wallets that were that had the firmware the vulnerable firmware

installed started to get their coins drained and so far i think we're it's more than like a thousand five hundred bitcoin that was uh stolen i don't remember the exact number but it keeps going up and and hundreds of people were affected by this and cold card which was a company that was very much known in the space it was also known to be like bitcoin only very maxi so you know it had the reputation and many people trusted them and had their wallet so i think it's time to say well done to the community for reacting so fast and spreading the word so that people some people were still able to save their coins and and other many other great people in the community are helping other people as much as possible to do things with you know this is really nice to see

the the involvement of everyone in the community and at that point i also want to say thank you so much for everyone that submitted questions for thomas so that we can do this episode this was also very cool and nice to see how what people want to learn okay so back to the questions can you share about the different splits and forts in the hardware wallet space like throughout the history and why they occurred what caused cold card to exist in the first place okay so um you know the way i remember it so you know it doesn't have to be 100 factually uh correct but the tldr is that basically cold card you know uh wanted to start their own hardware I think one of those main idea was the Bitcoin only thing.

So, you know, we got some hell in the past for supporting other coins than Bitcoin. And I think this was like a strong part of their offering that they were Bitcoin only. And also, yeah, they basically targeted the more hardcore audience. I think, you know, we can say that. So, you know, those air gap features, some advanced features and all that. and so that that's that's you know the one part and like there's of course nothing wrong about that so you know there are many companies on the market so you know some of them are more uh you know have broader support for coins for example and are focused on more uh you know

generic audience and you know then some are you know taking care of more the hardcore part of our community and that's fine and so so that was that was one part and then yeah the other part is you know the the story about the licensing the software which uh yeah is another rabbit hole to go go into but in in short we our firmware is licensed under a permissive license which means that you know anyone can take it distribute it sell it commercialize it in any way that's that's that's just what it is the only condition there is that you need to maintain you need to keep the license right so you cannot really take the code and basically change the license until no one can touch it anymore or no one can sell it anymore right you cannot do that and so cold card you

know uh started as a company that forked out code so which is totally fine by the way there's like nothing wrong about that i want to stress it out so they just forked out code and they started to to working on that and built, you know, their first hardware wallets on that. And so that's how it started. And then, which is a bit ironic, uh, some other companies started, you know, building on their software, right? Like they, they, again, forgot their code and they tried to build a hardware wallet on that, which again, I believe is, is totally fine because that's

what the license is saying, right? Like, so like that's, it's just what it is, but anyway, they, they didn't like that and they kind of decided to to change the license to another one which is you know source available meaning the code is public but it's not something you can build on sell on commercialize and all that and as i've mentioned earlier you like in order to do to do that you you cannot use the code like you it doesn't work with our license right so basically they had to rewrite the whole thing like everything they've been using from us and that's that's yeah actually where the bug was introduced during this rewrite so they can use this different license so that

was around 2021 yes i believe yeah around that yeah okay um interesting that they started off with your forking off your code yeah and like you know i i don't want to be like too sarcastic or because i you know i realize that there's a lot of you know people lost their life savings and all that so i yeah i'm really sorry about that it's just at the same time you know the the code like if you if you had an old device that was running the old firmware before this was introduced you're fine so the the the cold cards that are not affected are the ones that were running you know our code so uh yeah so this is like the whole licensing part is like a very niche and difficult topic uh but i yeah it's just when you're really doing open source and free and open source meaning

anyone can take the code and build on it then then you cannot be angry that someone took it and build on it right that's just that's just what it takes um so yeah it is what it is totally i i want to use the quote from jack mathers that wrote this week he he wrote it quite well so i don't see a point in paraphrasing it he said open source does not guarantee security The advantage of free open source software is not only visibility, it's also the review economy. It can create. People and companies can build on the code, fork it, which is what we're seeing here, compete with it, depend on it, challenge it, and improve it. The cold card bug survived for years even though the code was visible.

It clearly was not challenged enough. Why? So I'm ending the quote. do you agree with that framing why wasn't this caught sooner yeah so this is again many layers that there's many layers in that question so first of all maybe just for the audience to understand again i think there are three ways to to um to approach this so first of all you you can have the closed source approach you know meaning so everything is closed nothing is you know out there and there is some security free obscurity that you know just it's

not available then you have this source code available which is what coldcard had meaning the code is up there anyone can see it but they cannot build on it right and then you have the free and open source which is what our firmware is where you can actually you know take it commercialize and all that that i've said already three times and uh it's exactly what you know jack is partially talking about like the it really depends whether you can actually build on the code or not because if you build your company on that code you know you're incentivized to make sure that the code is working well right so you are incentivized to yourself to actually you know check everything or do audits and checks and all that so um you know i i don't want to say that

source available approach is useless like i don't think it is but the free and free and open is definitely, you know, better because then other companies can build on, on top of it. Right. And there has been maybe also like a small, small comment on this. There, there's been a lot of talk now that, so it's open source useless if, you know, uh, they, no one found it for five years and I, I don't want to, like, I don't want to say, and some find maybe the community is simplifying this. I don't, I don't want to phrase it in a way that open source equals security.

Like it is, it is not that. Like we still, you still need to incentivize the people to look for bugs. You know, there is this, this framing open source is great, but is there enough eyeballs? Why is there enough, you know, researchers to looking into that? So I really think open source is part of the puzzle and it's a very important one. Like, don't get me wrong. It's one of the most important ones, but I do agree. It's not enough, right?

So you still need to take care of, you still need to have a bug bounty program, you know, so to incentivize the researchers, you still should do audits. And like, it is all that, but it's just one important, you know, piece of that. So, because I've read those comments, like, so, okay, open source is now useless, but it's like, you know, if you're in a fatal car crash and you had a seatbelt, so like, are you then going to say that seatbelts are useless? Like, it doesn't make sense, right? It just doesn't, it doesn't work that way.

So open source is an important part of, you know, this whole concept. I do agree it's not enough, but it is the condition that is, you know, obligatory. So then, you know, the researchers and everyone can actually verify the code and it's right that the free and open actually helps that a lot because other companies can build on it. The bug bounty mechanism you mentioned is something that Trezor has. Other companies have that too? I'm just thinking about that.

It's something that is common to have in the industry? It is common to have. As far as I know, Coldcard actually didn't have one. They stated that they are not giving any bounties. We have that basically since the beginning. Other competitors usually have that as well. Big companies have it. Security companies have it. To be frank, it's also quite hard because also with AI, we do get a lot of reports and it's kind of hard to triage them, go through them, and really make sure that the critical ones are not left behind.

But then at the same time, you have to deal with the ones that are maybe false positive. So it is quite some investment to do because you need to take care of this. And also, there were some people on Twitter saying that our bug bounties are not enough, like monetary wise.

So it's kind of hard to set this whole thing up. More their time, more their effort. Yeah. So that's what we're trying to balance, you know, to really take care of the important vulnerabilities or problems. But, you know, at the same time, it also doesn't make sense if it's low severity to pay, I don't know, hundreds of thousands of dollars. Right. So it's a tough job, but it's very important one because, again, like open source is great, but there needs to be people looking at it. Right. Got it. And does it make sense that this was not discovered in the five years that it was sitting there? I mean... To you as, you know, a CTO of a hardware company, a hardware wallet company. I mean, to be honest, it surprised me that it was so long. Like, that's true. Like, five years is quite a lot. on the other hand there are some reports and i i'm not to judge if they are true there are some

reports that there were researchers like one or two that actually you know reported it to them so maybe even someone found but the company just didn't you know follow up enough but i really i i don't know the facts i did i did see those reports as well that you know it happened to some people the exact same uh draining of coins happened after they they bought some of the devices and and there is the supposedly the report were ignored and again like i don't yeah i don't want to judge it by i mean you don't know if that is totally yeah yeah yeah but yeah to answer your question it was a bit surprising but at the same time as i've mentioned the fact that you know no other companies could have built on it that there was no bug bounties you know that it all

just like kind of builds up yeah right now has trezor taken any steps to make sure that its rng is more secure since the incident and if so what are the steps that you've taken so yeah i mean of course you know just when it happened of course we went through the code and you know double checked everything um we you know our cryptographers just on right away on saturday there's a pull request doing another checks you know so it's it's not like that we would not have enough but you know six cameras is better than five i guess so you know we're looking for the we did look through the code and you know investigate this a lot but it's also important to say like we realize this is a vital part of the whole concept from the beginning so you know

already in 2014 when there was this the first treasure model one already at that time we had this feature that we don't rely on the randomness from from the device itself but we actually mix it with the with the computers right so the computer give you randomness the device gives you randomness and mix those two so you know already from the beginning we realize that this is one of the most you know important parts that we need to be very careful about and that's why you know we we had this feature and then in actually i don't know one year ago maybe two years ago i think it was uh early 2025 we introduced this entropy check feature which actually verifies that the host's computer is bundled in basically right so even in the most

catastrophic scenario where we all those you know safeguards would fail and everything would just go wrong we we still have this entropy check that should save you because the randomness from the computer would would at least you would rely on that right so we we looked in the code after the incident and we improved the safeguards as well but at the same time it's something that we are working on the whole time to some degree as well because we realized that this is the the most important part right you and you also put out a post saying how treasure is creating its a random number generation. Uh, you wrote the four, four different elements that it takes, right?

And makes it, is it four? Am I right? Yeah, yeah. So in a safe seven, so in our latest treasure, you actually do have four sources, so is the, the randomness from the generic chip, uh, randomness from the, uh, sec, the, the secure element that is from Infineon, uh, a company that is quite known. By the way, this chip is like the one that also has all those kind of certifications that, you know, the randomness is good enough.

If you're into certifications like this one, you know, give it to you. Then we have the open and auditable Secure Element that, you know, we introduced in Safe7, the Tropic Square, which also gives you randomness. And then the fourth one is the one from the computer or your phone, right? So, yes, it's all those four sources together. Right. and then people obviously are asking you know in light of the roll dicing which has become all of a sudden known for people that have had no idea that that even existed and what's your stance on dice rolling for newbies do you think that that's needed do you

think that we should at least allow this to people to do on their own or what's your stance about it yeah i i honestly think it's just silly like i i so also what is important to say that the four sources of entropy are great but then you actually need to use the entropy right and that was what happened in this incident was not that the randomness would not be good enough on the chip they basically haven't used it if i simplify right so that that's kind of important distinguishment and with the dice rolls is basically the same thing like there's like the the bug could have been there as well and you would roll dices and then the device wouldn't use it right so it's not about that we could not that we that computers don't know how to generate

random numbers this is a problem that's here for almost forever right like that that's what computers do all the time you you also need to generate randomness later on when you're actually creating the signature so it's there like all the time and like to me i like this saying that security at the cost of usability goes against security meaning like if you if you do something that you know is maybe 0.01 percent more secure but the usability is versed and it is not good then you know it impacts the security again and i think it's exactly that like yes maybe for a few people this makes sense but you know if we want to make self-custody come on for the majority or you know for the common common people so to so to speak like like is my grandma gonna roll 100

dices it's like yeah it's just i just think we need to do better as as as a community and as as you know people that are making products what you're saying that it was there it was just not used right that the computers obviously know how to generate randomness i 20 20 what was it 25 years ago i worked at a video games company i was a computer programmer that's how i started my journey a computer science degree and i worked for a few years building video games and there There was always a randomness there. Yeah, right. It's not like computers know how to create.

That's what they're good for. They're better than humans for it. We are less good than computers for computational actions. And it kind of reminded me when everyone started, and I'm not dismissing that. I mean, I think there is a very important lesson to learn about role-dicing, about entropy, about randomness, Like that, those are really important subjects

for people to get themselves familiar with. However, kind of reminded me how people say that we can send Bitcoin, like do a Bitcoin transaction with pen and paper. It's possible, right? It's possible. But obviously computers do it better than us, faster than us.

And as long as we don't get to the edge case in which we have to use this because all the internet and electricity in the world us down, that we don't have to do cryptography by hand, then we should rely on computers. And as long as, again, they are using the code properly. Yeah, 100%. I just want to say, I really agree with that because like, yeah, the most safe, you know, self-custody, probably if you hide yourself in a cave and you just have a pencil

and you draw there on the cave and you do the math in your head. Yeah, sure. It's more secure. Is it, is it more usable? It is not, right. So yeah, yeah, absolutely. All right. Should hardware wallets UI, the user interface, push users towards, oh,

we talked about supplying entropy, dice rolls, playing cards. Okay. So just to, just to make sure I understand Trezor is not planning on introducing that anytime soon. You know, I, it's like, we, we, I think we had this feature request since, I don't know, 2018 maybe or something like that, like for a very long time. And, like, I'm kind of torn on the topic as well. Like, I can imagine it in advanced settings.

Like, you know, so let's put a warning saying, you know, hey, be careful, this is not a good idea, take the rediddy, and then allow them. On the other hand, you know, then there are people that don't read and they're going to click through it and they're going to mess up. So I don't want to say, like, strong no,

maybe under some warnings, but, yeah, we need to discuss this some further. All right, I get it. Let's talk about trust and some practical guidance for the audience. So the average user can't verify everything, at least not without guidance. And today in LLM and AI, what practical steps can they take to reduce how much they need to trust and proceed with confidence? yeah so there is again a lot of a lot of possibilities but you know what we're always saying is that you know buy the devices from like direct from the manufacturers or trusted resellers you know don't don't just buy it randomly on the internet uh also we have you

know this device check meaning that the device proves that it's genuine we know because it's signed cryptographically by us so there is some kind of authenticity check on setup our firmwares are signed so you know they can run only on the device we have reproducible build which is a very complex word but what that means is that you can verify that you know the firmware that is signed and that we are providing matches the code on github so you know you can actually compare these two again you know people can you know give the contra argument but how many people is actually doing that probably not many but i would argue there are a few and there are you know checks for this and also as you've mentioned ai i think that can help as well there because it

can do it for you or it can tremendously help right so yeah these are you know some of the generic parts and then also yeah be careful about you know the backup because after all you know That's again, what is the most sensitive thing to you? So, you know, hide it well, or do some periodic checkups, you know, maybe once a year, once a two years, I don't know, but like, make sure you haven't lost it and all that. Yeah. Absolutely.

Or use a passphrase, right? Or not, or end. Yeah, yeah, yeah. And by the way, this always depends on like, what is like, how the users define their threat model or how to put it, right? Like if you have maybe just a few bucks, maybe you don't need a passphrase, right? But once the price goes up

or you're stacking up more and more sets, it's something that you should consider, right? So it's always hard to give clear advices, use that and don't use that. It always depends how people are tech savvy, if they are able to remember a passphrase and all that. So yeah, it depends is the answer, I suppose. Absolutely.

And is a single Trezor sufficient for self-custody or would you recommend multi-sig potentially across different manufacturers? And is multi-sig realistic for everyone or mainly for address users? Yeah, that's basically exactly what I've said just now. I don't think there is a clear yes and no answer. I really think it depends. So if you're starting up, I think it's totally fine to use just Trezor or other hardware wallet. By the way, it's fine even to start in a software wallet if you have just a few bucks, right? That's fine. But again, once you're stacking up more, it makes sense to get a hardware wallet. And maybe then eventually when you have a lot, and by the way, this is very tricky because what is a lot, right? It depends

on everyone what is a lot for them, right? So I cannot really judge that. So once you feel it's a Well, like Multisig does make sense. Like, yes, it does make sense. It should be across different vendors because honestly doing Multisig with three treasures, three same treasures, like it brings something. Don't get me wrong because, you know, at least are like physically different devices,

but it doesn't protect you against these kinds of failures. Right. So ideally, yes, you use different vendors and there are also services that mix in phone or cloud or whatever. So yeah, it depends on the use case, but there is definitely merit into it. In a recent video, I want to show you a video that BTC Sessions put up a few days ago,

and Nathan is making a request there of Trezor. So I want us to check it out together and let's see what you have to say about it after that. So let me share it. One second. that would be good it's a one minute video air gapped

again coming down and waiting but it still has value to me and the reason being and I would love it if I could get QR codes on the Trezor Trezor

if anybody Trezor is listening for the love of God they are they're listening for sure okay for the love of God people at Trezor let me plug an SD card into it

or get a QR code or something I just want it so that the computer cannot make requests to the device because again in the age of AI

We're thinking about the AI doing something on the hardware device. If it can't touch the hardware device and the firmware is good to begin with, it's not an issue. So I don't want the hardware to be hooked up to the internet where it's potentially... Look, we see these stories of AI escaping containment

all the goddamn time, right? So I'm pretty confident AI can make its way to my computer. So I don't want the device plugged into it. I don't want the computer to be able to tell it anything. So air gap still has value to me. But again, is it as important as I thought it was? It's not nearly as important to put oil in the fucking car, but I still want to make sure, like, it's still of value.

Dude, talk to Zach. I just love this. Talk to Trezor. Give me that multibender, multisig as one pack, and I'll love you forever. That's huge. You can do that. People saved big money for that today.

This is what needed to happen for this level of collaboration to happen. All righty. So here's Trezor listening to you guys, Nathan. Yeah. So I feel like I'm going to get a lot of help for this. So my honest opinion on AirGap, there is nothing inherently secure about the fact

that you're transferring data over QR codes or SD cards, right? Like you still need to exchange the data somehow. And I think we kind of got locked into this narrative of, you know, scanning QR codes are more secure than Bluetooth or cable. And I would actually argue against that to some degree because with QR codes, you still need a camera, right? Like camera means another thing on the device.

It means another code. Is the code open? Is it auditable? Da-di-da-di-da, all that. Like it needs, you know, it adds some attack vendor, right? The same with the SD card, right? Like you need to, another more code, more components and all that.

And- Yeah, and I feel that's, you know, the big part of the answer, that it brings some, but it also takes some, right? And my feeling on this whole thing is that it increases, it does increase the security maybe by 0.01%, or I don't know what the number is, but it does, you know, tiny a little bit, but it takes on the usability a lot, right?

Because it's just cumbersome. So, um, I'm just not sure, or I don't, I don't think the trade-off is there. That's basically it. And I also always find it funny, like air gap, like what does it actually mean? Because like the fact that it goes over air means that it's safer. So it's, it's suddenly is wifi super secure then because it goes through the air as well. Right.

So I don't know, I find it also a little bit, um, it's just not simple, black and white, that's what I'm trying to say. So I honestly don't think that it belongs into Trezor because I think that a lot of our users, you know, would use it wrong or they would do something to harm themselves. I actually, you know, can imagine it in a device that is dedicated just for that, like for the super hardcore audience, like that's totally fine. If you know what you're doing, then maybe the 0.01% is worth it for you. But exactly as this incident show, I think we have other places to look and make sure that they are, you know, that they are correct than this. So, yeah, I'm not a big fan of AirGap, to be honest. Thank you for this answer.

It makes me also think that when Trezor came out with the Trezor C7 that has Bluetooth for the first time, people had criticism over that because Bluetooth adds another layer of risk from, you know, that was the criticism. And then I'm looking at, for example, BitChat or other mesh networking applications that are coming out now and very popular. They're using Bluetooth. They're using other types of wireless networks to implement the use case. Why is there such a bad name for Bluetooth and is it really risky? I mean, I'm deviating here a little bit, but, you know, it's related in a way. No, it's a good question, actually. So I think in the past, there was a lot of exploits in Bluetooth.

So like, you know, in the past, I don't know, a few years ago, it's true that Bluetooth kind of got a bad reputation for their security. So yeah, it's true. It did improve a lot. So the latest versions, I think, are way better. But by the way, and that's a good thing to mention, we still decided not to trust it and we still have built another protocol

inside the Bluetooth protocol, right? So we have this Trezor host protocol, which is based on the noise protocol. What we basically did is that we made a tunnel inside the tunnel to really make sure that it's sound. So it doesn't really matter that much which way you communicate, whether it's Bluetooth or if it's through the cable,

it's still end-to-end encrypted to the device itself right so exactly we want it to be really safe on this side so that's why we uh you know introduce introduce this and yeah i i think a lot of people are scared by the fact that it's bluetooth that it's you know um remote or how to put it like that that it's you know uh you can do something distantly but then exactly what that's why we have the cable cable product as well right like if that's an issue for you and i by the way think this will always stay in our lineup right like now everything goes away and more mobile and on the go and all that but i think we should always offer a cable cable device right so yeah then the only thing that we're missing is some kind of device that is meant for this hardcore

audience and i'm not sure that if it's like our well whether is what we want to do and whether what's where we're strong, but never say never. So, yeah. Awesome. Thank you for that. OK, so you added the secure element chips in the safe series. How does this differ architecturally from cold cards? Dual S.E. secure element design, which also failed. And what threat model does the secure element actually address?

Yeah, so I mean, the secure element itself didn't fail in cold card. You know, it's just the fact that they didn't use what it provides. Right. So there is this difference. Other than that, like the architecture, it's a similar thing. We are using secure elements to protect against the, actually we use it for free things. So we use secure elements to protect against physical security, meaning, you know, if someone steals your treasure that they are not able to hack into it.

authentication or device check, meaning that when you start the device during onboarding, that you know that the device is genuine. So, you know, it holds some certificates proving that the device is genuine. And then the entropy slash randomness that we mentioned a few times today.

So that's the, you know, that's the threat model that, or that's how we use the secure elements. And then we're trying to diversify the risks by using more vendors, right? So, as mentioned, Safe7 has two secure elements and one generic chip, and we kind of, you know, mix all together. Yeah. I think not many people know that the Tropical, the Tropic Square secure element is also open source for the first time, right?

Yeah, yeah. Some, like, to be 100% honest, like, not the whole, it's not the whole thing. it's just like they are kind of like if i simplify you have the analog and the digital stuff so a lot of the digital stuff is open and available on github there are some parts that unfortunately are not yet open because simply it is not in financial abilities for you know mid-sized company to actually build this so these there are steps right like so they started to have one big chunk open and then in the next version is really bigger and bigger until you know they reach their code, but it is important to say that, you know, not everything is open, but it's

still way, way, way more open than whatever is on the market. And also, you know, they are releasing the audits and all that, and there's normally a lot of secrecy. You need to sign DAs and all that. They're not doing that. Everything is public. You can get one tomorrow. So yeah, that's the difference.

Got it. I think there was a question here about a problem that happened last year or this There was a 2026 laser fault injection finding on the Tropico 1 chip in the safe 7 that still left funds protected by layered security. Can you address this finding? Sure, sure. Yeah, sure. So, yeah, it's basically what it said.

So there was this laser injection finding, meaning that if you have, you know, costly or costly if you have a dedicated equipment uh like to to be able to do this attack so i don't know 20k usd or it depends right like something in that range so if you have this kind of equipment if you have the expertise so you know you're you you you have uh the knowledge to do it then you're you were able to laser it yeah like send lasers into the and you also need to you know take the chip off the board you need to tear treasure apart take the chip out uh disorder it like do some you know uh decapsulation or whatever is the word yeah some lasers and all that and even after you all do all of that like you still have the security of the other secure element and of the

generic chip right so no funds at risk it's it's nowhere like it's yeah just no no not it does it it doesn't really you know change much like you cannot really and what i also want to say like i think lately we as an industry like discuss the physical security a lot uh like in the past years like yeah we have two secure elements and the more the merrier and physical security lasers and all that but i i also feel like it's time now to stop and like look into other things exactly you know again like this incident because the physical security i don't want to downplay it it matters a lot but like again like if you're if you have neighbors that are working as a security experts and you invite them in your home then maybe this is an issue but i don't i'm just trying

to say that you know physical security is just one part of the whole story and we should look also in the code and elsewhere in the remote attacks and all that right because again the physical security it takes time it takes expertise it takes money to get into that and so i kind of feel we as an industry are maybe even overdoing it but still important part i just think that we need to focus also elsewhere to your question yeah it was just there's exactly the layered security where we have layers we have the generic chip one secular and second secure amount it didn't really affect your funds so yeah and sorry last point yeah i also wanted to mention the part

on the transparency because that's the whole point of the chip that the idea is, you know, to publish these findings, right? So whenever they find or some research lab

finds something, we're going to, they're going to share it, right? So this is kind of the hard part because it is difficult topic. So it's kind of hard to explain it to users and customers.

So, you know, we're sharing what we find like all the time because the trust is everything that we have. But, you know, it's also kind of tough to explain that, you know, it actually doesn't really mean anything or it means very little to the protection of your funds.

Yeah, right. Right. I get it. No, that is super critical. And I think that you guys have been very transparent since I have gotten to know you, which is a few years in your communication to users and to the community.

Um, and you know, I think your point, your comment about physical security and how much attention there is on it, uh, right now, it's just natural when, you know, emergencies or disasters like that happen, there's a, there's a spotlight on the vulnerability. Um, but I, I'm totally with you that to me, you know, a lot of people call me conspiracy theorist about that and i posted about it that just things didn't add up when this whole thing started i was like no no no it doesn't make sense i mean i'm a lot less um nice and balanced than you are i think that there is a bigger attack here because this is happening in a very strange timing with bit.10 and we're seeing a lot more security uh vulnerability attacks ai attacks on

you know on vaults on zoos on many different players in the industry and you have that red team sitting around the clock and finding more and more vulnerability now using ai like so something here just feels bigger but yeah so it just makes sense that the attention will go to what happened there just there and then we'll digest on it but i i also invite people like you to look at other layers of vulnerability and other layers of security issues. This is not the only thing. But let's just take another question in that trajectory. When security vulnerabilities are discovered,

what are Trezor's protocols regarding responsible disclosure and keeping users informed? Yes, so this is the, yeah, responsible disclosure is somewhat a term in the security industry. Basically, what this means is that when we get our security report, we you know first fix it uh we don't fix it in public just yet uh we fix it we release the firmware we write a blog post or anything we urge everyone to update and at that time we make the

code public right so it's basically someone find it reports it we fix it and then we make it public along with the communication to to actually uh that people are forced to to upgrade so this is very common in the industry. That's something that, you know, big companies are doing as well and something that we had since the beginning as well. But Thomas, in this instance with cold card, they, they did say that they're fixing the hardware, the firmware and released it, but it wasn't advised to use it and people were advised to just move their coins, right?

Because it was too much of a, why is that too much of a fuck up? I mean, I think at the beginning they even said that they can migrate it to the new firmware. Like they could, but I think the problem is that you need another device, right? Like you need to generate the wallet on the same device with the new firmware and then send the coins there. So it's probably easier to just move your funds to a different, you know, when there's a trust issue.

Yeah. I know. Of course. Yeah. That's yeah. Huge one as well. when we take this to the bigger picture so what do you see as the most risky challenges facing bitcoin today i mean where should i start yeah yeah it's yeah exactly like i mean the self-custody

part was always a big thing uh you know everything centralized into the exchanges and all that that's probably what i would answer a few years ago now i also think it's getting worse or you It's changing by all those, you know, institutions entering the space, ETFs, you know, and all that. And I don't want it to sound that ETFs are completely wrong, like that it can have some value to some people, right? Like when I joined Trezor, I kind of really believed that, you know, everyone will have a Trezor and everyone will be in self-custody. I'm kind of, as I grew older, I kind of realized that's probably not the thing. It's just, you know, not for everyone. And that's fine.

But the problem I'm having here is that people don't know what the risks are or what it means, right? Like they're buying Bitcoin ETF in their bank and they don't know that it's just paper Bitcoin, right? Or how to put it. So I think an institutionalization is a big thing. And I'm kind of worried about that because it takes something away from what, you know, this point of a Bitcoin.

So yeah, probably that. Yeah. I'm with you. So what do you think is the impact of what happened on Bitcoin, on the community and the broad adoption of it? it's something that i'm asking myself and i'm honestly like really curious because um like i think short term there is definitely some damage to to hardware wallets or maybe even open stores like you know there are people saying now screw this i'm going to exchange or whatever or etfs long term i kind of think it could be positive there is a sort of like a wake-up call you know that that there are now a lot of people you know running ai reviews and

actually you know digging into it so um i think long term it could be you know also positive that you know the industry kind of realized where to focus on but honestly it's it's i don't know and i will really it's a question i'm asking myself because like i have such a bittersweet feelings you know on on the whole on this whole thing because on one side so first of all you know lot of people lost a lot of money and some of the stories are simple heartbreaking so that's this part and whether those people would buy another whole hardware world after that i'm not really sure right because they're just like done with this so yeah i'm i don't know and i'm really curious how this will evolve yeah yeah i'm with you uh it's devastating and i'm sure many people

were shaken up by it but those who really understand that you know we fucked up by taking don't trust verify for granted uh in many cases means and and if we do stand in the source of everything that happens to us in our lives we are responsible you know we take responsibility which is a trait or property that bitcoiners have then we will learn from this and we will improve our education and our tactics and we will get better and we'll get stronger i mean that's what i would love to to see happen and i think there is that vibe too in the community and i really hope that we're not we did take a hit in terms of you know self-custody took a hit the community took a hit but can we can we withstand that we know that bitcoin is very

strong we know the community is very strong and bitcoin without self-custody is not really bitcoin i mean the promise of bitcoin is to separate money and state to to have no intermediary between you and your money right to remove the intermediary if we go back to custodians just custodians we're back to the same old system we are in today in fiat and that's what bitcoin comes to to give us so you know that freedom is something we have to remember um and chin up and cheer up and we can we can get better i mean that's my opinion yeah i i wouldn't say better like i agree 100 yeah exactly yes right the i will just do a little ps uh in the long list of questions we had, which was about what, 14, 15, someone asked when Miniscript?

And don't let him off the hook, push for an actual commitment or release window. It's like, no pressure. Yeah. No, I'll be frank here. So, and I'll try to provide the date. So like, this is one of those things that I, we are behind and like, we didn't prioritize enough. And so the good news is that 80% is done.

What is left is the other 80% because the final push always takes a lot of time. And yeah, like to give an honest answer, we didn't have it prioritized for the short roadmap. It was, you know, the idea was to release it Q1 next year, which is not very early, I agree. So Q1 next year, but, you know, given what happened, And it is something we will look into and if possible, we'll try to do it sooner.

Right. And what a coincidence that we're having this conversation and also the whole shit show with cold card happened around the time of the birthday of Trezor's model one, right? More or less the same time. Yes. How many years now? Is it 12?

No, and I'm scared if I remember it correctly, but I believe it's 2014, so yeah, it should be 12 years. Yeah, it's quite some time. Yeah, so the hardware wallet started a long time ago and went through many, many iterations during that time. Yeah, I think, yeah, I was very impressed with that side of the ecosystem when I got into Bitcoin in 2021 or 2 to see how developed that is like real security for this this is really impressive um and i think as an as an ecosystem in bitcoin it's so young and so small and we still we're still so early there's so much more to go when we're looking at other verticals of tech industry in the market um but that vertical of hardware wallets is is quite well um developing and has been developing

in the last uh 12 13 years so you know only upwards and onwards like really yeah i don't see room for despair yeah yeah i totally agree and at the same time i want to say that also like the concept of the hardware wallet like hasn't really changed from the 12 years ago or whatever it was right like it still has display it still has buttons or touch screen to confirm you still have to confirm it on the display you know it's a dedicated device that does only that and nothing else like you know the the original idea still you know stay the same and we're just now more we're just bigger companies so we can make it in a nice aluminum body and you know have a better display and all that but not that much has changed from the very beginning right so we're just trying

to stick to the mission. And I think that's, yeah, the right thing to do. Just improve the usability as well along the way. And the original principles that it stands on are still the very same. There's nothing better than the feeling of signing a transaction on your hardware wallet and then seeing it get to the other side

with no permission and no approval from anyone else. I just love it. I love it. Yeah, it's a nice feeling, right? Yeah, it is. It's awesome. especially with the safe seven it's uh i love it any any last thoughts any messages you want to convey out there i mean yeah with yeah i'm not really like just try to

stay strong you know in these for some people very difficult times um i would also like anyone you know with some technical knowledge again like more than happy to uh to see any reports on our code again we have the bug bounty program i'm glad that you know now really a lot of people are looking into the critical infrastructure in general of the bitcoin community so i'm kind of excited about that and yeah stay safe out there yep stay safe in the jungle thank you so much for this thomas i really appreciate you or your time where should people follow you uh to get more information so i'm on x uh t susanka uh i'm i'm not that active uh but because uh x is not my favorite uh platform uh i'm not sure if you're allowed to say that uh in the bitcoin you are

we don't like centralized platforms very much But anyway, yeah, but I just wanted to say that also I see that there is this hunger or need for also some technical content. So I think that's something we could improve on our side as well. Not just on Akes, it can be anywhere, but I feel we should write more blog posts or articles, you know, on this kind of entropy. What is it? What is doing?

How are we doing? I think that would help the community. So that's something, yeah, I would like to improve on our side. That would be wonderful. and today with all the ai tools you know you fit it into notebook llm or something like that you get a video as well out of your blog it's so so easier so much easier to create content and fantastic uh you're also on linkedin i'll put the links in the show notes for that i'll also put a link to um the the companies who support this podcast including trezor thank

you for your support uh i do not take it for granted i do want people to do their own homework even if it's you know products that i recommend it i am not the expert on everything and i think that that's something we saw now uh with with cold card that so many people recommended their products my heart goes out to them too because you know they feel so bad about recommending something that didn't work but that's life and we have to be careful we have to take responsibility and do our our checks properly so yeah thank you so much for everyone who submitted questions i hope your question got answered and if not feel free to let me know i will still be in touch with thomas and i can send him more questions later we can post that sure so that's it thank you so much stay

safe out there thanks thomas thank you for having me have a nice day thanks for being with us please take a minute to give this episode a like comment and subscribe and hit the notification bell to be notified when I release my next episode all this really helps me beat the suppression of the algorithms take a moment to check my sponsors and affiliation offers in the show notes that's how you support me and the show ensuring I can carry on with my mission lastly please share this with your friends so they can also get value and choose to take some positive action. Till next time.