Wasabi Wallet - Total Privacy For Bitcoin

[ABCbits]

Tracking issue for removing COLDCARD support from Wasabi: https://github.com/WalletWasabi/WalletWasabi/issues/14893

Any community feedback on this topic?

Just set coldcard support into maintenance mode, without new feature, format or support to other hardware wallet types. If nobody wants to maintain it, set it to deprecate at least for few months.

Apple has still not removed the fake Wasabi Wallet from their app store and now a Coldcard user trying to rescue their funds lost 6 BTC because of it.

I guess some people still have false perception App Store is strict enough to prevent most/all fake apps. Anyway, i just checked the fake app page and the problem is deeper. The scammer impersonate zkSNACKs company (that supposed to be already closed itself) and also have create fake X account.

[PrivacyG]

I can not understand how someone would think it is a good idea to move compromised Bitcoin from a hardware wallet to a mobile wallet first of all.  And use the mobile keyboard to insert the Seed.  And download the software with out checking its legitimacy first.

You would think this is an obvious 'DO NOT DO THIS' for someone who kept over 5 Bitcoin in a Coldcard.

[NotATether]

Apparently some of the stolen coins landed in Kruw's coordinator, and ZackXBT is certainly really angry about it:  https://x.com/i/status/2084949932289765633

Now I respect ZackXBT (234 thousand of you read my post on X saying that I like nvk as a person, so you know my respect is for everyone), but I always found his stance on Bitcoin privacy strange. I guess eXch was right about him when they made this post, even though I still think to this day they are passive aggressive.

Now if only we could have people who made more noise when people's coins are stolen, whether by exchanges, casinos, hackers, or scammers, but it seems that most people only care about the last two, and only when the number of victims is in the hundreds and they post about it on X.

People are going to use the Coldcard hack to try to destroy Bitcoin privacy worldwide, which would be a really tragic goal if it's accomplished, because the whole point of Coldcard was to increase your wallet privacy.

(For my part, I have also made a post in support of Kruw)

[Kruw]

Apparently some of the stolen coins landed in Kruw's coordinator, and ZackXBT is certainly really angry about it:  https://x.com/i/status/2084949932289765633

Now I respect ZackXBT (234 thousand of you read my post on X saying that I like nvk as a person, so you know my respect is for everyone), but I always found his stance on Bitcoin privacy strange. I guess eXch was right about him when they made this post, even though I still think to this day they are passive aggressive.

Now if only we could have people who made more noise when people's coins are stolen, whether by exchanges, casinos, hackers, or scammers, but it seems that most people only care about the last two, and only when the number of victims is in the hundreds and they post about it on X.

People are going to use the Coldcard hack to try to destroy Bitcoin privacy worldwide, which would be a really tragic goal if it's accomplished, because the whole point of Coldcard was to increase your wallet privacy.

(For my part, I have also made a post in support of Kruw)

*sigh*

https://x.com/Kruwed/status/1938294001074868554

https://x.com/zachxbt/status/2084045834099057018

[NotATether]

*sigh*

https://x.com/Kruwed/status/1938294001074868554

https://x.com/zachxbt/status/2084045834099057018

If I recall correctly, you don't even charge a coordinator fee since forever (besides toxic dust up per participant for the whole coinjoin session). So you don't even profit from this

 

[FinneysTrueVision]

Apparently some of the stolen coins landed in Kruw's coordinator, and ZackXBT is certainly really angry about it:  https://x.com/i/status/2084949932289765633

Now I respect ZackXBT (234 thousand of you read my post on X saying that I like nvk as a person, so you know my respect is for everyone), but I always found his stance on Bitcoin privacy strange. I guess eXch was right about him when they made this post, even though I still think to this day they are passive aggressive.

Now if only we could have people who made more noise when people's coins are stolen, whether by exchanges, casinos, hackers, or scammers, but it seems that most people only care about the last two, and only when the number of victims is in the hundreds and they post about it on X.

People are going to use the Coldcard hack to try to destroy Bitcoin privacy worldwide, which would be a really tragic goal if it's accomplished, because the whole point of Coldcard was to increase your wallet privacy.

(For my part, I have also made a post in support of Kruw)

Coordinators don’t ever have control of the BTC that is coinjoined. Preventing somebody from using a coordinator does absolutely nothing for victims. It is not like Tether where they can freeze stolen funds and make victims whole by minting new coins at will. ZachXBT might be well intentioned when he criticizes Wasabi coordinators and THORchain, but I still think it is misguided. Zach has even recognized that Wasabi is used for legitimate privacy reasons, so he is being kind of disingenuous by now only talking about it in negative terms.

https://x.com/zachxbt/status/2084045834099057018

He seems bitter about not being able to use this for his own enrichment. That money from Binance and BNB Chain really changed him.

[PrivacyG]

Having Privacy levels of Monero or a post Coin Join UTXO may hurt a few people.  Like the Coldcard victims.  But having no access to Privacy hurts everyone.  It is what it is.  Even with out Kruw and his coordinator, there are so many ways the attacker could have broke the chain.  ZackXBT probably only had a bad day.

[Kruw]

Lots of new config upgrades for coinjoin coordinators are on the way. If you haven't tried running one before, it's a good time to start learning.

[Kruw]

Wasabi Wallet plans, by lontivero: https://stacker.news/items/1546607

[Forsyth Jones]

Wasabi Wallet plans, by lontivero: https://stacker.news/items/1546607

Hey kruw, I found it on X: https://x.com/noosphere888x2/status/2088315997090427198



github link issue: https://github.com/WalletWasabi/WalletWasabi/issues/14410

The guy describes the flaw as high-level and says it would allow arbitrary commands to be executed on Linux and macOS by clicking on a supposed readmore dialog box. Has this been discussed before?

Note: it seems it has already been fixed, but it is alleged that it remained exposed for some time.

We are facing a problem that could become serious in the future, vulnerabilities taking much longer than necessary to be discovered during the growth of LLMs (see the Coldcard case for instance). It seems to be turning into a race against time against the devs, where malicious actors are digging through the code of relevant projects looking for flaws before ethical hackers can do so.

[lontivero]

Has this been discussed before?

Discussed? with whom? Bugs are not discussed; they are fixed asap.

Unfortunately that bug was reported in the open and then Kruw could have read it, Vulnerabilities reported in private (the majority) are not communicated to potential attackers.

Note: it seems it has already been fixed, but it is alleged that it remained exposed for some time.

Yes, it was exposed during the time that it was unknown.

We are facing a problem that could become serious in the future, vulnerabilities taking much longer than necessary to be discovered during the growth of LLMs (see the Coldcard case for instance). It seems to be turning into a race against time against the devs, where malicious actors are digging through the code of relevant projects looking for flaws before ethical hackers can do so.

Absolutely yes, that's true. In just one week Coldcard, BTCPayServer, Boltz, LNp2pBot where attacked successfully while Trezor users data was leaked, yes. We known since ever that all software has bugs, all, there isn't one single exception in all the history of computer science. The Red Team claims to have reported thousand of vulnerabilities in just one week so, yes. It was always a race, the only difference is that before we were riding horses and now we drive F1 cars.

[Kruw]

Hey kruw, I found it on X: https://x.com/noosphere888x2/status/2088315997090427198

This is the same guy who posted the fake news that he deanonymized a 64 BTC coinjoin whale: https://x.com/Kruwed/status/2085894398760411508

The Red Team claims to have reported thousand of vulnerabilities in just one week so, yes. It was always a race, the only difference is that before we were riding horses and now we drive F1 cars.

But LaurentMT is just a scammer who phishes Wasabi users: https://x.com/Kruwed/status/2084755002015305951

Since he couldn't find any existing bugs in the open source code, he submitted a fake news article claiming there was a backdoor (that he didn't find and didn't fix) added by a deleted Github account. Audit passed

[Kruw]

See here if your wallet is stuck loading at block height 963,722: https://github.com/orgs/WalletWasabi/discussions/14939#discussioncomment-18093694

[Kruw]

See here if your wallet is stuck loading at block height 963,722: https://github.com/orgs/WalletWasabi/discussions/14939#discussioncomment-18093694

There was another duplicate block at height 963,853. A new version will be released soon to fix the bug.

[satscraper]

Release for Wasabi wallet was elevated to 2.8.2.

It fixes sync bugs that happened after blockchain reorgs. It also adds  coinjoin security check that verifies other participants' inputs before signing, so a bad coordinator or peer can't easily trick you into  manipulated transaction.

[Forsyth Jones]

I can't load my wallet, it stuck on this infinite loading screen, it's been like this for hours.

The filter part simply doesn't load.

Detail: Compact Block Filters are enabled in my Bitcoin Core bitcoin.conf (blockfilterindex=1, peerbloomfilters=1). Wasabi is connected to my bitcoin core full node.



It's not possible that I'm the only guy going through this.  

Release for Wasabi wallet was elevated to 2.8.2.

I'm using this version, the most updated one.

[nc50lc]

Detail: Compact Block Filters are enabled in my Bitcoin Core bitcoin.conf (blockfilterindex=1, peerbloomfilters=1). Wasabi is connected to my bitcoin core full node.

How about peerblockfilters=1?
That's what it needs to serve compact block filters to its peers.

While you're at it, check your latest debug.log entries for active "command line" args and "config file" args to see if those are actually applied.

[lontivero]

I can't load my wallet, it stuck on this infinite loading screen, it's been like this for hours.

The filter part simply doesn't load.

Detail: Compact Block Filters are enabled in my Bitcoin Core bitcoin.conf (blockfilterindex=1, peerbloomfilters=1). Wasabi is connected to my bitcoin core full node.



It's not possible that I'm the only guy going through this.  

Release for Wasabi wallet was elevated to 2.8.2.

I'm using this version, the most updated one.

Wasabi is not connected to you bitcoin node because when it is connected to you node it doesn't download filter headers and then filters but filter headers AND filters at the exact same time because the rpc doesn't serve them separately. Go to Settings -> Bitcoin and verify the connection is correct.

[Forsyth Jones]

Wasabi is not connected to you bitcoin node because when it is connected to you node it doesn't download filter headers and then filters but filter headers AND filters at the exact same time because the rpc doesn't serve them separately. Go to Settings -> Bitcoin and verify the connection is correct.

Yeah, I recall that the "Bitcoin RPC Credential String: (rpcuser:rpcpassword)" setting was correctly configured according to my .cookie file on Core, it even displayed a positive message indicating a successful connection.

Now, when I opened Wasabi Wallet again today, it launched without any problems or delays and no changes to the settings on my end. This could be an inconsistent issue that could happen at any time.