SUPPORTED BY

Hi Reader,

Happy Friday! The S&P 500 hit a new all-time high this week amid a strong earnings season and rebound in tech. What might shock you is that the FTSE 100 has almost kept pace over the last five years. Both have delivered total annualised returns of around 13% since August 2021, with dividends reinvested. Though start date matters enormously. Extend the window to ten years and it's a lot less flattering for the UK market.

In-depth: How did hackers drain $130 million from the world's most paranoid crypto investors?
Newsbites: America is losing jobs, the S&P 500's stellar quarter, and the price of the Truth.
PensionCraft News: The everlasting money pot. Who looks after your money when you can't? And my explainer on the recently launched Avantis funds.

IN-DEPTH

Cold Comfort: Not Your Vault

Some people say I only write about crypto when an exchange blows up or a fraudster makes off with people’s money. Not true! Today I’ve decided to cover it because of a whole new kind of scare story.

You see, whenever an exchange explodes and takes its customers' deposits with it, the survivors solemnly repeat the industry's oldest mantra: not your keys, not your coins. Do the responsible thing and self-custody, we are told.

It’s not without risks. If you opt for “cold storage” you might lose your seed phrase in a house fire or accidentally throw your hard-drive in a landfill. Which would be pretty bad. But at least nobody stole your crypto. It went up in a puff of smoke all of your own making.

Which brings us to the Coldcard. For those who have never held one, it is a small device that looks like a calculator (albeit designed by someone who distrusts calculators). Its entire selling point is paranoia as a service. It generates a private bitcoin seed phrase — the twelve magic words that control your money — inside a sealed chip, offline and out of the reach of hackers, who tend to require the internet.

All this has made the last week a bit awkward, as Coldcard wallets were drained en masse. No one stole the devices. No one entered their details into a dodgy website. No one got hit over the head with a spanner until they spilled the seed phrase. Someone simply worked out that the magic words weren't real magic.

Random acts of negligence

Think of a number between one and ten. Now, I don’t want to be all David Blaine, but you’re probably thinking of seven. (Or because you’re a smart bunch who know 33% of people pick seven, you thought of six or eight. Well done, I hope you’re proud of yourself.)

Computers are almost as bad at picking random numbers as we are. Which is why serious hardware contains a dedicated random number generator — a lump of silicon that captures chaos from the universe, which thankfully has no shortage of actual chaos.

The Coldcard has one of these. But in March 2021, a firmware change introduced a bug that bypassed it. Since then, the devices generated seed phrases using a software random number generator, seeded from the chip's serial number and clock, rather than the hardware one. Which is to say they chose number seven. Sort of.

They still generated complicated numbers with 40 bits of entropy, but a long way short of the intended 128 bits. A number that couldn’t be cracked before the heat death of the universe could now be tackled over a long weekend with a decent graphics card.

Attackers could generate every possible seed a compromised Coldcard might produce, derive the addresses, and check them against the public blockchain.

Keys to the kingdom

On 30 July, 1,196 addresses were swept in 41 minutes, netting 1,082 bitcoin — around $70 million. The attack is ongoing, with analysts estimating losses nearing $130 million, as a dozen separate attackers pile in.

And these were the investors who were careful with their crypto. People have had life-changing sums stolen, with one losing $1.6 million:

"Perhaps the hardest part about this is that I did everything right. I never shared my seed phrase with anybody. My devices never touched the internet. Everything was kept in multiple safes and safety deposit boxes." — Jonathan Goodman on X

The lesson is that self-custody doesn't eliminate counterparty risk. It just means your counterparty is no longer Coinbase, it’s a small Canadian hardware firm and their codebase.

Some users were paranoid about their paranoia box and added their own dice-roll entropy or a passphrase. They have escaped, for now.

As usual, financial analysts went looking for the silver lining in someone else's mushroom cloud, suggesting nervous crypto holders will surely prefer regulated bitcoin ETFs, where it’s someone else’s job to worry about the entropy.

Coinkite, the maker of Coldcard, has urged users to immediately update their firmware, generate fresh seeds and carefully move their funds.

There is, as you might expect, a conspiracy theory doing the rounds. In October 2021, the official Coldcard account tweeted about its dice-roll feature, boasting that it made a "retirement attack" impossible — whereby the makers of a wallet deliberately plant a bug in the random number generator and come back for the coins later.

The vulnerable firmware had shipped six months earlier. Don’t expect the conspiracy theory to die anytime soon.

Use it or lose it

For more than five years the critical vulnerability sat in public view, in open-source firmware, on a device owned overwhelmingly by the kind of person who enjoys reading firmware. Nobody found it. Then several people found it more or less at once.

Back in April, I wrote that the latest AI models were getting alarmingly good at exploiting code.

“I wouldn’t be surprised to see a rush of major hacking attempts in the coming months. If you’re a state or non-state actor that’s been sitting on some zero-day software exploits, it may be time to use them or lose them.”

Nobody has proven AI found the Coldcard flaw. But the Coinkite CEO suspects one did, and researchers have since shown that current models can rediscover it in minutes.

“To every other developer: we believe this is a sober reality of the new AI paradigm. AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike.” — Rodolfo Novak, Coinkite CEO

If you don't own any bitcoin, you might be feeling smug. Not real money, is it. Just numbers on a computer. But your pension, ISA and current account are also numbers on a computer. Sure, they’re better regulated numbers, on better audited computers, and backed by official compensation schemes (albeit with some significant small-print). But numbers all the same.

Jerome Powell used to say he worried more about a cyberattack on a major bank or institution than about a financial crisis. It seemed alarmist, but maybe he was just early, not wrong. There is a backlog of dormant bugs sitting in critical code — in banks, exchanges, custodians, pension administrators — that were mostly safe for as long as finding them was expensive. The backlog will now start to get worked through, by both sides.

The search for treasure hidden amongst the digital landfill has begun.

I opened my Stocks & Shares ISA with Lightyear because I've always believed that in long-term investing, the one thing you can actually control is costs. And Lightyear is currently one of the lowest-cost brokers in the UK.

Their Stocks and Shares ISA and General Investment Account are commission-free, and the FX fee has been reduced to 0.1% (fund manager fees apply).

They offer a growing range of fractional, GBP-denominated ETFs and thousands of US and European stocks. You can check the full range here: lightyear.com/pensioncraft-funds

If you'd like to try Lightyear, use the code PENSIONCRAFT to receive between £10 and £100 in a fractional share or ETF. See full T&Cs at lightyear.com/pensioncraft. Investing involves risk. ISA rules and promotional terms apply.

NEWSBITEs

The US economy unexpectedly shed jobs in July, adding to the Fed’s rate-setting dilemma. Nonfarm payrolls fell by 23,000 last month, missing expectations for an 80,000 increase.

US companies are on track to deliver their best quarter since the pandemic rebound. As of the end of July (with 61% of S&P 500 companies reporting), second-quarter profits are up 47% year-on-year, driven by huge beats from Alphabet and Amazon. The tech giants benefited from massive mark-to-market gains on their stakes in companies such as Anthropic and SpaceX. Exclude Alphabet and Amazon and the index’s earnings growth would fall to 28.8%... so, still gangbusters.

Alphabet shares fell 5% after it reshuffled its AI leadership team. Sir Demis Hassabis stepped down as DeepMind chief executive to become chair and Alphabet's chief scientist. Meanwhile, Jeff Dean left after 27 years, along with three senior researchers, to found Discovery Loop, which Google is backing. Even the resignations are vertically integrated.

Prediction markets became Robinhood's second-biggest business. So-called “event contracts” earned $156m in the second quarter, up more than tenfold in a year, to overtake crypto ($100m) and equities ($129m). Only options trading brought in more. Crypto was the future once… now the future is the future.

Trump Media began selling early access to the President's social media posts. "Truth API" alerts trading firms to market-moving posts seconds before the public, for up to $100,000 a month. Democratic Senators are calling for an SEC investigation, with disbelief that insider trading could be a legitimate business model. Buy the rumour, sell the Truth.