Coldcard's Five-Year Vulnerability: RNG Failure, Four Suspected Attack Waves, and the Self-Custody Debate
Editor | WuBlockchain
TL;DR:
A five-year RNG vulnerability: During a code migration in 2021, Coldcard mistakenly routed wallet seed generation through a software pseudorandom number generator instead of the intended hardware random number generator. As a result, mnemonic phrases generated by certain firmware versions had an effective search space significantly below the intended security target.
Four suspected attack waves and counting: Galaxy Research previously identified three suspected attack waves involving 4,585 addresses and 1,367.05 BTC. A fourth wave emerged on August 3, with the latest estimate reaching approximately 448.7 BTC across 709 potential victim addresses. Assuming no overlap between the four waves, the combined observed total would be approximately 1,815.75 BTC across 5,294 addresses. However, these figures are based on on-chain pattern analysis and should not be treated as individually verified Coldcard victim addresses or confirmed final losses.
A firmware update cannot repair an old seed: Exposure depends on the device and firmware version used when the mnemonic phrase was created. Importing an affected mnemonic into another wallet or merely updating the Coldcard firmware cannot restore the missing entropy. Users must generate a new seed using patched firmware or another trusted environment and then move their funds.
Post-disclosure community tests suggest that AI may be able to identify the flaw, but they do not establish attribution: Community users claimed that Claude Code and GLM-5.2 identified the faulty random number generation path in approximately eight and 20 minutes, respectively. However, the tests have not been independently reproduced, and the code versions, model configurations, and execution environments were not fully disclosed. Coinkite also acknowledged that it had previously used AI to review the code without detecting the vulnerability. There is currently no evidence that the attackers used AI to discover or exploit the flaw.
The incident has reignited the custody debate: Following the disclosure, Bitcoin active addresses, movements of long-dormant BTC, and inflows to centralized platforms all increased. Some analysts believe that part of this activity may reflect users moving funds as a precaution, but on-chain data cannot establish a causal relationship. The incident exposed a key-generation risk in a specific hardware wallet product. It does not mean that Bitcoin’s underlying cryptography or all forms of self-custody have failed.
Between 01:10 and 01:51 UTC on July 30, 2026, a group of Bitcoin addresses was swept in approximately 41 minutes, with a total of 1,082.65 BTC moved. The assets were worth approximately $70.2 million at the time. Galaxy Research initially reported that 1,196 addresses were involved, but later used a figure of 1,195 when consolidating its analysis of the first three waves. This article uses the more recent figure of 1,195 while noting the discrepancy.
Galaxy said the initial core transaction cluster used a fixed fee rate of 30 sat/vB and produced no change outputs, suggesting that the transactions may have been executed in batches by an automated tool. In a subsequent update, Galaxy said the second wave primarily used fee rates of 10 sat/vB and 50 sat/vB, while a few additional low-value addresses were swept at approximately 4 sat/vB. The fixed 30 sat/vB fee should therefore be understood as a fingerprint of the first wave, rather than a feature shared by all related activity. The funds from the initial wave were subsequently consolidated primarily into four addresses.
The transfers occurred approximately 30 hours before Coinkite, the manufacturer of Coldcard, publicly disclosed the firmware risk affecting the Mk3. Several additional waves of fund movements with similar programmatic characteristics subsequently emerged. After identifying the first three waves, Galaxy expanded its estimate to 4,585 addresses and 1,367.05 BTC, worth approximately $88.6 million. On August 3, Galaxy Research Head of Firmwide Research Alex Thorn identified what appeared to be a fourth wave of organized activity.
The incident did not involve a compromise of Bitcoin’s underlying cryptography. Investigations by Block and Coinkite traced the problem to the random number generation path in Coldcard firmware. When creating wallet seeds, some devices did not use the intended hardware random number generator and instead called a predictable software pseudorandom number generator.
In theory, an attacker could enumerate candidate outputs using information such as device identifiers, boot times, timer states, and the history of random number generator calls, without physically accessing the device. The attacker could then derive corresponding mnemonic phrases and addresses and compare them against publicly visible blockchain addresses. However, no public report has yet demonstrated a complete end-to-end attack that reconstructs a specific victim’s mnemonic phrase from scratch and matches it to a drained address.
July 30: Approximately 500 Addresses Initially Swept
On July 30, on-chain researchers initially observed that approximately 500 single-signature Bitcoin addresses had been swept within about 25 minutes. The transfers involved approximately 594 BTC, worth around $38 million, with roughly 562 BTC subsequently sent to a single address. Most of the affected addresses held more than 0.15 BTC, and some of the UTXOs had remained inactive for years.
At the time, one potential victim said that they had used a Coldcard device, prompting speculation that the incident might be connected to the hardware wallet. Coinkite co-founder and CEO Rodolfo Novak, also known as NVK, initially rejected the conclusion that a confirmed device-level vulnerability had been identified. He suggested that the users involved might have imported previously compromised mnemonic phrases or seeds generated with weak randomness, and noted that the transfers involved private keys from multiple wallets.
Bitcoin security researcher Jameson Lopp said at the time that some users appeared to have lost only specific UTXOs rather than their entire wallet balances. This raised the possibility that the attacker possessed individual private keys rather than complete mnemonic phrases. However, this assessment was made before the root cause was disclosed and should be treated only as a hypothesis based on the limited evidence then available.
Galaxy later expanded the observed scope of the same wave to 1,195 addresses and 1,082.65 BTC. The earlier figures of approximately 500 addresses and 594 BTC therefore represented a narrower, preliminary view of the first wave and should not be added to the later totals.
Coinkite Issues an Alert and Later Expands the Affected Device Range
Approximately 30 hours after the first large-scale transfers, Coinkite issued a Coldcard security advisory. The company initially focused on Mk3 devices that had generated mnemonic phrases using certain firmware versions. Based on its preliminary analysis at the time, Coinkite said that the Mk4, Q, and Mk5 did not appear to be affected.
As Block’s security team and other researchers continued their analysis, Coinkite expanded the list of affected devices. According to the company’s advisory as updated on August 1:
Seeds generated on the Mk2 and Mk3 using firmware versions 4.0.1 through 4.1.9 are affected.
Seeds generated on the Mk4 and Mk5 using standard firmware versions earlier than 5.6.0 are affected.
Seeds generated on the Q using standard firmware versions earlier than 1.5.0Q are affected.
Seeds generated on the Mk4 and Mk5 using Edge firmware versions earlier than 6.6.0X are affected.
Seeds generated on the Q using Edge firmware versions earlier than 6.6.0QX are affected.
Block’s technical report, however, listed versions 4.0.0 through 4.1.9 as vulnerable on the Mk2 and Mk3. It said that the affected code path first appeared in version 4.0.0, released on March 17, 2021. This creates a one-version discrepancy with Coinkite’s advisory, which begins with version 4.0.1. Until Coinkite provides further clarification, users who generated seeds using version 4.0.0 may wish to take the more conservative approach of treating them as potentially affected and moving their funds.
TAPSIGNER, OPENDIME, and SATSCARD use different codebases and are not included in the affected product list.
Coinkite’s initial assessment that the Mk4, Q, and Mk5 were unaffected was therefore revised as the investigation progressed. Exposure should be determined by the device and firmware version used when the seed was generated, rather than the firmware currently installed, the device’s purchase date, or the wallet in which the mnemonic phrase is now stored.
A 2021 Code Migration Routed Seed Generation Through a Software PRNG
On July 30, Block’s Bitcoin Engineering and Security team published a technical analysis tracing the issue to March 2021. At the time, Coinkite migrated some elliptic-curve operations to libsecp256k1, the library used by Bitcoin Core, and introduced libNgU for its embedded MicroPython environment.
During the migration, the wallet seed generation call was changed from ckcc.rng_bytes() to ngu.random.bytes().
The original path called Coldcard’s hardware random number implementation for the STM32 chip. Because of an error in a conditional compilation check, the replacement path ultimately connected to Yasmarang, a software pseudorandom number generator included as a fallback in MicroPython.
Coldcard’s production configuration defined MICROPY_HW_ENABLE_RNG as 0. The developers intended this setting to disable MicroPython’s own hardware random number implementation and use Coldcard’s implementation instead. However, the relevant libNgU code checked only whether the macro was defined, rather than whether its value was nonzero.
Because the macro was defined even though its value was 0, the compilation process did not produce an error. The software fallback was subsequently linked into the firmware under the same function signature. The bug did not cause the device to crash or fail to generate a seed. Instead, the device continued to produce mnemonic phrases that appeared random, allowing the problem to remain unnoticed by users for years.
The software generator was initialized primarily using part of the microcontroller’s unique identifier and timer registers, including SysTick and RTC values. These inputs are not cryptographic secrets. If an attacker could obtain or narrow down the device identifier, boot time, timer state, and the number of previous random number generator calls, they might be able to reproduce parts of the output stream offline and generate candidate mnemonic phrases and addresses.
Block said that the affected seed generation path on the Mk2 and Mk3 did not receive a subsequent cryptographic reseed. The Mk4, Mk5, and Q also incorporated additional entropy from a secure element, but only four bytes from the resulting digest, or 32 bits, were incorporated into the state of the software generator. This was insufficient to restore the originally intended level of randomness.
Coinkite preliminarily estimated that affected Mk2 and Mk3 seeds had an effective search space of approximately 40 bits. For the Mk4, Mk5, and Q, the addition of secure element data increased the estimated effective entropy to approximately 72 bits, still below the company’s stated design target of 128 bits.
Block provided conditional upper bounds below approximately (2^{40.7}) and (2^{73.3}), respectively. It also cautioned that these estimates depend heavily on the device and timing information available to an attacker. They should not be treated as directly equivalent to conventional cryptographic security levels, nor can they be used to determine the exact cost of compromising every affected device.
Block said that it had not completed a full end-to-end empirical test involving real devices and victim wallets. Public materials have also not demonstrated the complete process of reconstructing a specific victim’s mnemonic phrase from scratch and matching it to an address that was subsequently drained.
The random number generation flaw has therefore been confirmed at the code level, but the connection between each individual on-chain address and the vulnerability remains based primarily on transaction behavior, address characteristics, and information from some users, rather than wallet-by-wallet cryptographic reproduction.
Galaxy Identifies Three Waves, but Whether They Shared an Operator Remains Unclear
On August 1, Galaxy Research said that its analysis of Bitcoin blockchain data had identified three waves of activity suspected of targeting Coldcard-generated addresses. The waves involved a total of 4,585 addresses and 1,367.05 BTC, worth approximately $88.6 million.
In Galaxy’s later address count, the first wave involved 1,195 addresses, the second involved 1,478 addresses, and the third involved 1,912 addresses, for a total of 4,585. Galaxy initially reported 1,196 addresses in its analysis of the first wave, resulting in a one-address adjustment between the two reports.
Galaxy said that the first two waves were similar in their fund-consolidation structures, destination address types, and address derivation paths. This supports a reasonable suspicion that they were conducted by the same operator, but does not prove it.
The third wave differed substantially in its consolidation structure, destination addresses, and batch transaction construction. The original attacker may have changed tools, or another attacker may have independently exploited the same vulnerability.
Galaxy expressed relatively high confidence that the transactions within each individual wave were controlled by a single operator. However, it did not conclude that the same person was responsible for all three waves.
Galaxy also stressed that the figures were derived from on-chain analysis and that it had not verified whether every identified address was generated by Coldcard firmware with insufficient randomness. Fixed fee rates, the absence of change outputs, address age, and fund-consolidation patterns can help identify transactions that may belong to the same cluster, but they cannot independently prove that every transaction was a theft or that different waves were conducted by the same attacker.
At the time Galaxy published its consolidated analysis of the first three waves, the main funds from those waves remained in the identified suspected attacker addresses. Separately, Galaxy observed that funds from smaller suspected copycat or opportunistic attacks had begun moving through peel chains, cross-chain services, and offshore gambling platforms. These movements should not be conflated with the flow of funds from the three main waves.
Galaxy said that it had provided approximately 600 suspected attacker-controlled holding addresses to US federal investigators, compliance firms, and cybersecurity investigators.
August 3: The Fourth Suspected Wave Reaches Approximately 448.7 BTC
On August 3, Galaxy Research Head of Firmwide Research Alex Thorn said that what appeared to be a fourth wave of organized Coldcard-related attacks was underway.
Thorn initially identified 218 transactions between blocks 960,778 and 960,792, involving 462 potential victim addresses, 216 newly created destination addresses, and approximately 388.93 BTC.
He said that none of the relevant inputs predated the point at which the vulnerable Coldcard firmware was released. Within the observed range, there were an average of approximately 13.8 sweep transactions per block, compared with approximately 0.3 per block during a pre-incident control window. This was roughly 45 times the normal rate.
Most transactions created a new destination address for each potential victim, while some funds were subsequently sent to second-hop addresses.
As additional blocks were confirmed and the dataset was refined, Thorn updated the fourth-wave estimate to approximately 448.7 BTC across 709 potential victim addresses. The revision included the removal of false positives, including 89 multisignature addresses holding approximately 20.58 BTC. The updated figure should therefore not be interpreted as a simple addition of newly confirmed transactions to the original estimate.
The figures remain on-chain estimates based on UTXO age, address types, and transaction behavior. They have not been individually confirmed by Coinkite, law enforcement agencies, or all of the relevant wallet holders.
Thorn also said that similar transactions were still awaiting confirmation in the mempool and that some confirmed transactions had opted into replace-by-fee, or RBF. Users who still controlled the relevant private keys and whose suspicious transactions remained unconfirmed and eligible for replacement could attempt to broadcast a conflicting transaction with a higher fee that moved the funds to a secure wallet.
However, RBF applies only to unconfirmed transactions that meet the replacement conditions, and there is no guarantee that the user’s replacement transaction will be confirmed first. Users should also be alert to fraudulent recovery tools, phishing websites, and purported support representatives requesting mnemonic phrases during the emergency.
Adding Galaxy’s previous estimate of 1,367.05 BTC across 4,585 addresses to the updated fourth-wave figure produces an observed total of approximately 1,815.75 BTC across 5,294 addresses. This calculation assumes that there is no overlap between the waves and represents only an arithmetic aggregation of on-chain estimates. It should not be treated as a final loss figure confirmed by Coinkite or law enforcement agencies.
Swan Pauses Certain Withdrawals as Nunchuk Reviews Platform Keys Generated by Coldcard
On August 1, Bitcoin financial services platform Swan said that it had temporarily paused certain withdrawals that appeared to be directed to Coldcard wallets following the disclosure of the vulnerability.
Swan said that its own services were not affected. The restrictions were based primarily on wallet labels that users had previously assigned to withdrawal addresses. Swan could not determine from those labels alone which device or firmware version a user currently employed, or whether the underlying seed was affected.
According to a Nunchuk response reported by Bitcoin News, some of the platform’s keys had been generated using the Coldcard Mk4. However, the keys used in practice were processed through a custom derivation method, making them less likely to appear directly in lookup tables constructed around standard derivation paths.
Nunchuk also said that, given sufficient time, users should assume that attackers could eventually include those derived keys in their search range. No complete public technical advisory from Nunchuk has been identified. The information should therefore be understood as a company response relayed by the media, rather than an independently verified security conclusion.
ZachXBT Declines to Track the Incident, Citing Unpaid Investigative Work
On August 3, on-chain investigator ZachXBT said that he had no plans to monitor or trace the Coldcard incident and would instead focus his time on ecosystems that valued his investigative work.
ZachXBT also cited several investigations for which he said he had not been paid. He claimed that his previous investigation into John Daghita, also known as Lick, directly contributed to Daghita’s arrest in the Caribbean, but that he received no compensation for the work.
In January 2026, ZachXBT alleged that Daghita had used access linked to a US Marshals Service contract held by his father’s company, CMDSS, to steal more than $46 million in cryptocurrency seized by the US government. Daghita was subsequently arrested in Saint Martin. However, law enforcement agencies have not publicly confirmed that ZachXBT’s investigation directly led to the arrest, meaning that the asserted causal relationship remains ZachXBT’s own account.
ZachXBT also claimed that, in June 2026, he spent more than five hours tracing a $600,000 scam and helped freeze $96,000, but did not receive the fee he had been promised. He further alleged that another project had failed to pay a $25,000 bounty for nine months after he completed an investigation.
These statements are ZachXBT’s own claims and are not directly related to the Coldcard random number generation vulnerability.
On-Chain Activity Increased After the Disclosure, but the Rise Cannot Be Attributed Entirely to Coldcard
CryptoQuant Head of Research Julio Moreno said that the number of daily active Bitcoin addresses increased from approximately 645,000 on July 30 to nearly 1 million on July 31, the highest level since December 10, 2024. The number of active sending addresses rose particularly sharply.
Moreno said that some of the increase might reflect Coldcard users moving BTC as a precaution following the disclosure. However, active address data cannot identify the wallet brand involved and does not establish a direct causal relationship.
During the same period, transfers of less than 1 BTC each totaled approximately 39,600 BTC, close to the roughly 39,900 BTC recorded following the collapse of FTX in November 2022. Exchange deposits involving transactions of less than 10 BTC rose to approximately 7,300 BTC, the highest level since February 6.
TimechainIndex founder Sani estimated that net Bitcoin inflows to centralized platforms or identified entities reached approximately 11,163 BTC on July 31, with the largest flows going to River, Binance, Kraken, and OKX. Because River is not a conventional pure-play exchange, the entire figure should not be uniformly described as net exchange inflows.
CryptoQuant analyst JA Maartunn said that approximately 77,402 BTC from older UTXO age bands had moved since the vulnerability was disclosed. The figure represents renewed activity involving long-dormant Bitcoin. It cannot be attributed entirely to Coldcard and does not mean that all 77,402 BTC was deposited on exchanges.
Wallet migrations, address consolidation, changes in custody arrangements, and actual selling activity can all appear in on-chain data.
According to Santiment, the ratio of positive to negative Bitcoin commentary across X, Reddit, and Telegram fell to the lowest level recorded since the firm began its modern social data tracking. For every negative comment, there were approximately 0.58 positive comments.
Santiment said that the Coldcard incident may have weakened some traders’ confidence in cold wallets and self-custody. However, the result was based on a short-term social media sample that could be heavily influenced by a single news cycle or unusually negative commentary. It cannot establish whether the shift in sentiment will persist.
In its July 2026 security report, PeckShield provisionally estimated Coldcard-related losses at approximately $70 million and ranked the incident as the third-largest cryptocurrency theft of the year to date, behind Drift and KelpDAO/LayerZero.
The figure was a point-in-time estimate published in a July monthly report. It did not include all of the suspected addresses subsequently identified by Galaxy or the fourth wave, and it should not be treated as a final loss total confirmed by victims or law enforcement agencies.
The Incident Reignites the Custody Debate, but Different Models Carry Different Risks
Bloomberg ETF analyst Eric Balchunas said that, according to publicly available information from PitchBook and LinkedIn, Coinkite had approximately five employees. He argued that such a small team could represent a risk signal for a hardware wallet manufacturer responsible for securing substantial amounts of user wealth.
Balchunas said that larger institutions such as Coinbase and Ledger, as well as regulated custody arrangements supporting spot Bitcoin ETFs, might have greater security and compliance resources, although some of these options may involve higher fees.
Coinkite’s actual employee count was not independently confirmed by the company in connection with his comments. The figure of approximately five employees should therefore be treated as a third-party estimate cited by Balchunas, rather than an established fact.
The resulting debate has focused primarily on the different risks associated with centralized custody and self-custody.
Exchanges and fund custody systems expose users to counterparty risks, including asset misappropriation, institutional insolvency, withdrawal freezes, insider attacks, regulatory intervention, and single points of failure. Self-custody reduces some counterparty risks, but transfers responsibility for seed generation, backups, inheritance, signing devices, firmware supply chains, and operational security to the asset holder.
The Coldcard incident demonstrates that operating a hardware wallet offline does not mean that every component, including seed generation, firmware builds, and supply chains, has been fully verified. The flaw affected the random number generation path used when a seed was created. Importing an affected mnemonic phrase into another hardware wallet does not correct the original lack of entropy.
Merely updating the firmware also cannot repair a mnemonic phrase that has already been generated. Users must create a new seed using patched firmware or another trusted environment and transfer their assets to addresses controlled by the new seed.
According to Coinkite’s advisory, the patched firmware versions are:
Mk2 and Mk3: Version 4.2.0 or later.
Mk4 and Mk5 standard firmware: Version 5.6.0 or later.
Q standard firmware: Version 1.5.0Q or later.
Mk4 and Mk5 Edge firmware: Version 6.6.0X or later.
Q Edge firmware: Version 6.6.0QX or later.
Coinkite said that adding at least 50 fair, independent, and private dice rolls during seed generation could provide additional entropy that did not depend on the device’s random number generator. The dice must be physical and fair, and the rolls must be performed independently by the user. If the results are recorded, photographed, uploaded, or provided by a third party, the additional protection is reduced.
A strong and unique BIP-39 passphrase can provide an independent layer of protection, but it cannot restore the randomness missing from the original seed and should not replace fund migration. Coinkite continues to recommend generating a new seed and moving funds when a seed is known or suspected to have been created using affected firmware.
For larger holdings, generating keys on devices from different manufacturers and using them in a multisignature arrangement can reduce the risk that a single vendor flaw compromises enough keys to meet the signing threshold. However, the protection depends on the multisignature quorum retaining enough secure keys. Such arrangements also introduce additional complexity in backups, inheritance, recovery, and routine operations.
Coldcard’s firmware source code has long been publicly viewable and verifiable, allowing Block and other researchers to identify the root cause quickly after the incident. However, the current Coldcard license includes restrictions such as the Commons Clause. It should therefore not automatically be described as free and open-source software under generally accepted definitions. More precise descriptions include “publicly available source code” or “source code available for public review.”
Making code publicly available creates the conditions for review, but does not prove that the code has been adequately audited. The seed generation error remained in the code path for approximately five years, demonstrating that even publicly accessible security-critical code can go without sufficiently deep or continuous review.
Post-Disclosure Community Tests Suggest That AI Can Identify the Flaw, but Do Not Prove That the Attackers Used AI
In its technical explanation, Coinkite said that because Coldcard’s source code was publicly accessible, the company suspected that someone might have used AI to review an older version of the code and identify the flaw.
Coinkite also disclosed that it had used a leading AI model to review the code several weeks before the incident, but the model did not identify the vulnerability or any other critical issue. The contrasting results illustrate that AI-assisted code review depends on factors including the scope of the code provided, prompts, context limits, tool configuration, and verification procedures. It should not be treated as a deterministic security audit.
After the vulnerability became public, a Reddit user claimed to have provided the Coldcard code to Claude Code with a simple instruction resembling “check for vulnerabilities.” According to the user, the model identified the random number generation path as the source of the problem after approximately eight minutes.
The same community user also claimed that GLM-5.2, described as having been released or trained before the incident and run without internet access, identified the same issue in approximately 20 minutes.
Both tests were conducted after the vulnerability had already been disclosed. The participants did not fully disclose the exact code commits analyzed, whether the repositories contained fixes or other relevant clues, the precise model versions, system prompts, complete execution logs, or evidence confirming network isolation.
The results therefore do not rule out the possibility that the models reviewed code versions containing obvious clues, or that the experimenters’ selection and interpretation of the outputs were influenced by prior knowledge of the vulnerability.
At most, the community tests suggest that current coding models may be able to trace macro definitions, dependencies, and function call paths with limited human guidance and reproduce or independently identify this type of flaw.
They do not prove that the original attackers used AI to discover the vulnerability. Nor do they demonstrate that AI can autonomously complete the entire attack process, from code review and exploit development to seed enumeration and on-chain fund transfers.
No publicly available attack tools, model usage records, prompts, execution environments, or attacker identity information currently support attribution to AI. Coinkite’s suggestion that the attackers may have used AI remains speculative.
What can currently be confirmed is that a random number generator integration error introduced in 2021 weakened the security of wallet seeds generated by certain firmware versions. Several waves of on-chain fund movements with programmatic characteristics subsequently occurred. Based on transaction fingerprints, Galaxy and other researchers believe that the activity may be connected to the vulnerability, but the affected wallets have not been individually verified through cryptographic reproduction.
The incident concerns a key-generation flaw in a specific product and set of firmware versions. It does not represent a failure of Bitcoin’s elliptic-curve cryptography, SHA-256, the BIP-39 standard, or Bitcoin’s consensus mechanism. Nor does it establish that all hardware wallets or all forms of self-custody are insecure.
Note: The address counts, BTC amounts, and US dollar values cited in this article are provisional figures derived from publicly available on-chain data and transaction characteristics as of August 3, 2026. They do not mean that every relevant address has been individually confirmed as having been generated by affected Coldcard firmware, nor do they represent final losses confirmed by Coinkite, law enforcement agencies, or victims. The incident remains ongoing, and the affected device and firmware ranges should be checked against Coinkite’s latest security advisory.
Follow us
Twitter: https://twitter.com/WuBlockchain
Telegram: https://t.me/wublockchainenglish