The Year the Shofar Waits

Rosh Hashanah 5787, the Coldcard reckoning, and the ten percent

Rosh Hashanah begins at sundown on Friday, September 11, 2026, and ends at nightfall on Sunday the 13th. We enter the year 5787.

There is a quirk to this one. The first day falls on Shabbat, which means the shofar is not sounded on day one. The whole year turns on that blast — the alarm, the wordless cry, the sound that is supposed to wake you — and this year it waits. Day one, silence. You get a full day of Rosh Hashanah with no alarm at all.

You have to do the waking yourself.

Which is convenient, because five weeks ago the alarm already went off, and most of us hit snooze.

What the sound actually was

In the early hours of July 30, roughly 594 BTC left about 500 wallets in under half an hour. Not an exchange hack. Not a phishing campaign. Not somebody’s uncle typing his seed into a website. Cold storage. Air-gapped. The gold standard. Gone in twenty-five minutes.

The cause, as reconstructed by Block’s Bitcoin engineering team and independent Core developers, was a firmware defect introduced in March 2021. Coldcard devices were supposed to draw entropy from a dedicated hardware random number generator. On certain firmware versions, they quietly fell back to a deterministic software PRNG instead. A 128-bit seed collapsed to something on the order of 72 bits of real randomness — small enough for an attacker with automation to simply search the space and walk out with the keys.

The bug sat in public, open-source code for five years. Auditable by anyone. Audited, apparently, by no one who was looking hard enough — until someone who was not on our side got there first.

As I write this, the running total has climbed past 2,000 BTC across more than 7,700 addresses. It may be higher by the time you read it. Coinkite’s founder has apologized publicly and taken accountability, which is more than many would have done, and then spent the following days defending a customer-email retention practice that contradicted years of privacy assurances. Both of those things are true at once. Hold them both.

But the part that should keep you up at night is not the bug.

The part that should keep you up at night

When the largest self-custody failure in Bitcoin’s history was five days old and still bleeding, the industry’s most effective on-chain investigator publicly declined to trace a single satoshi.

His reasoning was not cruelty. It was an invoice. He said his time goes to ecosystems that value his work, that Bitcoin maximalists are not donors or supporters, and that he therefore has less obligation to help. He cited a recovery fee he was ghosted on. He cited a $25,000 bounty outstanding for nine months. He said he was no longer interested in burning weeks on complex cases in exchange for a pat on the back.

Read that again slowly, because it is the most important sentence written about Bitcoin this year: you are not donors or supporters.

He is not wrong. That is the wound. We have built a culture that produces men who will grind for a decade to accumulate, and cannot be moved to fund the people who make the accumulation mean anything. We took the labor of open-source developers, security researchers, privacy engineers, and forensic investigators — and we paid them in engagement. In likes. In “you’re a legend, ser.” In laser eyes.

And then the day came when we needed them, and the bill came due, and we discovered that we had no credit.

Notice who did show up. Block’s security team — funded. Galaxy Research — funded. The Core developers who dissected the entropy failure — many of them on grants from Brink, OpenSats, or HRF’s Bitcoin Development Fund. Every single person who helped in the last week was paid by someone. Just, overwhelmingly, not by you.

Meanwhile — and I want you to sit with this — Bitwise, an ETF issuer, the very thing the timeline calls a fiat parasite, has committed ten percent of its Bitcoin ETF profits to open-source Bitcoin development.

The ETF tithes.

Do you?

Tzedakah is not charity
Here is where the calendar stops being decoration and starts being an argument.

We translate tzedakah as charity. It is a bad translation, and the badness matters. Charity comes from caritas, love — a gift, freely given, from surplus, because you felt like it. Tzedakah comes from tzedek: justice. It is not a gift. It is a debt. It is the portion that was never fully yours, held in your account, and giving it is not generosity — it is settlement.

The tithe, ma’aser kesafim, is ten percent. The Sages at Usha capped the upper end at a fifth, a chomesh, precisely because people were impoverishing themselves through zeal (Ketubot 50a). Note the shape of that: the rabbis’ recorded worry was that people would give too much. Imagine legislating against that failure mode in this community.

The liturgy makes the mechanism explicit. On these days we say that teshuvah, tefillah, and tzedakah avert the severity of the decree. Repentance, prayer, and giving. Not two of three. Not the two that are free.

Now, a necessary honesty: whether you owe ma’aser this year is a real halachic question and I am not your rav. Ask him. Most authorities apply the tithe to income and realized profit, not to principal, and not to an unrealized paper stack. Which means a Bitcoiner in August 2026 — with BTC around $64,000, roughly half off the all-time high, sitting on coins he has not sold and does not intend to sell — can build a technically defensible case that he owes precisely nothing.

You can. The argument works. It is also the single most spiritually dangerous sentence in this essay, because it is exactly the kind of argument the yetzer hara is best at: airtight, sourced, and load-bearing for the conclusion you already wanted.

You know the difference between a heter and an alibi. So do I.

Teshuva is proof of work
The Rambam is unsentimental about what repentance actually requires. Regret, abandonment of the act, verbal confession, resolve — and the proof, in Hilchot Teshuva 2:1: complete teshuva is when you stand in the same place, with the same opportunity, with nothing stopping you, and you choose differently.

Not when you feel bad. Not when you post about feeling bad. When the identical situation recurs and your hands do something else.

Teshuva is proof of work. You cannot stake your way into it.

And there is a further rule, from the Mishnah in Yoma, that this community needs tattooed somewhere: Yom Kippur atones for transgressions between a person and God. For transgressions between a person and his fellow, it atones for nothing at all until you have gone to that person and made it right.

That is the whole Coldcard situation in one line. There is a sin here between us and Heaven — arrogance, idolatry of the stack, the smugness of “not your keys” recited as a catechism by people who never verified anything in their lives. Fine. Fast for it. But there is also a sin between us and our fellows, and Rosh Hashanah does not touch it. The developer who was never funded. The researcher who was ghosted on his fee. The maintainer who reviewed your code for free for eleven years while you called him a communist for taking a grant. The auditors who did not exist, because we never paid for auditors.

You do not get atonement for that by davening harder. You get it by writing checks to the specific people you stiffed.

The tikkun of the stacker
Every soul comes in with a correction to make, and the correction is always located precisely where your greatest strength curdles.

Ours is not greed. Give us that much. The Bitcoiner’s virtue is real: patience, discipline, deferred gratification, the willingness to be laughed at for a decade. Low time preference. We built an entire identity on the ability to not spend.

And that is exactly where the rot sets in, because a virtue that is never tested becomes a hiding place. Somewhere along the way, “I don’t sell” quietly became “I don’t give,” and we let the second one wear the costume of the first. We sanctified refusal. We made an inability to open our hands into a spiritual discipline and called it conviction.

Look at it honestly and it inverts. Funding freedom tech is the lowest time-preference act available to you. It is spending capital today on infrastructure that pays out in twenty years, to people who will never thank you, for the benefit of a generation that is not born yet. That is the actual practice. Refusing to do it is high time preference in a Savile Row suit — the frantic, grasping need to see your number today, right now, uncut and unshared.

The tikkun is not to stop stacking. It is to stop confusing hoarding with holiness.

For the children, allegedly
We talk constantly about our children. Generational wealth. A world for our kids. Fixing the money fixes the world. It is the standard justification for everything, including the parts that look like avarice from the outside.

So take it seriously, on its own terms.

What exactly are you leaving them? Twenty million coins are already mined. If you leave your children a stack and nothing else, you have left them wealth denominated in a network that nobody funded, secured by software nobody audited, defended by lawyers nobody retained, running on privacy tools that were never finished, in a legal environment nobody fought for. You have handed them a very large key to a house with no walls.

The last five weeks are what that looks like in miniature. The money was there. The maintenance was not. And when it broke, the people who could have helped had already learned that we do not pay.

L’dor vador — from generation to generation — is not a transfer of assets. It is a transfer of a functioning world.

What this actually looks like
Ten percent. Not of your stack — of your gains this year, and if your gains are negative, then of whatever number you know in your own heart you can part with without lying to yourself. Denominate it in sats if that helps. It should.

Send it where the work is:

OpenSats — since 2023, over $24 million to more than 270 developers across 40+ countries, all denominated in sats.
Brink — grants and mentorship for the Bitcoin Core developers who keep the protocol alive.
HRF’s Bitcoin Development Fund — 1.5 billion sats in Q1 2026 alone, aimed squarely at people living under regimes that make this technology a matter of survival rather than portfolio construction.
Coin Center — because code is speech only for as long as someone is willing to argue it in court.
Btrust, Vinteum, Summer of Bitcoin — developers in Africa, Latin America, and everywhere the next Satoshi is currently unable to afford a laptop.
Independent security researchers and auditors. Pay the outstanding bounties. Pay the ones you ghosted.

That one is not tzedakah, it is gezel — theft — and it comes first.

Set it to recur. Do it before Yom Kippur, when the ledger is still open.

Elul is nearly done. The month whose name is read as Ani l’dodi v’dodi li — I am my beloved’s and my beloved is mine — the season when the King is said to be out in the field, close enough to talk to, before He returns to the palace and the gates get harder to reach.

This year the shofar does not sound on the first day. Nobody is going to wake you. The wake-up call already came, at 01:31 UTC on a Friday in July, and it cost the community over $100 million and something more expensive than that: the discovery that when we finally needed the people we never supported, they had every right to say no.

So do the accounting. All of it, not just the part you’re good at. Open the ledger you keep in your chest, the one with no seed phrase and no backup and no recovering it if you lose it, and look at what’s actually in there.

You may be good at the stacking sats part, but how humble are you really?