Peter D. Gray | Confusion Grows Over His Alleged Alias ‘Switck’

A situation surrounding Coldcard intensifies as questions swirl about Peter D. Gray's possible alias, "switck." It appears Gray may have communicated through this identity, linking it to 58 commits in a repository amid concerns over vulnerabilities in the Coldcard wallet's library.

The Identification of Switck

Investigations reveal that 58 commits in the switck/libngu repository were indeed authored under the name "Switck" and signed with Gray’s GPG key. This suggests both identities were active simultaneously, raising eyebrows about the implications of this duality. As one source commented, "This is unfolding like a classic murder story."

In 2019, the switck account tweeted about a "new identity" during the DEF CON conference, hinting at a possible intent behind the alias. The account also promoted critical updates related to the Coldcard firmware, leading people to question whether Coinkite was aware of this overlapping identity.

Analyzing Git Commit Practices

Commenters have pointed out that it’s not unusual for a commit to be signed by someone different from the original author due to Git workflows like rebasing or cherry-picking. Nevertheless, the details from the switck/libngu commits raise significant red flags:

• The author and GPG signature do not match the committer—a discrepancy that suggests they could be the same person.

• Timestamps for the author, committer, and GPG signature in libngu commits are identical, implying they occurred in the same action.

One user observed, "What is weird is a hardware wallet including random guys security implementation for no reason." This points to both credibility and security concerns about the library integration.

The Security Implications

The integration of switck/libngu into Coldcard introduced serious vulnerabilities, where wallet-seed generation shifted to a defective random number generator. Some comments reflect mixed sentiments, with people questioning the oversight and communication from Coinkite during this incident.

"These could have been identified years ago, and ready to ‘dump all’ as soon as the command is sent."

Others speculate broader implications, suggesting, "This may go much deeper than the immediate team."

Demand for Accountability

The silence from Coinkite regarding who controlled the switck identity has left many demanding clarity. "Why was a critical Coldcard library hosted under a pseudonymous account instead of Coinkite or Coldcard?" asks one concerned commentator.

Key Takeaways

• 🚨 58 commits under alias "Switck" linked to Peter D. Gray’s key.

• 🔍 Coldcard firmware shows vulnerabilities due to RNG issues introduced by this library.

• ❓ Ongoing questions surrounding transparency and accountability from Coinkite.

As this situation unfolds, pressure mounts for Gray and Coinkite to address these concerns, with users increasingly eager for resolution before the impacts deepen. The ultimate question that lingers is: what is the real story behind this peculiar saga?