What is the video about?
Crypto Coffee answers a criticism that has resurfaced while Richard Heart is detained in Turkey: that the official PulseChain bridge has admin keys, although Heart has long warned against them (at 0:00, at 9:11). The host’s case is that no bridge in crypto is fully trustless (at 1:22), that multisig bridges such as Ronin, Harmony and Orbit were drained anyway (at 2:35), and that the keys are a known, deliberate trade-off rather than a hidden flaw (at 1:45, at 8:02). This portal has read the bridge’s contracts and keys on chain; the full readings are on the bridge and in the animated explainer.
The host’s count of 20 days in detention matches the dates: Heart was detained on 14 October 2026 and the video came out on 3 November. As of 4 November 2026 no court decision on custody, no Turkish charge and no extradition request is public; the record is on the legal timeline.
What holds?
- Claim: five of eight bridge validators must sign a transfer (at 6:52). Right. On 2026-10-17 and 2026-10-19 the validator contract on each chain listed 8 validators with 5 signatures required. In the same passage the host also speaks of “an 8 of 15 multi-sig”, which matches nothing in the contracts; the rule is 5 of 8.
- Claim: the bridge is OmniBridge, an old design from the xDai bridge (at 6:30). Right. It is the OmniBridge and Arbitrary Message Bridge code written by POA Network and Gnosis, the family behind the xDai, now Gnosis Chain, bridge.
- Claim: the bridge has audits with no critical findings (at 23:27). Right for the upstream code. ChainSecurity found 0 critical and 1 high issue, partially corrected, in OmniBridge v6.0 (2021), and Quantstamp found no high or medium issues in TokenBridge 5.4.1 (2020). These audits cover the code PulseChain’s bridge is built on, not PulseChain’s own deployment or how its keys are kept; no audit of the deployment was found.
- Claim: PulseChain does not have EIP-7702 (at 10:40). Right. PulseChain mainnet runs Ethereum’s rules up to Shanghai and Capella and has not activated later upgrades, including Prague, which brought EIP-7702 (history). The host’s figure of about $6 billion for the recent Binance hack is close to what crypto press such as Cointelegraph reports; how much EIP-7702 contributed is still disputed in that coverage and was not checked here.
- Claim: the admin keys were never a secret (at 25:06). Right in the sense that the keys are visible to anyone who reads the contracts: each role can be queried on chain.
What does not hold?
- Claim: no single key can both change parameters and upgrade the code, so an attacker would need two keys at once (at 17:47). There are indeed five distinct keys per chain, as the host says, some of them holding more than one role — but one of them is enough. A mediator owner can point the mediator at a different message contract, a validator-list owner can replace validators or lower the threshold, and an upgrade owner can replace the code. Each of these can bypass the 5-of-8 rule alone. All ten role holders were single addresses with no multisig or timelock on chain (readings of 2026-10-17 and 2026-10-19, who can change what). Whether the keys are protected off chain cannot be seen.
- Claim: daily and per-transaction limits cap what a dishonest quorum could steal (at 18:12). Not at the current settings. On 2026-10-19 the daily limits of the six main tokens read (USDC, DAI, USDT, WETH, HEX, WBTC) and the default limit were each a trillion units, far above what the bridge holds, so the limits do not slow an outflow (daily limits).
- Claim: an owner can freeze the bridge in an emergency (at 8:02, at 18:40). The bridge code this portal reviewed has no separate pause function. The owners could stop transfers only indirectly, for example through limits or a code upgrade, and that would take the same single keys described above.
What could not be checked?
- That the bridge has carried over 1.1 million transfers and never halted since launch (at 17:23), and that a forged message would be spotted at once by validators (at 19:02).
- That about 1,000 validators joined PulseChain in the past month (at 0:00). This portal counted 46,644 active validators on 2026-10-19 (validators) and 47,215 on 2026-10-22, so there was no wave of exits after the detention; validator counts do not show how many independent operators run them.
- Heart’s 2023 post that there are nine bridge validators (at 16:44). The validator contracts list eight; the host himself guesses the ninth is an owner key.
- The loss figures for the Ronin, Harmony, Orbit, Wormhole and Sonne hacks (at 2:35, at 4:11, at 4:57), and the host’s account of exploits on Gnosis Chain lending apps (at 24:20).
What about the PulseX buy-and-burn?
The host says the PLSX buy-and-burn was paused after someone redirected about $20,000 of fees through crafted liquidity pools, and that only approved callers can now trigger it (at 21:53). The chain shows the switch: the contracts’ owner turned anyAuth off on both buy-and-burn contracts on 28 August 2026, ending public triggering, and on 4 November it was still off, so only whitelisted callers can run a conversion. No official explanation of the change was found, so the host’s account of why it happened was not confirmed; nor were the $20,000 and the roughly $400,000 of waiting fees he mentions. Who controls the contract is on PulseX fees.
What is opinion?
The video plays two clips of Heart: one, which the host dates to about five years ago, warns Polygon users about admin keys; in the other he says he hates admin keys but knows of no trustless bridge without one (at 13:10, at 14:52). The host reads this as a changed view, not a contradiction. That is his interpretation, and so is the argument that slow upgrades and Ethereum acting as PulseChain’s testnet make the chain safer. He calls Liberty Swap a backup bridge with more centralisation risk than the official one (at 20:40). That fits this portal’s check of 2026-10-19: Liberty Swap’s PulseChain routers were not verified, they were owned by a single address, and delivery relied on Liberty’s own pools and relayers. The video gives no price targets, though it speculates that the waiting buy-and-burn fees could lift the PLSX price.
Commercial offer: the host closes by promoting his own metal seed-phrase cards (at 27:02). This portal has not reviewed them, and mentioning them is not an endorsement. Never type a recovery phrase into any website, and never let a seller see it.