How a Bug in Coldcard’s Code Went Unnoticed for Years, Leading to $100 Million in Hacked Funds

How a bug in Coldcard’s code went unnoticed for years, leading to $100 million in hacked funds

Crypto’s favorite maxim, “don’t trust, verify” wasn’t followed in the case of Coldcard’s code.

Coldcard’s Entropy Bug Exposed a Hidden Weakness in Hardware Wallet Security

A 2021 firmware bug collapsed Coldcard's seed entropy from 128 bits to 40. Five years later, an attacker drained $89M in Bitcoin across 4,585

Hardware wallets shouldn't be a source of randomness. Period. Dice only. \ stacker news

Post coldcard fiasco, the new standard should be: hardware wallets never generate seed phrases from their own randomness, however sourced, but only accept user generated entropy. Hardware wallet that generates its own 24 word seedphrase is a Red Flag.

The Coldcard hack proves reputation is not a security model

Nobody can measure how much licensing pressure shaped the scope or speed of that rewrite, and the overhaul also pursued legitimate technical goals. The documented facts are narrower and still damning: a license change made to restrict competitors preceded a rushed replacement of battle-tested cryptographic code, and the replacement contained the flaw now draining wallets. Free and open-source software principles exist precisely to keep security …