Stop the FUD against Bitcoin, Self-Custody and all other hard wallets. This was ALL on Coldcard. It was mistake by them that should have never happened if they even trivially reviewed/tested ONCE their code before publishing! HW like Trezor and Ledger are

I see a lot of people here wondering what to do at this point and whether trusting Coinkite moving forward is possible. Here is my take:

Unforgivable sin #1

This bug was a integration mistake, not a complex crypto flaw. It should have been easily caught by basic build time assertions. It's a huge oversight and unforgivable for a company whose very existence is based on security.

Unforgivable sin #2

The most damning issue here is that Coinkite, a company that primary and ONLY premise is the development of a secure HARDWARE device does not test the output of that hardware at runtime. The fact that they didn't check that the output produced by the seed generator passed through standard randomness battery tests is wild! They would have instantly noticed that the outputs were coming from a deterministic PRNG if they bothered to test.

Unforgivable sin #3

At the end of the day, a hardware wallet only has one job. Generate true randomness. All coldcard wallets failed at this. Yes, you could say the bug is hard to spot, especially when doing static code analysis. The code is open source and has been subject to audits, but integration tests should have discovered this flaw before the affected firmware was ever published.

The theory that this bug was discovered by AI is also a side track and completely irrelevant. This was not a complex vulnerability.

https://np.reddit.com/r/coldcard/comments/1vcfugv/coinkite_is_done_for_here_is_why/

Edit (more details):

ColdCard migrated to a different elliptic curve library in 2021. That library had a fallback to a software PRNG. The code checked if a specifc macro was defined (MICROPY_HW_ENABLE_RNG).

If the macro was defined but set to a value of 1, the library would use it's generic STM32 driver for RNG.

If the macro was not defined, the compiler would throw an error, forcing devs to fix it.

In this case, the macro was defined but set to a value of 0. That bypassed the compiler error but resulted in the library using it's fallback software RNG instead.

Coinkite erroneously assumed setting the value to 0 would tell the library to disable it's internal RNG driver and let the custom board-level RNG driver handle all entropy calls across the entire system.

In the hot fix Coinkite has a script that checks the generated symbol table and asserts that whether the rng_get() symbol originates from the coldcard board directory and throws an error otherwise. There are several other ways they could accomplish the same thing.

https://np.reddit.com/r/coldcard/comments/1vcfugv/coinkite_is_done_for_here_is_why/p11ge3v/