Coinkite Wrote a Guard Against This Exact Failure. It Was One Keyword Wrong.
A five-year-old entropy bug, a licensing fight with a competitor, and a company pointing at AI for finding what its own review process didn’t.
Somewhere in Coldcard’s firmware sits a line that exists for one reason: to stop the device from ever shipping a seed generated without real hardware randomness. It reads #ifndef MICROPY_HW_ENABLE_RNG, followed by #error "get a HW TRNG plz". Someone at Coinkite wrote that specifically to catch this failure before it could happen.
It didn’t work. #ifndef asks one question: does this setting exist? It doesn't ask what the setting says. Coldcard's board configuration defines MICROPY_HW_ENABLE_RNG as zero, disabling the hardware generator. Zero still counts as defined. The guard saw the setting existed, stayed quiet, and the firmware fell through to a software pseudorandom generator instead.
The comment sitting directly above the seed-generation function read “best-quality high entropy TRNG bytes” the entire time. Every layer that was supposed to catch this reported success.
The commit that started it
The change entered the codebase on March 1, 2021. It shipped publicly in firmware 4.0.0 on March 17, 2021. It is the same commit that stripped out the cryptographic libraries Coldcard had originally inherited from Trezor.
The context matters. Coldcard was GPL-licensed until a competitor, Foundation, built its Passport hardware wallet on that code. Coinkite’s founder, Rodolfo Novak, said publicly at the time that he regretted the license choice. Coinkite then relicensed under MIT plus Commons Clause, blocking anyone from building a competing commercial product on the code, and rewrote the crypto libraries from scratch. Foundation has published a timeline placing the entropy bug inside that same 120-file commit. Foundation is a direct competitor with an obvious interest in that framing. The commit dates are public regardless.
The license change had a second cost nobody priced at the time. Source-available is not open source. Under Commons Clause, other developers can read the code but cannot legally build on it, which quietly thins out the number of people with any professional reason to read it closely. Five years is a long time for a seed-generation routine to go unexamined in a product whose entire pitch was that it protected your keys better than anyone else’s.
The advisory that made it worse
On July 30, with the attack already running, Coinkite’s first public advisory scoped the vulnerability to Mk3 devices and stated that Mk4, Q, and Mk5 were not affected based on early analysis. That was wrong. The advisory had to be expanded the next day to cover every model. In the gap between those two statements, owners of newer devices were reading an official company statement telling them to stand down while their funds remained at risk.
Get BitBrainers’s stories in your inbox
Join Medium for free to get updates from this writer.
One prominent developer publicly told Novak he had spread misinformation and said someone he knew personally had been drained from a Mk4 seed within hours of that first advisory. Samson Mow ended up advising people to migrate off every Coldcard model regardless of version, because the vendor’s own guidance could no longer be trusted at face value.
Blaming the tool that found it
Novak’s public framing since has been that the company has to assume the bug was found using AI, since the code has been sitting in public view since 2021. Coinkite also disclosed that it ran a leading AI model over its own codebase weeks before the attack, and that review missed the bug too.
Read plainly: a company whose product lost roughly $88 million is pointing at the tool that eventually found the flaw, rather than at the five years in which its own process did not. The tool missing it and the company missing it are the same fact stated twice.
Three days later
Coinkite has emailed every customer address it could reach through its store and newsletter systems, in batches, since Friday. Canadian law requires the company to retain business records for eight years, so names and addresses were blanked while the email field was preserved. That is a correctly taken step.
What has not happened: no compensation fund, no formal position on liability, and no answer for anyone whose Coldcard was purchased through a channel the company cannot reach.
What this actually proves
Nobody is owed bug-free code. Software has bugs, hardware wallets are not exempt, and five years of quiet doesn’t mean five years of safety. It means five years of nobody spending the effort to look.
What people were owed was a company that treated its own seed generation as the single most safety-critical function it shipped, didn’t narrow the pool of people who could review it to protect a commercial moat, and got the scope right on day one when it mattered most for the people still holding funds.
It did none of those three things. That is not a story about complexity or bad luck. It is a story about what a company chose to protect.
This is market commentary, not financial advice. BitBrainers holds Bitcoin and other digital assets. Nothing here is a recommendation to buy or sell any asset. Do your own research.
