NVK used open-source code from Trezor to build Coldcard.
Then Foundation forked Coldcard’s code to create Passport.
NVK got mad and switched Coldcard to a Commons Clause license so competitors could no longer use their code.
But because he couldn’t simply relicense the GPL code he took from Trezor, he had to remove and replace it.
And during that rewrite, he introduced the RNG flaw.
That flaw stayed unnoticed for 5 years because nobody had an economic incentive to spend weeks auditing code they were no longer allowed to build on.
His greed caused his downfall.
Do I get this right?
I'm a software engineer with an MSc in Computer Science and 25+ years in the industry. Here's why Coinkite's Coldcard bug isn't an oopsy, it's disqualifying.
Coldcard's seed generation silently fell back to a non-cryptographic "random" number generator for 5 years. Not because crypto is hard, but because Coinkite violated the most basic rule of secure system design: fail closed, never open. When a security-critical path can't be verified, the system refuses to run and throws an error.
It does not quietly substitute something weaker and carry on. This code should have refused to produce a seed. Instead it produced a predictable one and continue silently. ☠️
A company that lets its most critical code path go unverified for half a decade cannot be trusted with your keys.
Throw away your Coldcards. Never buy one again.
Buenas noticias para los holders de Tangem: sus activos siguen totalmente seguros. El caso de Coldcard no afecta a @Tangem .
Su problema está en su firmware propietario y un fallo aleatorio específico de ciertos dispositivos. Tangem funciona con un código completamente independiente y no usa ni comparte nada de esa implementación. Aquí te explicamos por qué:
1. En Tangem, las claves privadas se generan íntegramente dentro del Secure Element de Samsung, certificado EAL6+, usando su generador de números aleatorios (TRNG) integrado en el hardware. La clave se crea dentro del chip y nunca sale de él.
2. Más allá del hardware certificado, la arquitectura de seguridad y el firmware de Tangem han sido auditados de forma independiente por Kudelski Security, Riscure y Cure53 Laboratories, con especial atención a la generación, almacenamiento y uso seguro de claves privadas.
Descubre más sobre cómo Tangem genera entropía:
https://t.co/09mpzZIBLk
Good news for Tangem holders: your assets remain fully secure. The Coldcard case is not relevant to Tangem.
Their issue lies in their proprietary firmware and a random flaw specific to certain devices. Tangem runs on entirely separate code and does not use or share any part of that implementation. Here is why:
1. At Tangem, private keys are generated entirely inside the EAL6+ certified Samsung Secure Element using its built-in hardware True Random Number Generator (TRNG). The key is created inside the chip and never leaves it.
2. Beyond certified hardware, Tangem’s firmware and security architecture have been independently audited by Kudelski Security, Riscure, Cure53 Laboratories, with particular focus on secure private key generation, storage, and usage.
Learn more about how Tangem generates entropy:
https://t.co/cSvC6vJoT2
The Coldcard bug explained in simple terms:
Normally, a hardware wallet generates your 12 word seed phrase using true randomness.
Think of it like a lottery with roughly 340 undecillion possible tickets (that’s a 340 followed by 36 zeros). Every ticket has an equal chance of being picked, making the odds of guessing your seed essentially zero.
The bug didn’t shorten the 2,048-word BIP-39 word list. It changed how the wallet picked the words.
Instead of choosing from the entire lottery, the wallet kept picking from the same tiny corner because the “random” numbers were partially predictable from things like the device’s ID and timing.
Imagine that instead of 340 undecillion possible combinations, your wallet accidentally chose from only a few billion. That’s still a huge number, but astronomically smaller than what Bitcoin’s security is designed to provide.
Your seed phrase still looked completely normal. The words came from the same 2,048-word list. Nothing looked suspicious.
But for an attacker, the search space became millions of trillions of trillions of times smaller.
Absolutely incredible.
In an unprecedented move, South Korea's stock market just collapsed -44% in 40 days, erasing -$2 trillion in market cap.
Now, South Korea's finance ministry has announced plans to "stabilize" the market.
What is happening? Let us explain.
(a thread)
🌞 ¡Sorteo de verano! 🌞
Este verano, @tangem_spanish premia tus vacaciones con un Tangem Ring. ¡Woooow! ¿Cómo? Así de fácil:
✅ Dale like a este post
🔁 Haz RT citando con una foto de tus vacaciones (¡puntos extra si sale tu Tangem, tarjeta o anillo!)
➕ Sigue a @tangem_spanish
Y ojo, que un Tangem Ring en el dedo no es solo un accesorio... es tu bóveda personal, siempre contigo. El regalo que dice "cuido lo que es mío", hasta de vacaciones 💍🔐
Así de simple. En una semana el ganador. Suerte a todos ☀️
#Tangem #TangemRing #Bitcoin
🌞 ¡Sorteo de verano! 🌞
Este verano, @tangem_spanish premia tus vacaciones con un Tangem Ring. ¡Woooow! ¿Cómo? Así de fácil:
✅ Dale like a este post
🔁 Haz RT citando con una foto de tus vacaciones (¡puntos extra si sale tu Tangem, tarjeta o anillo!)
➕ Sigue a @tangem_spanish
Y ojo, que un Tangem Ring en el dedo no es solo un accesorio... es tu bóveda personal, siempre contigo. El regalo que dice "cuido lo que es mío", hasta de vacaciones 💍🔐
Así de simple. En una semana el ganador. Suerte a todos ☀️
#Tangem #TangemRing #Bitcoin
Win a ticket to football's biggest game.
One seat, New York New Jersey Stadium, this Sunday. To enter:
1. Follow @Nexo
2. Like & repost this
Closes in 24 hours. Random draw, winner DM'd – keep yours open, 2 hrs to reply or we redraw.
Could be you. Good luck.
Terms apply.
Giveaway time ⚡⛏️
We’re giving away a @HammerMiner BC01 to 1 lucky winner!
The BC01 is a 1.5TH/s desktop Bitcoin miner that uses only 23W, It is perfect for learning about Bitcoin mining or gifting to a Bitcoiner.
To enter:
✅ Like
✅ Share
✅ Comment #MineYourIndependence
Winner picked Sunday!
Inside tip: We’re giving away one BC01 on each platform X, Facebook, TikTok, and Instagram. Go enter them all for more chances!