Coldcard’s RNG check asked “does this setting exist” instead of “is it actually on.” It existed, set to zero. Off. Passed anyway.
Five years, seeds generated from chip IDs and clock timers instead of real hardware randomness. That’s how $100M+ walked out the door starting July 30.
The fix just landed. One line. Now it checks the real value, and if hardware randomness isn’t genuinely on, the build refuses to compile.
One character wrong for five years. Took a nine figure theft to catch it.
View quoted note →