I don't have any reason to believe given the data available that @ODELL or @MartyBent had anything to do with the #Coldcard heist.
This post, if anything, merely reveals that NVK might have had a Freudian slip when telling Odel that the 4.0.0 release was compromised in such a way that he could "steal all your Bitcoin" even without physical access to everyone's coldcards.
In other words, the suspicion that NVK knew about Peter's exploit increases.
Odell and Marty recommended Coldcard for years, in bad judgment, and have owned up to that.
NVK indicated to Matt Odell that he wouldn't share the details of the bug in 4.0.0 because it would allow Odell to "steal all your Bitcoin", according to Odell.
Many claim that Odell was referring to a bug in 4.0.0 that was patched in 4.0.1 which accidentally left the debugging interface enabled (USB serial REPL), which would allow an attacker with physical access to customer coldcards to extract it's secrets.
But Odell wouldn't have physical access to customer coldcards, so NVK must have accidentally been referring to Peter Gray's exploit which also shipped in 4.0.0, which *would* allow anyone with knowledge of the exploit to "steal all your #Bitcoin".
View quoted note β
View quoted note →