Bitcoin security experts aren’t surprised by Coldcard’s issues In 2019, researchers @sedited_ & @KasparEtter disclosed a severe bug in the Coldcard hardware wallet They could have exploited the bug, but chose to send all the information + the fix to Rodolfo Instead of paying them for their work, Rodolfo downlpayed the severity of the bug as “low risk” and only sent merchandise to the two researchers (mugs & Coldcards). In the security world, Coldcard has always had a bad reputation for not offering bounties in exchange for responsible disclosures So when teenage prodigy hacker @saleemrash1d found a vulnerability, he disclosed it to Trezor, Ledger, BitBox, and every hardware wallet company except for Coldcard Why? Because he knew that Coldcard doesn’t pay. So Coldcard had to learn about the vulnerability after their competitors had already patched it. This is as a recurring theme with Coldcard: they constantly resorted to downplaying the severity of security disclosures, paid much less money for bounties than their competitors, did a lot of dishonest marketing which emphasized that being “Bitcoin-only” makes their devices more secure (they used BIP44 too for testnet).

Also huge thank you to @Vladcostea who’s honest inquiry tipped me off to this at the time years ago and prompted me to actually do the hard work and understand the technical nuances of hww security models. Gracias 🙏

In early 2022 after Coldcard decided to ditch the open source GPL license for Commons Clause, I called out NVK. Francis Pouliot came to his friend’s defense by arguing that I’m “gaslighting” with “esoteric nerd talk”. That’s when I lost all respect for Francis and I blocked him. I don’t care what else he does in the space, this man is not intellectually honest and chooses loyalty over truth. The reason I am posting this is simple: if more people called out Rodolfo (NVK) for his reckless decision to change licenses, the Coldcard firmware would have had more scrutiny from white hat hackers. Today’s incident could have been avoided if the people close to NVK had the balls to call him out on his bullshit.

I wish Matt Odell’s old account was still up so I could show you all how he deflected my “Coldcard is not open source anymore” claim with “oh look, you used to work for Trezor” as if any of that invalidates Coldcard’s issues That’s when I blocked Matt for being a dishonest loyalist. Later I found out that his VC firm Ten31 is an investor in Coinkite, so I cannot expect any objectivity from him.

I will post a blog article later today. But TLDR: - it's worse than you think. - Mk4, MK5, Q will get drained. - multisig of Coldcard devices, or multisig where Coldcard signatures are sufficient to reach the threshold are at risk. - MINISCRIPT WALLETS are ALSO at risk, if you use Coldcards where only CC signatures are enough to spend, or to recover. No need to panic, but time to plan a move to new mnemonics/devices in the next few days, if you used a Coldcard in your setup.

4 years ago, I tried to make Coldcard honest I was greeted with hostility and insults If NVK merged my pull request, he would have signaled to his customers that he prefers profits over standard security practices in the space If he reverted back to the GPL license, there would have been incentives to find the random number generator issue before today’s incident

In early 2022 after Coldcard decided to ditch the open source GPL license for Commons Clause, I called out NVK. Francis Pouliot came to his friend’s defense by arguing that I’m “gaslighting” with “esoteric nerd talk”. That’s when I lost all respect for Francis and I blocked him. I don’t care what else he does in the space, this man is not intellectually honest and chooses loyalty over truth. The reason I am posting this is simple: if more people called out Rodolfo (NVK) for his reckless decision to change licenses, the Coldcard firmware would have had more scrutiny from white hat hackers. Today’s incident could have been avoided if the people close to NVK had the balls to call him out on his bullshit.

@Vladcostea Credit where credit is due 😉 You were a dick and the only anti-Coldcard person in my feed during this time, and what's more, right since the beginning on this. I could've lost all my 0.1btc and keep being pro-Coldcard if I wouldn't look into it because of you.

@Vladcostea @stutxo The only person who I knew who wasn't bought by Coldcard was Vlad. They even paid me and send free products for years lol. And I did some of my own investigation into the matter and it happened that majority of what @Vladcostea said was true, and that nvk straight lies.

Will interview @TheDesertLynx in 2 hours! He’s one of the very few people around who actually lives on crypto full time and he’s an advocate of inconvenience: using ATMs, buying gift cards, whatever it takes to avoid banks Join us in the live chat (link below) 👇🏻

@Dieter75 @HonkHoganBTC @francispouliot_ @brian_trollz @BitcoinErrorLog @ErikVoorhees @ODELL I'd be happy if Rodolfo merged my GitHub pull request to replace "Open Source" with "Source Available". Honesty gets restored, everyone is happy, we can all be friends again. He deleted it and locked the repo: