Especially since this was an amateur hour mistake

I have migrated away from CC - 2 years ago. There is no way any heir of mine could have ever used a Coinkite device successfully Their biggest vulnerability is UX & Always has been

Meanwhile in Deeznuts security lab: Bitkey vs Coldcard: Entropy Audit of mcu_rng.c Just finished auditing Bitkey's STM32U5 RNG driver after the Coldcard entropy disaster ($38M stolen, ~500 wallets swept in 25 min). The Coldcard bug in 2 sentences: A C macro #ifdef vs #if footgun caused the firmware to silently link against MicroPython's deterministic Yasmarang PRNG instead of the actual STM32 hardware RNG. Seeds were generated from device UID + timer state. Trivially brute-forceable. 5 years in production, nobody caught it. Bitkey's mcu_rng.c is structurally immune: • Single mcu_rng_get() implementation — reads RNG->DR directly from the hardware peripheral. No software PRNG exists anywhere in the codebase to accidentally link against. • NIST SP800-90B compliant configuration per ST application note AN-4230, with exact magic register values (CR=0x00F00D00, HTCR=0x0000A2B0, NSCR=0x00017CBB). • Runtime assertion verifies the control register is NISTC-compliant after write — catches bus errors, tamper, or glitches. • SECS status register checked on every read. On error: reconfigures, re-checks, ASSERTs (device halts via tamper). Fail-closed, not fail-open like Coldcard's exception handler. • DRBG layer reads 64 bytes from HW RNG (2× security strength to absorb bias), seeds NIST SP800-90A HMAC-DRBG, zeros the entropy buffer. • Seed generation path: crypto_random() → HMAC-DRBG → 32-byte seed → BIP-32 master key. Full pipeline traceable from register to private key. Minor notes (not vulnerabilities): • DRBG is seeded once at boot, never reseeded. Authors acknowledge this violates SP 800-90A but 2⁴⁸ calls is unreachable on a hardware wallet. Defensible. • No public reseed() API for user-supplied dice entropy at the DRBG layer. The lesson: Coldcard didn't fail because of weak cryptography. It failed because of a build-system linking bug that was invisible to code review. Bitkey's architecture has one entropy source, one path, and hardware-level assertions. The Coldcard attack is structurally impossible here. The best fix costs nothing: one build-time assertion that verifies which rng_get() symbol the linker actually resolved.

Hey guise who is going to use their AI agent to find all the podcasts where a certain “crypto expert” acts as his own fluffer about his crypto skills and you know make a supercut??? Asking for a friend

The USB UIDs are deterministic: STM32 UID is factory-burned ROM The 96-bit MCU unique identifier is written by STMicroelectronics at the foundry. It never changes, it's globally unique per chip, and it's readable by any code running on the device. The low 32 bits are what feed the Yasmarang pad value. USB descriptor exposure Coldcard presents itself as a USB HID device on connection. The USB device descriptor includes a serial number string field. Whether Coinkite populated that field with the raw STM32 UID (or a derivative) depends on their firmware — but even if they don't expose it explicitly: 1. ckcc (Coinkite's own Python USB library) reads device metadata 2. USB packet captures or lsusb -v reveal whatever the descriptor exposes 3. Any firmware bug that leaks even part of the UID collapses the UID dimension of the search Supply chain leakage This is the bigger vector. Coinkite (and their manufacturing partners) may log device serial numbers for: - Warranty/RMA tracking - Batch authentication - Quality control databases If an attacker has access to purchase records, shipping manifests, or a leaked Coinkite internal database, they already know which UID maps to which customer — and can target high-value wallets with surgical precision. Practical impact on the attack For the mass sweep (Option B), the attacker doesn't need the UID at all — they enumerate UID × tick space blindly and find matches on-chain. The UID dimension is 2³² ≈ 4.3 billion; combined with ~120k tick values, that's ~2⁴⁸ candidates, which is feasible on modern GPU clusters over weeks. For targeted attacks (Option A), knowing the UID collapses the search to just the SysTick/RTC space — around 2¹⁶ candidates — which takes minutes on a laptop. This is why Block warned Mk4/Q/Mk5 are vulnerable to targeted attacks: once you know the UID of a specific high-value target's device, the 32-bit reseed space (2³²) is trivial. The real question: how did the attacker in July 2026 discover which wallets were vulnerable? They couldn't have known UIDs without either: 1. Running the blind 2⁴⁸ mass sweep 2. Leaking a Coinkite internal database mapping UID → customer/wallet 3. Some other intelligence channel The mass-sweep hypothesis fits the evidence best — 500 wallets hit, BIP-84 only, partial drains of other address types. That's an automated pre-computation against the full search space, not a targeted operation.

GM!

So maybe a unit test could have avoided this??? ‘Yes. And that's what makes this so frustrating — it wasn't a sophisticated exploit of some novel cryptographic weakness. It was a build configuration typo that silently broke security for 5 years, and it would have been caught by trivially simple tests. What would have caught it: 1. Entropy source smoke test: After device init, call the RNG twice, assert the outputs differ. Yasmarang seeded from (fixed_UID, tick) produces deterministic output on cold boot — two rapid calls would have returned identical bytes, failing immediately. 2. Symbol resolution check: Link libngu, then grep the final binary for rng_get and verify it resolves to the hardware-RNG object, not MicroPython's fallback. Coinkite's existing review verified the intended TRNG code was present in the firmware binary — but didn't verify which rng_get() the seed-generation path actually reached across submodules. A one-line linker-map assertion. 3. Reproducibility test: Generate a seed on a real device, then generate another seed after reboot. If they match (or collide more often than probability predicts), something is wrong. This is the absolute bare minimum — a five-minute test that any hardware wallet company should be running on every CI build. 4. Build-time assertion (the hotfix): Coinkite's actual fix was exactly this — exclude the fallback PRNG object and add a build-time symbol check that fails if the intended RNG symbol isn't the one that binds. They didn't even need new security infrastructure; they just needed to verify the linker did what they thought it did. Why it happened anyway: - The macro check (MICROPY_HW_ENABLE_RNG defined vs enabled) is the kind of C-preprocessor footgun that's easy to miss in code review - The fallback is a valid function that links successfully and returns bytes that look random — statistical tests pass, entropy looks fine to casual inspection - Reproducible build verification checked "is the code there?" but not "does the call graph reach it?" - No end-to-end integration test of "generate a seed on real hardware, verify it's not deterministic" Block's advisory explicitly names it: the existing review "confirmed that the intended TRNG implementation was present in the firmware binary, but did not verify which rng_get() implementation the wallet seed-generation path actually reached across the two submodules." The deeper lesson: Hardware wallet security depends on entropy being cryptographically strong at the exact moment a seed is generated. That's a runtime invariant, not a compile-time one. Unit tests and code reviews are necessary but not sufficient — you need hardware-in-the-loop tests that verify the entropy pipeline on real silicon, on every firmware release, ideally in CI. This wasn't a failure of cryptography. It was a failure of operational discipline around something that should be the highest-stakes part of a hardware wallet's firmware. A $38M lesson in why "it compiled and the code looks right" is not a security review.’

This poor entropy situation is the ultimate nightmare in cryptography. It’s literally Rule Number 1: use high randomization sources for entropy, like in the Linux kernel, etc, perhaps NOT EVEN shortly after boot up. I assume this python library has piss poor entropy and someone figured out how to generate your seed. I moved to multisig a long time ago and abandoned my MK3 and all Coinkite devices as they are too complex even for me to deal with. Imagine your heirs trying to figure out that fucking thing to extract your wealth after you get hit by a bus!

LOL. No.

No one should vote, ever

Fuck You Zero shame The natives were Just As Brutal, perhaps more I never killed any Indians. I never bought any slaves Go Fuck Yourself

I used to work in privacy engineering. I once met the creator of PGP, Zimmerman… the only question he asked me about my project was “where does the entropy come from and how long after boot up is the RNG queried for randomness?” That is the majority of security. Entropy. A simple unit or integration test should have covered this issue.

Imagine getting hit by a bus and your family’s BTC is protected by only 40 bits of entropy and they have to move their BTC asap https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

What Fucking Psyop Are You Retards Stuck Inside Of???

I’m pretty sure Coinkite is going out of business The lawsuits will be many and expensive

Probably not a good ideal to have multiple agents. My tokenminning strategy requires the use of rawq to index all code and only use rawq to search code, always use openspec before writing code and TDD for all implementation. I have 2 or 3 opencode sessions going all day and swap back and forth between Claude max account and OpenAI max. My monthly is 400 on tokens, but I was spending even more. It’s all tax deductible at least

These fucking retards will do anything that is not effective or pragmatic to push the narrative. The real solution is abolishing public schools

The Department of War is this largest communist organization outside of China

When did these retards stop wearing masks?