I CANNOT F*CKING BELIEVE I JUST SAW SOMEONE IN THE INDUSTRY PRAISE COLDCARD. • OVER $100 MILLION STOLEN • DISMISSED CUSTOMER COMPLAINTS OF LOST FUNDS • IGNORED WARNING FROM BITCOIN DEV • THREATENED COMPETITORS • HAD ONE JOB WTAF! STOCKHOLM SYNDROME?

Extremely important correction. @jackmallers there wasn’t a weak entropy fallback. I think it’s important to be precise about what actually happened. The weak PRNG (Yasmarang) wasn’t Coinkite’s fallback—it was MicroPython’s built-in general-purpose RNG, introduced upstream in May 2018. It didn’t become part of Coldcard’s seed generation until the libNgU migration in March 2021. Most language runtimes include a non-cryptographic RNG like this for general purposes such as shuffling, timing jitter, or other non-security-related randomness. By itself, that’s not unusual. Coinkite’s design intent was actually the opposite of having a software fallback: seed generation was supposed to rely exclusively on the hardware TRNG and never use the software RNG. Setting MICROPY_HW_ENABLE_RNG=0 was intended to disable that software path. The issue is that this setting didn’t have the intended effect, and the symbol instead resolved to the runtime’s default implementation. So what people are describing as a “fallback” wasn’t an intentional design decision or a shortcut in the seed-generation logic—it was inherited behavior from the underlying platform that became active because of a link-time error.

TREZOR USER CLAIMS LIFE SAVINGS STOLEN AFTER CLICKING PHISHING SITE IN GOOGLE SPONSORED RESULT A Trezor user says they lost their life savings after clicking what they claim was a sponsored Google search result impersonating Trezor. The phishing page, hosted on Google Sites, allegedly tricked victims into entering their wallet recovery seed. Trezor says it is escalating the report, working to have the site removed, and has reminded users to never enter a wallet backup or seed phrase into any website or online form. Google-sponsored phishing ads remain a persistent attack vector for crypto users.