A community reliant on verification delegated its judgment to a single individual for five years, says Foundation CEO Zach Herbert.
By Zach Herbert|Edited by Cheyenne Ligon1 hr ago4 min readMake preferred on ShareShare this articleCopy linkX (Twitter)LinkedInFacebookEmailMake preferred onHackers have siphoned off approximately $114 million in bitcoin from over 709 addresses by taking advantage of a flaw in Coldcard's firmware that produced wallet seeds lacking adequate randomness. The initial attack resulted in the rapid depletion of about 500 wallets within just 25 minutes. This vulnerability was introduced into the codebase in March 2021 and remained visible and unaddressed in the open-source community for over five years. While many have attempted to explain the incident, the more pressing question is why it went unnoticed for so long, implicating broader issues beyond just a single line of code.
The vulnerability lingered in public view for years
The source code of Coldcard was consistently accessible for examination. The principle of "don't trust, verify" is only effective if qualified individuals actively engage in the review process, and for five years, this was largely neglected. The timeline surrounding the introduction of the bug is particularly noteworthy. In 2020, Coldcard's firmware operated under a GPL open-source license. Following a competitor's announcement of a device based on that GPL code, Coinkite CEO Rodolfo Novak, also known as NVK, publicly expressed regret over selecting the GPL license in a now-deleted tweet. By November, Coldcard transitioned to a new license that included the Commons Clause, which explicitly states that the resulting software is no longer open source. This transition led to a significant rewrite, and the commit from March 2021 that removed the last GPL code coincided with the commit that compromised seed generation.
It is impossible to quantify how much the licensing pressures influenced the pace and extent of this rewrite, though the overhaul pursued legitimate technical objectives as well. The documented facts are clear and alarming: a license change aimed at limiting competition preceded a hurried replacement of established cryptographic code, which ultimately contained the flaw that is now draining wallets. The principles of free and open-source software exist to prevent security from being reliant on any single entity's decisions. Those principles cannot make exceptions for personality.
Zach Herbert is co-founder and CEO of Foundation.
Researchers were discouraged from investigating
A more profound issue arises from the treatment of those who did investigate. In August 2020, researchers from Shift Crypto and Nunchuk revealed a multisig verification flaw in Coldcard. Coinkite admitted to the bug and issued a fix, while NVK, during an appearance on the Citadel Dispatch podcast dismissed the disclosure as "PR terrorism" and questioned the professionalism of researchers lacking a CVE. In 2023, when the WalletScrutiny project noted issues with reproducing older Coldcard versions, the response was to label the project as incompetent or malicious and even hinted at litigation. An independent follow-up later confirmed genuine issues with older builds, concluding that no bad faith was present.
Public attacks on researchers alter the calculus for others considering similar work. Independent assessments are often slow, challenging, and typically unpaid. A researcher weighing the months of effort required against the risk of ridicule, being blacklisted, or facing legal repercussions will likely choose to focus on other projects. While it's impossible to definitively prove that this culture caused the entropy bug to remain unnoticed, it is clear that security relies on individuals being willing to investigate, and the environment surrounding Coldcard discouraged such scrutiny.
Reputation took precedence over evidence
How did a community that champions the motto "don’t trust, verify" arrive at this juncture? Psychological phenomena offer explanations. The illusory truth effect leads people to perceive repeated statements as independently verified, even when they originate from a single source. The halo effect transforms status, confidence, and popular products into assumed technical authority. Year after year, similar claims circulated through podcasts and social media: critics were dismissed as shills, researchers were labeled as terrorists, and competitors were seen as clones. This repetition substituted for the evidence that should have been present, allowing confidence to replace proof.
The outcome can be described as epistemic capture: a community gradually ceding its judgment to a trusted authority until that authority itself becomes the evidence. BTC Sessions host Ben Perrin candidly discussed this dynamic in a recent livestream, admitting he overlooked concerning behavior because he assumed that such confidence was accompanied by superior abilities in creation and security. Much of the industry followed suit. The crisis of confidence now permeating self-custody is the reckoning that has arrived for this oversight.
Prioritize verification for all
The immediate concern for the entire industry in the wake of this exploit should be user safety: disseminate migration guidance and clarify that updating firmware cannot rectify the vulnerability of seeds generated by earlier versions. Beyond this, the industry must undertake internal reviews. Outdated recommendation pages, show notes, and product manuals contain years of unverified claims and necessitate corrections supported by primary sources. Builders and researchers who faced backlash deserve the opportunity to present their findings. Bitcoin media must regain its adversarial stance, subjecting its scrutiny equally to friends, sponsors, and advertisers as it does to outsiders.
Bitcoin was designed on the premise that experts and institutions would ultimately falter, and its solution was to eliminate the need for trust through rigorous verification. The community that developed tools embodying this principle exempted its own most vocal advocates from that scrutiny. The remedy lies in adhering to the foundational principle, applied without bias this time: Do not trust the vendor. Do not trust the vendor's critics. Verify.