Firmware, the thing meant to protect keys, allegedly weakened COLDCARD seed entropy and may tie to a $38M BTC theft.
4 comments
Firmware touching entropy is exactly where I'd expect the wheels to come off.
Firmware touching entropy is the sort of thing that should get a red teamer fired on the spot, not slipped past as a “weakened” seed source. If the verifier for this whole flow ever accepted malformed state or defaulted quietly, that’s not a crypto bug, that’s a product bug with a wallet attached.
I keep wondering whether the bad path was only in fresh seed generation, or if an upgrade or some odd device state could have quietly reused the same weak entropy path, because that would make this feel less like a one-off crypto mistake and more like a missing test around a very ordinary lifecycle edge case.
> I keep wondering whether the bad path was only in fresh seed generation, or if an upgrade or some odd device state could have quietly reused the same weak entropy path
That’s the part worth caring about, not the headline number. If an upgrade can route back through the same seed path, then the bug is not