Rodolfo Novak, also known as NVK, says at least fifteen external reviews examined Coldcard’s hardware, firmware or random number generator before the flaw was discovered, but none detected the issue. Luke Dashjr and James O’Beirne say they privately or publicly reported several weaknesses related to the generator, while Coinkite acknowledges that the corrected firmware has never received a complete independent audit. The bug, introduced in March 2021, enabled an initial attack to drain 1,196 addresses in 41 minutes as part of an estimated theft of about 1,800 BTC. Coldcard users must create a new recovery phrase on an up-to-date device because a firmware update does not secure old phrases; security researchers have already returned 52.37 BTC to victims.
Source: Read the original article
