The Coldcard hardware wallet was hacked, resulting in the loss of over 100 million dollars worth of bitcoin, exceeding 1,500 BTC. A critical entropy flaw remained present in publicly available firmware for approximately five years before being exploited, illustrating the limitations of source availability alone. The libngu library at the center of this vulnerability received minimal external scrutiny with only 7 stars and fewer than 20 forks on GitHub. The incident demonstrates that the open source model creates the possibility of verification, but actual security depends on economic incentives, skills, and real attention from reviewers. A volunteer initiative called Bitcoin Red Team subsequently used artificial intelligence to audit hundreds of Bitcoin repositories and found thousands of issues, including dozens classified as critical or high severity.
Source: Read the original article
