Laser

"A retirement attack is when the project makers could have a 'bug' in the entropy generation for later retrieval." -Coldkite

#Coldcard #Coinkite

This is well done. #Coldcard #Coinkite

My #Coldcard findings: based on public data, there is a high probability that the #Coinkite CTO intentionally planted an entropy vulnerability into the firmware, and there is good reason to believe that the CEO knew about it at the time the exploit was distributed to customers.

Why I believe #Coinkite defrauded #Coldcard customers. 🤫

1. CTO authored entropy vulnerability while pretending to be an external contributor. Coinkite props up CTO alias as an external dev in comms.

2. CEO shared details with Odell that could only apply to the entropy vulnerability that had just gone out to customers. Odell then bragged about his self custody guide, implicating CEO.

3. CTO always used the ifndef guard correctly in the Coldcard firmware, literally dozens of times, but shipped a singular misuse of the function under his alias, thus allowing customer funds to be swept remotely.

4. In the same release the entropy vulnerability was distributed, the CTO had enabled the interactive debugger used to verify code changes on live Coldcard devices, which would plainly reveal that the false/pseudo Yasmarang entropy had been selected.

We know that #Coinkite CTO Peter Gray was using the interactive debugger at the time that he had introduced the entropy vulnerability to the #Coldcard source via an alias.

In 4.0.0, the major version containing the entropy vulnerability (ifndef fallback to false/pseudo entropy), Peter explicitly enabled the interactive debugger in order to debug integration of libngu, the library he authored under an alias which contained the entropy vulnerability.

This is so that Peter could step through the execution environment to examine variables and control flow at each stage of the #Coldcard firmware on a live device before integrating the changes and distributing them to customers.

The fact that Yasmarang, a false/pseudo entropy, was ultimately selected for use would be glaring and front center in the code path that Peter was verifying using the interactive debugger.

The idea that Peter was too stupid to use Python, which he had been using for decades, and too reckless to verify the implementation, even as he clearly was using the interactive debugger to verify his own libngu library, is frankly absurd.

They think we are dumb.

https://github.com/Coldcard/firmware/blame/75addaefcb5b1861e1c8986195a448ac3f94a303/stm32/COLDCARD/vcp_lockdown.c#L14

#Coinkite CTO, pretending to be an external contributor, switches out Coldcard's strong entropy implementation for false/pseudo entropy, thus allowing future wallets to be remotely swept.

Plebs: "It's an honest mistake. Python is hard! These things happen."

Peter Gray had an extensive debugging setup for the #Coldcard development process. He even left the USB REPL enabled only days before the vulnerability was shipped, meaning he had been inside the runtime inspecting the state of variables within #Coldcard during their big entropy changes.

Nobody makes the massive entropy changes they did without stepping into an interactive debugger (or automated testing) to see if things are in tact or broken. And guess what? Peter did.

He left the interactive debugger enabled at the time that he shipped the entropy vulnerability, meaning: he must have been inspecting the entropy implementation, and saw that Yasmarang was "defaulted" to as a result of the innocuous "bug" that had been introduced.

#Bitcoin

Wow. "Everything you need to know about the #Coldcard disaster" fails to mention that:

1. #Coinkite founder and CTO Peter Gray authored the entropy vulnerability using an alias which he pretended was an external contributor, even carrying out public dialogs with himself via his CTO handle.

2. Then Peter integrates the vulnerability he himself wrote into the Coldcard source code under his official capacity as CTO, then proceeded to distribute it to customer devices.

Is this not the MOST IMPORTANT thing people need to know about the #Coldcard disaster?

Unbelievable. 🤡🤡🤡

Didn't the #Coinkite CTO sneak an entropy vulnerability into the #Coldcard firmware?

The coordinated amnesia across the #Bitcoin space surrounding #Coinkite CTO's authoring of the #Coldcard exploit under an alias is the largest testament to broad intelligence involvement that we have.

What is with all the universal pussyfooting in the #Bitcoin space around the reality that #Coinkite founder and CTO Peter Gray authored the entropy vulnerability using an alias then integrated it into the #Coldcard codebase and distributed it to customers under his official capacity as CTO?

[Help Requested]

Please circulate this post on Twitter/X.

It makes the difference whether or not NVK will be considered for having past knowledge in Coldcard vulnerability.

The discussion there is not scrutinizing #Coinkite's clam that NVK was referring to the USB REPL flag, even though that is impossible given the language Odell used on Rabbit Hole Recap.

Please quote retweet JP_Technology's clip so that folks can hear for themselves: https://x.com/JP_Technology/status/2085031289141232016

Thank you. 🙏

Don't think NVK had knowledge of the entropy vulnerability at the time of it's distribution?

Drop the quoted post directly into your available AIs and post the response here.

Here is Grok's response:

"Yes. The three points are correct and decisive.

Coinkite’s own disclosure history confirms the USB REPL flag existed only in the never-distributed 4.0.0 internal build and was fixed before any public 4.x release.

That bug required physical USB access to an unlocked device. It could not enable remote theft of all affected wallets, and dice entropy is irrelevant to it.

Odell’s contemporaneous statements (remote fund theft risk if details leaked + dice rollers safe) match only the entropy/RNG regression introduced in the same March 2021 libNgU migration window. That regression shipped publicly in 4.0.1+ and remained until the 2026 emergency patches.

NVK described the entropy issue to Odell."

#Bitcoin #Coincard #Coinkite

The public record now supports the finding that #Coinkite defrauded their customers.

1. The CTO authored and GPG-signed the vulnerable libngu code under the deliberately constructed switck alias, operated it publicly on GitHub and X, engaged in self-conversations between the identities, and had the company thank the alias as an independent contributor.

2. The CEO privately described a critical flaw matching that exact remote-theft vulnerability at the time the affected firmware was distributed to customers.

3. The company continued selling and marketing Coldcards as highly secure while the issue remained undisclosed for five years, during which customers generated weak seeds and later lost substantial funds.

These facts establish material misrepresentation, knowledge of falsity, intent to induce reliance through the false appearance of independent secure development, and resulting damage.