Coinkite CTO, Peter D. Gray (DocHex), created a nym named "switck" in 2020, then used it to contribute the libngu library that contained the RNG bug.
Crucially, Coinkite publicly thanked switck in their 2021 release notes, and the commits were signed with Peter D. Gray's GPG key, meaning he had full control over the code that went into production.
This looks like he deliberately used the pseudonym to separate his personal identity from the code contribution.
🚨🚨🚨


Coldcard in 2021: 'a [retirement attack] is when the project makers have a "bug" in the entropy generation for later retrieval.'
View quoted note →
View quoted note →
View quoted note →
