Yeah, either through negligence or ignorance, ColdCard wasn't doing what it was supposed to be doing. People blame the fact they weren't opensource as one of the reasons. I'm a huge FLOSS supporter, but this exact same thing happened to Debian with SSH in the early 2000s (I should write some longform about that). And the person exploting the bug to drain the wallets is a criminal, not an influencer.

Because of a coffee change the path to utilize the hardware tRNG module was blocked and the software fell back to a shitty python library, but that never should have happened. This should have been written as a fail closed function, and when the hardware module didn't produce the entropy the device would have failed to generate a key. In that case it would have been identified in testing. They didn't write proper validation gates for their code. I'd say it's debatable how criminal it really is to simply guess a random number and sign a transaction on a public blockchain. Nothing was hacked and there was no unauthorized device intrusion. The keys were just easy to find in the number space. Possession of the private key is the only proof of ownership that exists in Bitcoin.

"And the person exploting the bug to drain the wallets is a criminal, not an influencer." True. But they have had a huge influence on how people approach self custody from now, so technically one of the bigger btc influencers operating at the moment