(1/N): Here's my first big deep dive it wasn't perfect but it has some interesting tidbits. Part I found most interesting was the fact that the RHR quote implies in March 2021 they were actively probing security. I will do more: # NVK Investigation Report: Statements on Cold Card Security (2018-2026) **Research Focus:** Rodolfo Novak (NVK) statements regarding Cold Card security, entropy, seed generation, and the March 2021 firmware changes that introduced the weak RNG vulnerability. **Context:** In August 2026, security researchers discovered that Cold Card firmware 4.0+ contained a critically weak random number generator that made wallets vulnerable to attacks. This report compiles NVK's public statements about security, the code changes, and entropy to identify potentially misleading claims. --- ## Executive Summary ### The Timeline - **January 8, 2021**: ColdCard firmware 3.2.1 announced license change from GPL to MIT + Commons Clause - **March 1, 2021**: Firmware 4.0 released with **libngu library** replacing GPL Trezor-derived crypto libraries - **Same commit (120 files)**: Changed seed generation implementation - **Shortly after**: Firmware 4.0.1 released to fix a "self-discovered vulnerability" - **August 2026**: Community discovers the RNG vulnerability was far more severe than disclosed ### The Core Issue The libngu library, created by an anonymous/pseudonymous developer (@switck/yasmarang), used a weak pseudo-random number generator (PRNG) instead of properly accessing the hardware's true random number generator (TRNG). This was introduced in the same commit that removed GPL code and changed the license to a custom "Bitcoin only" license. ---