uncleJim21's avatar
uncleJim21 uncleJim21@nostrly.com 13 hours ago
(1/N): Here's my first big deep dive it wasn't perfect but it has some interesting tidbits. Part I found most interesting was the fact that the RHR quote implies in March 2021 they were actively probing security. I will do more: # NVK Investigation Report: Statements on Cold Card Security (2018-2026) **Research Focus:** Rodolfo Novak (NVK) statements regarding Cold Card security, entropy, seed generation, and the March 2021 firmware changes that introduced the weak RNG vulnerability. **Context:** In August 2026, security researchers discovered that Cold Card firmware 4.0+ contained a critically weak random number generator that made wallets vulnerable to attacks. This report compiles NVK's public statements about security, the code changes, and entropy to identify potentially misleading claims. --- ## Executive Summary ### The Timeline - **January 8, 2021**: ColdCard firmware 3.2.1 announced license change from GPL to MIT + Commons Clause - **March 1, 2021**: Firmware 4.0 released with **libngu library** replacing GPL Trezor-derived crypto libraries - **Same commit (120 files)**: Changed seed generation implementation - **Shortly after**: Firmware 4.0.1 released to fix a "self-discovered vulnerability" - **August 2026**: Community discovers the RNG vulnerability was far more severe than disclosed ### The Core Issue The libngu library, created by an anonymous/pseudonymous developer (@switck/yasmarang), used a weak pseudo-random number generator (PRNG) instead of properly accessing the hardware's true random number generator (TRNG). This was introduced in the same commit that removed GPL code and changed the license to a custom "Bitcoin only" license. ---
↑ Parent

Replies (1)

uncleJim21's avatar
uncleJim21 uncleJim21@nostrly.com 13 hours ago
(2/N): ## Key Findings ### 1. The March 2021 License Change & Code Rewrite **From Simply Bitcoin (August 3, 2026):** > "On January 8, 2021, ColdCard firmware 3.2.1 formally announced license change from GPL to MIT CC on files which the GPL doesn't apply. CC is the common clause license addendum which is sourced available instead of completely Open source. On March 1, 2021, the first pass with Lib Ngu commit Remove the GPL Trezor derived crypto libraries and replace them with lib ngu. **That same 120 file commit change seed generation.** Lib ngu was licensed with the novel license for Bitcoin only license." **🎧 [Listen to clip](
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
 | **[Audio](https://audio.pullthatupjamie.ai/4506555/0e0dcaee-4a8d-4a4a-9f57-056504769338.mp3)** **From UNGOVERNABLE Podcast - "Unpacking the Coldcard Exploit" (August 1, 2026):** > "Now that wasn't the only stated purpose. They were also adding in, like, the the new libsec stuff, and and they were working on that for a long time and and so on. But they ended up changing the code the the license of the code to what's called source available instead of open source, and they ended up using a new library. I don't know if it was written by Coldcard or if it was someone else because I don't think the guy who wrote it is is affiliated with the company, but it's called LibNGU." **🎧 [Listen to clip](
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
 | **[Audio](https://audio.pullthatupjamie.ai/352598/483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233.mp3)** **From UNGOVERNABLE Podcast (August 1, 2026):** > "And they released like, the this code change that caused the, you know, the Entropy bug in early twenty twenty one was a direct result of doing this major change to the code base. And it even said in the release notes, like, something along the lines of, like, **the last GPL code was removed.** And so they were able to fully and and officially swap the licenses. And this LibNGU library where it could have been, like, a great library that the whole space wanted to build on, but **they made up a a a software license, something like the something Bitcoin license. Like, it was just a made up software license. It's not it wasn't an open source license.**" **🎧 [Listen to clip](
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
 | **[Audio](https://audio.pullthatupjamie.ai/352598/483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233.mp3)** **Analysis:** The vulnerability was introduced in the same commit that removed GPL code and implemented a custom, non-standard license. This proprietary license may have reduced community scrutiny of the code changes. --- ### 2. NVK's Claims About Hardware RNG Security **From Stephan Livera Podcast SLP62 - "Rodolfo Novak - Keeping Bitcoin Cypherpunk" (March 27, 2019) - NVK speaking:** > "And another nice thing, too, that you get with a secure element is a true random number generator, TRNG. So that's a very powerful random number generator. **Better than that, only the dice.** Yeah, right. Yeah." **🎧 [Listen to clip](
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
 | **[Audio](https://audio.pullthatupjamie.ai/759235/fc87b6c9-7cf7-a7a3-3ceb-816b809c8a03.mp3)** **From Stephan Livera Podcast SLP103 (August 28, 2019) - Charles Guillemet from Ledger explaining TRNGs:** > "Hardware wallets are made with IC, with integrated circuit, and inside the circuit, there is often TRNG, which stands for True Random Number Generator. And this is a specific part of electronics. There are different kinds of design. Often, this is the three oscillators which runs in parallel and they are sampled at a very specific timing. And this very tiny source of entropy is amplified with different means." **🎧 [Full Episode](https://www.stephanlivera.com/episode/103/)**
1 replies ↓
↑