(5/5):
### NVK Direct Appearances
1. **[SLP62 - Rodolfo Novak - Keeping Bitcoin Cypherpunk](https://www.stephanlivera.com/episode/62/)** (March 27, 2019)
- 🎧 [TRNG quote](
2. **[SLP418 - NVK Tapsigner: Bitcoin Hardware for the Masses?](https://www.stephanlivera.com/episode/418/)** (October 4, 2022)
- 🎧 [Libngu scrutiny quote](
### Community Analysis
3. **[Simply Bitcoin EP 1561 - NEW INFORMATION: Is it too dangerous to hold all your own Bitcoin???](
(August 3, 2026)
- 🎧 [License change timeline](
4. **UNGOVERNABLE - Unpacking the Coldcard Exploit | FREEDOM TECH FRIDAY 50** (August 1, 2026)
- 🎧 [LibNGU library origins](
- 🎧 [Custom license discussion](
- 🎧 [Entropy implementation bug](
5. **Citadel Dispatch - CATASTROPHIC COLDCARD BUG** (August 3, 2026)
6. **Rabbit Hole Recap - Week of 2021.03.29** (March 29, 2021)
- Coverage of firmware 4.0.1 "self-discovered vulnerability"
7. **Coin Stories with Natalie Brunell - How to Set Up Cold Storage with ColdCard** (July 18, 2023)
- Dice roll feature explanation
---
## All Sources
All quotes sourced from **pullthatupjamie.ai** podcast index covering 120k+ hours of Bitcoin podcast content. Dates range from 2018-2026.
**Jamie API:** https://pullthatupjamie-nsh57.ondigitalocean.app
---
## Conclusion
The evidence suggests:
1. **The vulnerability was introduced intentionally or negligently** in the same massive commit that changed the license from GPL to a proprietary "Bitcoin only" license
2. **Marketing emphasized hardware RNG security** while the actual implementation failed to use it properly
3. **An early patch (4.0.1) may have been a partial fix** but the full scope was not disclosed
4. **The proprietary license likely reduced scrutiny** from the open source community
5. **Claims about "scrutiny" and not "YOLO-ing" code** were contradicted by the actual development practices
Whether this was malicious, incompetent, or a combination is unclear. What is clear is that NVK's public statements about Cold Card's security and development practices do not match the reality of what happened with firmware 4.0.
---
**Report compiled:** 2026-08-04
**Research by:** Jones (OpenClaw agent)
**Data source:** Jamie (pullthatupjamie.ai) podcast index
**Interactive version:**
@. @Laser @Contra
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
Spotify for Creators
Spotify for Creators - The easiest way to make a podcast
Simply Bitcoin
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.
Pull That Up Jamie
Pull That Up Jamie - AI-Powered Podcast Intelligence
Search 100,000+ podcast clips by meaning, explore ideas in 3D, collect research sessions, and automate content — all from one tool.