(4/N): **From TFTC Podcast (April 1, 2021):** > "Not a hack, but they had a vulnerability that was self-discovered. So they have a new firmware version, 4.0.1, or is it 0.01? 4.0.1. Yeah. You messed up." **Analysis:** Shortly after firmware 4.0 was released, a "self-discovered vulnerability" was patched in 4.0.1, but the details were kept secret "for the sake of users." This may have been an early discovery of the RNG issue, but it was downplayed and never fully disclosed until the community discovered it independently in August 2026. --- ### 5. Dice Roll Feature as Security Theater? **From Coin Stories with Natalie Brunell (July 18, 2023) - BTC Sessions explaining Cold Card:** > "If you don't trust NVK and CoinKite, that they're really generating numbers randomly in this device and that they've injected something, even though you can audit what the code is doing. **If you don't trust the random number generator, you can actually roll dice and add more randomness to the creation of your 24 words.** Wow. Yeah, that's probably too technical and over my head. So we'll just do the 24 word defaults." **Analysis:** Cold Card marketed a dice-roll feature for users who didn't trust the internal RNG. In hindsight, this feature may have served as security theater - acknowledging RNG trust issues while the default path used a fundamentally broken implementation. --- ### 6. Reproducible Builds & Open Source Claims **From Citadel Dispatch (September 7, 2021):** > "So the main topic of the conversation today is building our software from source. Recently, NVK, who has been on the show many times, **launched a new project, Bitcoinbinary.org, to basically try and normalize the process of verifying that source code matches the binaries that people are installing**, the actual install files that people install." **From Ungovernable Misfits (September 4, 2024) - Zach Herbert discussing reproducible builds:** > "And then we make sure that we give them instructions to get it to match or update our process. And I think why a lot of people don't like them is because you get called out for it if it doesn't, if it doesn't match, if it's not reproducible. **And you can imagine like MVK getting pretty pissed off that, you know, they're saying he failed the reproducibility and he's saying, well, they just didn't follow my instructions.** I think the humble approach is, well, then our instructions weren't good enough, right? Or there was something wrong with our instructions." **From Citadel Dispatch (April 16, 2025) - Rob Hamilton referencing NVK's license:** > "And for us, we put a lot of time and effort into it. And just to be frank, for today, if we did open source it, it'd probably be closer to an MIT CC license. **The NVK the NVK license.** Yeah. **The NVK license.**" **Analysis:** NVK promoted reproducible builds and code verification through Bitcoinbinary.org, yet Cold Card's own source-available (not open source) license and reproducibility issues made independent verification difficult. The "NVK license" became a reference point for other projects considering similar restrictions. --- ### 7. Recent Community Response (August 2026) **From Citadel Dispatch - "CATASTROPHIC COLDCARD BUG" (August 3, 2026):** > "**NVK rightfully deserves a lot of shit for his license change.**" **Analysis:** The Bitcoin community's response has been strongly critical, with many pointing to the license change as enabling reduced scrutiny that may have allowed the RNG bug to persist undetected for years. --- ## Red Flags in Hindsight 1. **Massive single commit** (120 files) changed both licensing AND seed generation 2. **Custom "Bitcoin only" license** reduced community participation and review 3. **Anonymous library author** (@switck/yasmarang) with no known affiliation to Coinkite 4. **Quick 4.0.1 patch** with undisclosed vulnerability details 5. **Years of delay** before vulnerability was publicly disclosed by community researchers 6. **Marketing emphasis on TRNG security** while actual implementation used weak PRNG 7. **Dice roll feature** acknowledged RNG trust issues but didn't fix the default path --- ## Search Terms Used High-priority terms searched: - libngu / LibNgU - switck / @switck / yasmarang - ngu.random / ngu.random.bytes - hardware RNG / true RNG / TRNG - seed generation + firmware / rewrite - entropy + Coldcard - GPL + remove / replace - firmware 4.0 / v4.0.0 - reproducible builds - Trezor crypto / Trezor-derived --- ## Key Episodes Referenced (with Links)

wtf: "**From Rabbit Hole Recap (Week of March 29, 2021):** > "Not a hack, but they had a vulnerability that was self-discovered. So they have a new firmware version, 4.0.1, or is it 0.01? 4.0.1. Yeah. You messed up... **And you're only vulnerable if you had already upgraded to 4.0.0, which was their big upgrade. If it's not, then you're not vulnerable. I have no idea what this vulnerability is. NVK wouldn't tell me what it was for the sake of the users because he's afraid I was going to steal all your Bitcoin.** But yeah, upgrade."