flash on Nostr: ⚡️🚨 NEW - FOUNDATION DEVICES CEO LINKS COLDCARD ENTROPY BUG TO 2021 FIRMWARE ...
⚡️🚨 NEW - FOUNDATION DEVICES CEO LINKS COLDCARD ENTROPY BUG TO 2021 FIRMWARE REWRITE
Foundation Devices CEO Zach Herbert says the Coldcard entropy bug appears to have been introduced during a sweeping March 2021 firmware rewrite that replaced the wallet’s remaining GPL code with new cryptographic libraries.
Herbert outlines a timeline showing Foundation announced Passport in July 2020 using Coldcard’s then-GPL firmware, after which Coinkite moved to a source-available license and launched a major code overhaul.
He stresses the rewrite also pursued technical improvements, including adopting Bitcoin Core’s libsecp256k1, faster cryptographic implementations, and reproducible builds.
Herbert says there is no evidence licensing alone caused the bug, but notes the vulnerability was introduced in the same 120-file commit that removed the remaining GPL code dependencies.
Published at
2026-07-31 06:57:58 UTCEvent JSON
{
"id": "208dadb4b4923310a5e4b6c3fa19f36e81fb60596e6de07bee596421ff154cca",
"pubkey": "4d7842051782e0d3feb034d150adc2b6bae4ee3b49786793bffa468b6f5b96b3",
"created_at": 1785481078,
"kind": 1,
"tags": [
[
"imeta",
"url https://blossom.primal.net/a4a333e5503201f2a7c47472c9873719f0329e59c974723f0c25e19b303c2e9a.jpg",
"m jpeg",
"dim 1170.0x1722.0"
],
[
"imeta",
"url https://blossom.primal.net/9d7a4f4eac8cf4c978baff46df154e11896d4ff7c5176def79af7379779a726e.jpg",
"m jpeg",
"dim 1170.0x1806.0"
],
[
"imeta",
"url https://blossom.primal.net/865888a031141934c1a6fcd5e1ad33ef57c21b0555fcefbe3d52871a5369f568.jpg",
"m jpeg",
"dim 1170.0x1565.0"
],
[
"client",
"Primal iOS"
]
],
"content": "⚡️🚨 NEW - FOUNDATION DEVICES CEO LINKS COLDCARD ENTROPY BUG TO 2021 FIRMWARE REWRITE\n\nFoundation Devices CEO Zach Herbert says the Coldcard entropy bug appears to have been introduced during a sweeping March 2021 firmware rewrite that replaced the wallet’s remaining GPL code with new cryptographic libraries.\n\nHerbert outlines a timeline showing Foundation announced Passport in July 2020 using Coldcard’s then-GPL firmware, after which Coinkite moved to a source-available license and launched a major code overhaul. \n\nHe stresses the rewrite also pursued technical improvements, including adopting Bitcoin Core’s libsecp256k1, faster cryptographic implementations, and reproducible builds.\n\nHerbert says there is no evidence licensing alone caused the bug, but notes the vulnerability was introduced in the same 120-file commit that removed the remaining GPL code dependencies.\nhttps://blossom.primal.net/a4a333e5503201f2a7c47472c9873719f0329e59c974723f0c25e19b303c2e9a.jpg\nhttps://blossom.primal.net/9d7a4f4eac8cf4c978baff46df154e11896d4ff7c5176def79af7379779a726e.jpg\nhttps://blossom.primal.net/865888a031141934c1a6fcd5e1ad33ef57c21b0555fcefbe3d52871a5369f568.jpg",
"sig": "0b1e5322e8d0c2176e7ff75eb3bd838476c98d5404b20b7fc2b4067c4b1e8c827f76569bc89c2ec0763636106e17c7a960e5dc30ed524c201ecb1e698d1efb72"
}
