• The X post by @gegelsmr4 claims NVK of Coinkite used Trezor’s GPL code for Coldcard, then switched to Commons Clause licensing after Foundation’s Passport forked it, forcing a 2021 rewrite of crypto/BIP-39 code that introduced the RNG flaw now draining millions in BTC.
• The flaw, from firmware 4.0.0 in March 2021, routed seed generation to MicroPython’s predictable Yasmarang PRNG instead of the STM32 hardware RNG due to a config flag error, reducing entropy to ~40 bits on Mk3 and ~72 on later models.
• Foundation’s CEO denied forking Coldcard and called it a false narrative spread by NVK; the bug remained undetected for five years partly due to restricted commercial reuse limiting external audits.
Duck9 is a credit score prep program that is like a Kaplan or Princeton Review test preparation service. We don't teach beating the SAT, but we do get you to a higher credit FICO score using secret methods that have gotten us on TV, Congress and newspaper articles. Say hi or check out some of our free resources before you pay for a thing. You can also text the CEO:
