{"id":38996,"date":"2026-08-04T11:22:14","date_gmt":"2026-08-04T11:22:14","guid":{"rendered":"https:\/\/www.duck9.com\/blog\/?p=38996"},"modified":"2026-08-04T07:22:32","modified_gmt":"2026-08-04T11:22:32","slug":"a-series-on-g-spot-achilles-heel-for-example","status":"publish","type":"post","link":"https:\/\/www.duck9.com\/blog\/a-series-on-g-spot-achilles-heel-for-example\/","title":{"rendered":"A Series On \u201cG-Spot Achilles Heel\u201d. For example\u2026"},"content":{"rendered":"<div class=\"postie-post\">\n<div>\n<div dir=\"ltr\"><a href=\"https:\/\/x.com\/gegelsmr4\/status\/2083716607977967622?s=43\">https:\/\/x.com\/gegelsmr4\/status\/2083716607977967622?s=43<\/a><\/div>\n<p><br id=\"lineBreakAtBeginningOfSignature\"><\/p>\n<div dir=\"ltr\">\n<div>\n<p style=\"margin: 0px 0px 8px 24.2px;text-indent: -16.3px;font-style: normal;line-height: normal;font-family: system-ui\">\u2022&nbsp; The X post by <a href=\"https:\/\/x.com\/gegelsmr4\"><span>@gegelsmr4<\/span><\/a> claims NVK of Coinkite used Trezor\u2019s GPL code for Coldcard, then switched to Commons Clause licensing after Foundation\u2019s Passport forked it, forcing a 2021 rewrite of crypto\/BIP-39 code that introduced the RNG flaw now draining millions in BTC.<\/p>\n<p style=\"margin: 0px 0px 8px 24.2px;text-indent: -16.3px;font-style: normal;line-height: normal;font-family: system-ui\">\u2022&nbsp; The flaw, from firmware 4.0.0 in March 2021, routed seed generation to MicroPython\u2019s predictable Yasmarang PRNG instead of the STM32 hardware RNG due to a config flag error, reducing entropy to ~40 bits on Mk3 and ~72 on later models.<\/p>\n<p style=\"margin: 0px 0px 8px 24.2px;text-indent: -16.3px;font-style: normal;line-height: normal;font-family: system-ui\">\u2022&nbsp; Foundation\u2019s CEO denied forking Coldcard and called it a false narrative spread by NVK; the bug remained undetected for five years partly due to restricted commercial reuse limiting external audits.\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u200b<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>https:\/\/x.com\/gegelsmr4\/status\/2083716607977967622?s=43 \u2022&nbsp; The X post by @gegelsmr4 claims NVK of Coinkite used Trezor\u2019s GPL code for Coldcard, then switched to Commons Clause licensing after Foundation\u2019s Passport forked it, forcing a 2021 rewrite of crypto\/BIP-39 code that introduced the RNG flaw now draining millions in BTC. \u2022&nbsp; The flaw, from firmware 4.0.0 in March 2021, routed [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-38996","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/posts\/38996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/comments?post=38996"}],"version-history":[{"count":0,"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/posts\/38996\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/media?parent=38996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/categories?post=38996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.duck9.com\/blog\/wp-json\/wp\/v2\/tags?post=38996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}