MONDAY, AUG03
1. Coldcard entropy collapse, 2. the commit that said runs, 3. Commons Clause fallout, 4. IBM quantum timeline, 5. Hormuz bitcoin sanctions, 6. the AI audit blind spot
From Proto and Bitkey - part of the Bitcoin ecosystem at Block, Inc.
1. entropy
Frank Corva has published a full breakdown of the Coldcard firmware failure that exposed private keys across more than 4,500 bitcoin addresses and cost users roughly $89 million, according to his post on Substack. The root cause was a build configuration error rather than a broken algorithm: Coldcard’s board config set MICROPY_HW_ENABLE_RNG to zero, but the libngu library checked whether that macro was defined rather than whether it was nonzero, so seed generation fell through to a deterministic Yasmarang PRNG seeded from MCU UID, SysTick and RTC values. Corva calls it “one line of bad code” that survived five years without an audit catching it, and urges anyone holding a Mk3 — or any Coldcard that generated its own seed — to move funds immediately and never re-enter the compromised phrase on new hardware. For a freedom-tech audience, the distinction Corva draws is the one that matters: the bitcoin network held, a single vendor’s build toolchain did not, and self-custody is only ever as strong as the weakest link in a device’s supply of randomness.2. forensics
Core Lightning developer ddustin has traced the Coldcard entropy failure to two commits with almost no explanation attached, according to his guest post in bitcoin++’s Insider Edition. One commit changed 1,534 lines of firmware under a five-character message reading only “runs,” a comment-to-code ratio he calls atrociously bad for the most security-critical part of a signing device. His reconstruction: the developer hit a duplicate symbol compiler error while trying to override MicroPython’s RNG functions, then silenced it by setting MICROPY_HW_ENABLE_RNG to zero, which removed the hardware RNG path entirely and left make_new_wallet calling random.bytes() straight into a software generator. “Do not ship code you do not understand,” he writes, extending the criticism to MicroPython for creating the illusion that embedded work requires no understanding of C. For a freedom-tech audience, this is the piece that converts a vendor incident into a reviewable engineering standard: commit hygiene, compiler warnings and review depth are security properties of a hardware wallet, not developer etiquette.3. license
A thread circulating among hardware wallet developers argues that Coinkite’s licensing decisions helped create the conditions for the Coldcard entropy flaw, according to skot’s post on X. Coldcard was built partly on GPL code from Trezor. When Foundation Devices forked Coldcard to create Passport, Coinkite moved to a Commons Clause license, which meant the borrowed GPL code had to be stripped out and rewritten — and the RNG defect entered during that rewrite, then sat undetected for five years. Skot’s framing is about incentives rather than intent: “the best reviewers are people, companies and agents integrating into their own projects,” and a source-viewable license removes the economic reason for anyone to audit deeply. For a freedom-tech audience, the causal chain needs proper forensics before anyone calls it settled, but the underlying question is durable: in security hardware, permissive licensing may function less as generosity toward competitors and more as a subsidy for review labor no vendor can afford to buy.4. quantum
IBM chief executive Arvind Krishna says quantum computing is close to becoming a commercial business rather than a research program, with a measurable contribution to revenue and profit expected by 2028 or 2029, according to Helene Braun in CoinDesk reporting his CNBC interview. “By the end of the 2030s, we are now pretty convinced this is a trillion dollars of value,” Krishna said. IBM has committed $1 billion to a standalone quantum chip foundry, matched by a further $1 billion from the Department of Commerce through the CHIPS incentive program. For a bitcoin audience, two things follow. Quantum machines require entirely different facilities and supply chains from AI data centers, which limits how far miners like MARA, Riot and CleanSpark can extend the diversification playbook into this workload. And while a machine capable of breaking wallet cryptography remains distant, commercialization timelines shorten the runway for migrating to quantum-resistant signatures, turning it from a theoretical debate into a scheduling problem for protocol developers.5. sanctions
The U.S. Treasury has sanctioned two Iranian maritime firms running a bitcoin-settled insurance scheme for vessels transiting the Strait of Hormuz, according to Shaurya Malwa in CoinDesk. OFAC designated the Persian Gulf Marine Insurance Company and HormuzSafe Marine Services Authority, describing the arrangement as extortion rather than coverage because the policies insured against vessel seizures that “are overwhelmingly created by Iran itself.” Treasury said Hormuz Safe was developed by Iran’s Ministry of Economy and accepts bitcoin and other digital assets as part of the regime’s attempts to bypass Western sanctions, with proceeds flowing to the Islamic Revolutionary Guard Corps. Foreign firms paying in bitcoin carry the same secondary sanctions exposure as those paying through banks. For a freedom-tech audience, that equivalence is the point worth sitting with: censorship resistance at the protocol layer does not extend to the counterparty layer, and enforcement has adapted to target the entities on either end of a settlement rather than the rails between them.6. blindspot
The Coldcard entropy flaw was surfaced by one AI model and missed by another, and the team behind the miss has explained why, according to their post on X. Kimi K3, an open-weight model, found the bug during firmware review. A team running Anthropic’s Opus did not: “we hadn’t cloned enough of Coldcard’s submodules. This bug lives between files, and some of those files weren’t on disk.” What the model could see told a self-consistent story, complete with docstrings at the boundary promising “best-quality high entropy TRNG bytes.” The failure was in repository setup, not reasoning. For a freedom-tech audience, this is the most actionable detail of the week for anyone pointing models at security-critical code: completeness of context determines whether an audit means anything, a partial checkout yields confident output about code that does not exist as assembled, and the weakest link in automated auditing right now is the harness rather than the model.Thanks for reading Tangents Daily, the front row for frontier tech. Please share & subscribe: