Was it all a "Retirement Attack"? (Coldcard Q&A P2)

— The Coldcard RNG bug involved a fundamental design flaw where a security library checked only if a switch existed, not whether it was turned on, causing the device to fall back to weak software-based random number generation instead of the secure hardware chip.

— The debate between malice versus incompetence centers on whether NVK's defensive, dismissive attitude toward bug reports created an environment where critical issues went unaddressed for years.

— The licensing shift from open-source to source-available code may have introduced bugs during refactoring done specifically to enable the license change, rather than for security improvements.

— Extremely poor entropy from the bug likely caused key collisions, explaining years-old Reddit posts about users discovering Bitcoin already on newly generated addresses—possibly funds sent by others who generated the same keys by accident.

— Fake mobile apps for Sparrow and Wasabi wallets are actively stealing Bitcoin from users trying to quickly migrate funds away from compromised hardware wallets.

— The arrogant, dismissive posture toward all criticism—dismissed as "FUD"—prevented legitimate security concerns from receiving proper scrutiny or testing.

— Never assume a desktop-only wallet has a mobile version; verify the official source before downloading any financial app, as scammers are impersonating Sparrow and Wasabi on app stores to steal private keys and funds.

— When moving funds away from a compromised device, pause to double-check the legitimacy of your destination wallet or app despite time pressure—a six-Bitcoin loss to a fake Sparrow mobile app demonstrates the cost of rushing.

— Do not rely solely on app store ratings or presence as proof of legitimacy; use only official project websites and links to confirm you are using the correct tool.