What Bitcoin Did
The Coldcard Disaster: Everything You Need to Know | Lloyd Fournier & Nick Farrow
- A catastrophic Coldcard vulnerability in randomness generation affected approximately 1,200 wallets and nearly 2,000 Bitcoin, exposing years of stacking by users who followed best practices like self-custody.
- The bug stemmed from Coldcard's use of the non-cryptographic Yasmarang RNG layered on top of device entropy, compressing the effective entropy to just 20–40 bits instead of 256 bits required for security.
- An AI model (Grok/Claude/Kimmy-K3) discovered and exploited the vulnerability; multiple human reviewers, security audits, and safeguards all failed to catch five years of weak randomness.
- Dark Skippy is a two-signature attack where a malicious device can leak a seed phrase through transaction nonces, demonstrating that hardware wallets remain trusted third parties regardless of air-gapping or entropy controls.
- Distributed key generation and threshold signatures (Frost) used by Frostsnap eliminate single points of failure in randomness and remove the need for descriptor backups, improving recovery and inheritance.
- The community debate now centers on whether users should roll dice, use multiple devices from different manufacturers, or accept that single-sig custody may require fundamental rethinking.