It gets worse the more you know. Leaning towards an inside job now rather than an accidental vulnerability.

Yes. Confirmed by at least one honest dev. Working to validate the claims independently. Severely underestimated this as simple negligence. It's fucking malice at this point.

From James Obeirne on x “I haven't told the full story yet, but I came to the same conclusion back in May 2025 when I started doing an audit of `coldcard/firmware`. I wanted to figure out conclusively where the CC RNG was getting sourced from, and found that it backed up to some shady library ca...

Verified by GPG and phone number now. Timeline is extremely sketchy. nostr:nevent1qqsqqqq5ax5fgwkxkh8s5t446n2susgmg6hwa86ymy46la86jyj7kpszypj2eaq9t75zd09ts3t7ynhclwn5jz4mremdh2m24p6j55aqadx55576wxc

Looks like nostr:nprofile1qyxhwumn8ghj7mn0wvhxcmmvqywhwumn8ghj7mn0wd68yttsw43zuam9d3kx7unyv4ezumn9wsqzqzgz2jqp5l5w2zzmqtn3zc30phap4p2sxjf67fr25s40pr67f5kl34qnc2 confirmed it on twitter with PGP

Why is he/her/whatever using 2 different GitHub accounts?