(1/N): Here's my first big deep dive it wasn't perfect but it has some interesting tidbits. Part I found most interesting was the fact that the RHR quote implies in March 2021 they were actively probi...
(2/N): ## Key Findings
### 1. The March 2021 License Change & Code Rewrite
**From Simply Bitcoin (August 3, 2026):**
> "On January 8, 2021, ColdCard firmware 3.2.1 formally announced license change from GPL to MIT CC on files which the GPL doesn't apply. CC is the common clause license addendum which is sourced available instead of completely Open source. On March 1, 2021, the first pass with Lib Ngu commit Remove the GPL Trezor derived crypto libraries and replace them with lib ngu. **That same 120 file commit change seed generation.** Lib ngu was licensed with the novel license for Bitcoin only license."
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=0e0dcaee-4a8d-4a4a-9f57-056504769338_p132)** | **[Audio](https://audio.pullthatupjamie.ai/4506555/0e0dcaee-4a8d-4a4a-9f57-056504769338.mp3)**
**From UNGOVERNABLE Podcast - "Unpacking the Coldcard Exploit" (August 1, 2026):**
> "Now that wasn't the only stated purpose. They were also adding in, like, the the new libsec stuff, and and they were working on that for a long time and and so on. But they ended up changing the code the the license of the code to what's called source available instead of open source, and they ended up using a new library. I don't know if it was written by Coldcard or if it was someone else because I don't think the guy who wrote it is is affiliated with the company, but it's called LibNGU."
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233_p58)** | **[Audio](https://audio.pullthatupjamie.ai/352598/483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233.mp3)**
**From UNGOVERNABLE Podcast (August 1, 2026):**
> "And they released like, the this code change that caused the, you know, the Entropy bug in early twenty twenty one was a direct result of doing this major change to the code base. And it even said in the release notes, like, something along the lines of, like, **the last GPL code was removed.** And so they were able to fully and and officially swap the licenses. And this LibNGU library where it could have been, like, a great library that the whole space wanted to build on, but **they made up a a a software license, something like the something Bitcoin license. Like, it was just a made up software license. It's not it wasn't an open source license.**"
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233_p70)** | **[Audio](https://audio.pullthatupjamie.ai/352598/483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233.mp3)**
**Analysis:** The vulnerability was introduced in the same commit that removed GPL code and implemented a custom, non-standard license. This proprietary license may have reduced community scrutiny of the code changes.
---
### 2. NVK's Claims About Hardware RNG Security
**From Stephan Livera Podcast SLP62 - "Rodolfo Novak - Keeping Bitcoin Cypherpunk" (March 27, 2019) - NVK speaking:**
> "And another nice thing, too, that you get with a secure element is a true random number generator, TRNG. So that's a very powerful random number generator. **Better than that, only the dice.** Yeah, right. Yeah."
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=fc87b6c9-7cf7-a7a3-3ceb-816b809c8a03_p137)** | **[Audio](https://audio.pullthatupjamie.ai/759235/fc87b6c9-7cf7-a7a3-3ceb-816b809c8a03.mp3)**
**From Stephan Livera Podcast SLP103 (August 28, 2019) - Charles Guillemet from Ledger explaining TRNGs:**
> "Hardware wallets are made with IC, with integrated circuit, and inside the circuit, there is often TRNG, which stands for True Random Number Generator. And this is a specific part of electronics. There are different kinds of design. Often, this is the three oscillators which runs in parallel and they are sampled at a very specific timing. And this very tiny source of entropy is amplified with different means."
**🎧 [Full Episode](https://www.stephanlivera.com/episode/103/)**
### 1. The March 2021 License Change & Code Rewrite
**From Simply Bitcoin (August 3, 2026):**
> "On January 8, 2021, ColdCard firmware 3.2.1 formally announced license change from GPL to MIT CC on files which the GPL doesn't apply. CC is the common clause license addendum which is sourced available instead of completely Open source. On March 1, 2021, the first pass with Lib Ngu commit Remove the GPL Trezor derived crypto libraries and replace them with lib ngu. **That same 120 file commit change seed generation.** Lib ngu was licensed with the novel license for Bitcoin only license."
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=0e0dcaee-4a8d-4a4a-9f57-056504769338_p132)** | **[Audio](https://audio.pullthatupjamie.ai/4506555/0e0dcaee-4a8d-4a4a-9f57-056504769338.mp3)**
**From UNGOVERNABLE Podcast - "Unpacking the Coldcard Exploit" (August 1, 2026):**
> "Now that wasn't the only stated purpose. They were also adding in, like, the the new libsec stuff, and and they were working on that for a long time and and so on. But they ended up changing the code the the license of the code to what's called source available instead of open source, and they ended up using a new library. I don't know if it was written by Coldcard or if it was someone else because I don't think the guy who wrote it is is affiliated with the company, but it's called LibNGU."
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233_p58)** | **[Audio](https://audio.pullthatupjamie.ai/352598/483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233.mp3)**
**From UNGOVERNABLE Podcast (August 1, 2026):**
> "And they released like, the this code change that caused the, you know, the Entropy bug in early twenty twenty one was a direct result of doing this major change to the code base. And it even said in the release notes, like, something along the lines of, like, **the last GPL code was removed.** And so they were able to fully and and officially swap the licenses. And this LibNGU library where it could have been, like, a great library that the whole space wanted to build on, but **they made up a a a software license, something like the something Bitcoin license. Like, it was just a made up software license. It's not it wasn't an open source license.**"
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233_p70)** | **[Audio](https://audio.pullthatupjamie.ai/352598/483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233.mp3)**
**Analysis:** The vulnerability was introduced in the same commit that removed GPL code and implemented a custom, non-standard license. This proprietary license may have reduced community scrutiny of the code changes.
---
### 2. NVK's Claims About Hardware RNG Security
**From Stephan Livera Podcast SLP62 - "Rodolfo Novak - Keeping Bitcoin Cypherpunk" (March 27, 2019) - NVK speaking:**
> "And another nice thing, too, that you get with a secure element is a true random number generator, TRNG. So that's a very powerful random number generator. **Better than that, only the dice.** Yeah, right. Yeah."
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=fc87b6c9-7cf7-a7a3-3ceb-816b809c8a03_p137)** | **[Audio](https://audio.pullthatupjamie.ai/759235/fc87b6c9-7cf7-a7a3-3ceb-816b809c8a03.mp3)**
**From Stephan Livera Podcast SLP103 (August 28, 2019) - Charles Guillemet from Ledger explaining TRNGs:**
> "Hardware wallets are made with IC, with integrated circuit, and inside the circuit, there is often TRNG, which stands for True Random Number Generator. And this is a specific part of electronics. There are different kinds of design. Often, this is the three oscillators which runs in parallel and they are sampled at a very specific timing. And this very tiny source of entropy is amplified with different means."
**🎧 [Full Episode](https://www.stephanlivera.com/episode/103/)**
1