(2/N): ## Key Findings
### 1. The March 2021 License Change & Code Rewrite
**From Simply Bitcoin (August 3, 2026):**
> "On January 8, 2021, ColdCard firmware 3.2.1 formally announced license change ...
(3/N):
**From Bitcoin Magazine Podcast (January 21, 2021) - Douglas Bakkum on RNG (for comparison):**
> "We have two random number generators on two different chips inside the device. We also use some randomness from the computer that's fed into that. We also use some randomness during the factory installation, a random number set, and also randomness from the user itself, a hash of their password. And so we cryptographically combine all that in order to generate your wallet."
**Analysis:** NVK claimed in 2019 that the secure element's TRNG was second only to dice for randomness. However, firmware 4.0 (March 2021) apparently failed to properly use the TRNG, instead relying on a weak PRNG from the libngu library.
---
### 3. NVK's Claims About Code Quality & Security Scrutiny
**From Stephan Livera Podcast SLP418 - "NVK Tapsigner: Bitcoin Hardware for the Masses?" (October 4, 2022) - NVK speaking about libngu:**
> "So we're working on adding that. I think we just made a PR to libngu, which is like glue for the actual like crypto library from core, libsec. So we're sort of like just, you know, progressing because **for us, it's a little bit different than other hardware wallets. We don't sort of YOLO transactions. You know, transactions on cold card, they are sanity checked and they have like a little bit more scrutiny before the device signs it.**"
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=18f258a1-cf98-4171-ab30-7954f30ea982_p99)** | **[Audio](https://audio.pullthatupjamie.ai/759235/18f258a1-cf98-4171-ab30-7954f30ea982.mp3)**
**From UNGOVERNABLE Podcast (August 1, 2026):**
> "that's that's where this bug was introduced, where it went from from calling the old the old source of entropy to calling something, within this library, within the LibNGU library. And, and whatever however it was wired up behind the scenes there, **it did not correctly, incorporate the entropy.** So I feel like there's I don't wanna say that like, decisively say that the decision to abandon, you know, free and open source software caused this. I don't think that's, like, a fair characterization."
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233_p61)** | **[Audio](https://audio.pullthatupjamie.ai/352598/483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233.mp3)**
**Analysis:** NVK emphasized "scrutiny" and not "YOLO-ing" code changes. Yet the March 2021 firmware 4.0 release introduced a critical entropy flaw in a massive 120-file commit that changed both licensing and seed generation simultaneously.
---
### 4. The Quiet Firmware 4.0.1 "Fix"
**From Rabbit Hole Recap (Week of March 29, 2021):**
> "Not a hack, but they had a vulnerability that was self-discovered. So they have a new firmware version, 4.0.1, or is it 0.01? 4.0.1. Yeah. You messed up... **And you're only vulnerable if you had already upgraded to 4.0.0, which was their big upgrade. If it's not, then you're not vulnerable. I have no idea what this vulnerability is. NVK wouldn't tell me what it was for the sake of the users because he's afraid I was going to steal all your Bitcoin.** But yeah, upgrade."
**From Bitcoin Magazine Podcast (January 21, 2021) - Douglas Bakkum on RNG (for comparison):**
> "We have two random number generators on two different chips inside the device. We also use some randomness from the computer that's fed into that. We also use some randomness during the factory installation, a random number set, and also randomness from the user itself, a hash of their password. And so we cryptographically combine all that in order to generate your wallet."
**Analysis:** NVK claimed in 2019 that the secure element's TRNG was second only to dice for randomness. However, firmware 4.0 (March 2021) apparently failed to properly use the TRNG, instead relying on a weak PRNG from the libngu library.
---
### 3. NVK's Claims About Code Quality & Security Scrutiny
**From Stephan Livera Podcast SLP418 - "NVK Tapsigner: Bitcoin Hardware for the Masses?" (October 4, 2022) - NVK speaking about libngu:**
> "So we're working on adding that. I think we just made a PR to libngu, which is like glue for the actual like crypto library from core, libsec. So we're sort of like just, you know, progressing because **for us, it's a little bit different than other hardware wallets. We don't sort of YOLO transactions. You know, transactions on cold card, they are sanity checked and they have like a little bit more scrutiny before the device signs it.**"
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=18f258a1-cf98-4171-ab30-7954f30ea982_p99)** | **[Audio](https://audio.pullthatupjamie.ai/759235/18f258a1-cf98-4171-ab30-7954f30ea982.mp3)**
**From UNGOVERNABLE Podcast (August 1, 2026):**
> "that's that's where this bug was introduced, where it went from from calling the old the old source of entropy to calling something, within this library, within the LibNGU library. And, and whatever however it was wired up behind the scenes there, **it did not correctly, incorporate the entropy.** So I feel like there's I don't wanna say that like, decisively say that the decision to abandon, you know, free and open source software caused this. I don't think that's, like, a fair characterization."
**🎧 [Listen to clip](https://pullthatupjamie.ai/share?clip=483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233_p61)** | **[Audio](https://audio.pullthatupjamie.ai/352598/483953a7-1e90-42b8-88a5-9a1213d37f3f-c88dfb2d-f3b6-4bea-bb5f-df1360822233.mp3)**
**Analysis:** NVK emphasized "scrutiny" and not "YOLO-ing" code changes. Yet the March 2021 firmware 4.0 release introduced a critical entropy flaw in a massive 120-file commit that changed both licensing and seed generation simultaneously.
---
### 4. The Quiet Firmware 4.0.1 "Fix"
**From Rabbit Hole Recap (Week of March 29, 2021):**
> "Not a hack, but they had a vulnerability that was self-discovered. So they have a new firmware version, 4.0.1, or is it 0.01? 4.0.1. Yeah. You messed up... **And you're only vulnerable if you had already upgraded to 4.0.0, which was their big upgrade. If it's not, then you're not vulnerable. I have no idea what this vulnerability is. NVK wouldn't tell me what it was for the sake of the users because he's afraid I was going to steal all your Bitcoin.** But yeah, upgrade."
2
