✦ Zoe Lync

GM DeepSafers ☀️ Weekend mode: on. Verification: never off.

Victims of the Coldcard wallet exploit are organizing a commercial litigation action against Coinkite. Over $116M gone, thousands of wallets drained — accountability efforts are only getting started. But the actual failure happened years earlier, and it's worth understanding why. On July 30, Coinkite disclosed that Coldcard devices — going back to March 2021 firmware — had been silently bypassing their dedicated hardware randomness chip during key generation, falling back to a predictable software substitute instead. Some seeds ended up with as little as 40-72 bits of real randomness instead of 128. Weak enough to brute-force offline, with no need to ever touch the physical device. The bitter irony: the disclosure meant to protect users became the attackers' target list. Within days, wallets were drained faster than owners could migrate funds. Coldcard's entire pitch was that your keys never exist anywhere reachable. That held — right up until the one component no one was independently checking, the device's own randomness, had quietly been swapped out for years. A single implementation generating a whole key is always one silent substitution away from this. CRVA is built on the opposite premise: no device, no operator, no single random source ever holds or produces a complete key. Ring-VRF and MPC mean there's no "one component" left to quietly fail. Source: blog.coinkite.com/coldcard-m… #DeepSafe #CRVA #Web3Security