122. Weak Entropy, Broken Trust, and the $90M Coldcard Fallout

In this episode, we spent most of our time unpacking the Coldcard firmware exploit and the chaos that followed across the Bitcoin self-custody world. From our perspective, this was a painful but important conversation about broken trust, weak entropy, and the real-world consequences of software mistakes in security-critical products. We walked through how the vulnerability appears to have stemmed from a flawed random number generation implementation, why so many wallets were exposed, and how quickly attackers were able to sweep funds once the issue became public. We also discussed why this incident has reignited the debate around GPL licensing, open development, and the value of broad community review for Bitcoin hardware and firmware projects.We also zoomed out to talk about what this means for Bitcoin builders and operators going forward. That included the importance of defensive self-custody practices, why simply applying a hotfix may not be enough to restore confidence, and how the broader community responded with audits, tooling, data analysis, and emergency migration help. We wrapped by connecting these lessons to open-source mining development, including updates from the 256 Foundation ecosystem and the latest Mujina developer call, where contributors are working to build community-owned tools the right way: in public, with transparency, shared responsibility, and long-term resilience in mind.