- Coldcard branded "Don't Trust. Verify." — never audited the seed-generation path
- Since Mar 2021: hardware TRNG silently disabled (
MICROPY_HW_ENABLE_RNG=0); Yasmarang software PRNG ran instead - Seed looked valid; entropy was not — on-chain losses in the ~$100M+ range
- Error 1: Source-available ≠ audited (restrictive license ≠ open-source scrutiny)
- Error 2: Workflow security ≠ seed security — SE/PSBT reviewed; entropy path was not
- Error 3: Social capital ≠ verification — HWI/Core tooling + endorsements made Coldcard the default
- HWI → maintenance mode (Optech #418): ecosystem consequence of credentialed trust without seed-path audit
secsov.com/articles/dont-trust-verify · Optech #416 · Optech #418