It seems that the details were already posted all over the p...

Raw JSON

{
  "kind": 1,
  "id": "65ebfdb9b203df459e7c776bf0896b9150202611c70e013957dc3979bf8fe3e3",
  "pubkey": "52b4a076bcbbbdc3a1aefa3735816cf74993b1b8db202b01c883c58be7fad8bd",
  "created_at": 1785457688,
  "tags": [
    [
      "client",
      "Damus"
    ]
  ],
  "content": "It seems that the details were already posted all over the place over Twitter and Telegram, so here is an explanation of it:\n\nIn Coldcard, there are two implementations of getting bytes from the HWRNG, in cckt and libngu.\n\nThe path in libngu is used for generating seeds. This one calls the MicroPython API to get random values.\n\nThe MicroPython API uses the HWRNG if enabled. The problem was that Coinkite disabled the HWRNG for MicroPython.\n\nThis should not have been an issue, as libngu had a check to see if the HW RNG is enabled. However, this used ifndef, which explicitly checked *if the HW RNG enable was not configured*. It did not check if the HW RNG enable was turned off explicitly, which is what Coinkite did.\n\nThis led to their code using the flawed software MicroPython RNG, which was solely based on the device boot time and a very weak manufacturing identifier.\n\nThis means that there are not a lot of different seeds. In Mk4/Mk5, this issue still exists. The only difference is that 32 actually random bits (which is tiny) have been mixed into the RNG.\n\nBy overly complicating their codebase, in what can only be described as “attempted security through complexity”, they have put all user funds at risk.\n\nRegarding the implications:\n- If you generated using dice or wordlist or another method that included non-Coldcard entropy, you are fine.\n- If you generated on a non-Coldcard device, you are fine.\n- If not, your funds are at risk. A passphrase will help slow it down but the main seed is still compromised.\n\nMultisigs: You are affected *privacy wise* if one of your members is a Coldcard-generated seed. You are only at risk if the majority of your members are CC.\n\nSecure element RNGs: These are fine. You need a proper one though from Infineon/NXP/ST, and not the crappy IoT ones.\nAlso beware the HWW firmware can still butcher the resulting numbers.",
  "sig": "2a16107ccf57ba0e8a6c9ba20595bc49abbd547342286c8e4f3761b3bdb43558acd21208dc1dc8b1ef084a8c19efab1d83d74cd10afbb8234f358d5a3ed2c367"
}