BOM Reddit Mentions | ChartExchange

First thing first -> **Title must be -> Coldcard Wallets Security Advisory not just Mk3!**
\-------------------------------------------------------------------------------------------------
For years, Coinkite (and founder NVK) built their entire brand on Twitter, Nostr, and podcasts by mocking every competitor in the space. Ledger was "closed-source garbage," Trezor was "insecure glitching junk," and BitBox or Jade were dismissed for using standard consumer-friendly hardware.
They sold the community on a clear-cut promise: *"We charge Apple-tier prices for a device that looks like a 1990s gas station calculator because every single dollar goes into paranoid-grade security engineering."*
Well, almost $40 million in automated-drained Bitcoin later, that entire narrative has completely unraveled.
# 1. The "Security Superiority Complex" Met Its Match: A C-Preprocessor Misconfiguration
After years of preaching "adversarial thinking" and treating everyone else like amateurs, Coinkite fell victim to a rookie-level software integration error in their own build system:
* They set `#define MICROPY_HW_ENABLE_RNG (0)` to use their own custom driver.
* Their entropy library used an `#ifndef` check instead of an `#if` check, meaning compilation passed cleanly without throwing a build error.
* The firmware silently bypassed the hardware TRNG and defaulted to a weak MicroPython software fallback (Yasmarang PRNG) seeded by non-secret system clocks and chip serial numbers.
* **The result:** Effective entropy collapsed down to \~40 bits on Mk3 units. Attackers swept \~594 BTC from 500+ single-sig wallets in a 25-minute window.
They built a physical fortress designed to withstand futuristic side-channel laser probing, but left the front door wide open by accidentally disabling hardware randomness in MicroPython.
# 2. $250+ for Cheap Plastic and Zero Automated CI/CD Testing
The Bill of Materials (BOM) on a Coldcard is laughably cheap: injection-molded clear acrylic, cheap rubber keypads, and off-the-shelf monochrome OLEDs.
We were told the high retail price ($170–$290 USD) paid for uncompromised R&D and world-class testing. But if a simple Python macro flag disabling the hardware TRNG went completely undetected in production firmware for years, where was their automated testing?
Where were the basic statistical battery entropy tests (Dieharder, NIST) in their release pipeline? Users paid premium prices for $15 POS calculator hardware, only to receive firmware that failed at the single most critical job of a hardware wallet: generating true random numbers.
# 3. The "Stealth Wallet" Lie
Whenever critics pointed out that the Coldcard looks like a middle-school TI-83, fanboys claimed it was a feature: *"It’s a stealth wallet! Thieves will think it's junk!"*
A clear plastic brick showing a bare circuit board with `"SHOOT THESE"` literally printed over the secure elements, a numeric keypad, dual MicroSD slots, and a screen doesn't fool anyone. To a burglar, custom-control officer, or thief, it screams specialized hardware. It was never "stealth"—it was just cheap industrial design disguised as a security feature.
# 4. The r/BitcoinCA Local Echo Chamber
When Ledger had their marketing database leaks or released their optional recover service, this sub (and general Bitcoin subs) rightfully tore them apart.
Yet when a Toronto-based vendor suffers a catastrophic firmware bug that results in a multi-million-dollar on-chain drain, local podcasters and influencers immediately jump to defend them: *"Well, you should have used dice rolls anyway!"*
If you're charging $250 for a hardware wallet, the user shouldn't have to manually roll dice 100 times to fix your broken MicroPython build system.
# 5. "Not Your Keys, Not Your Coins" Cuts Both Ways
For years, Coinkite’s entire brand ethos was built around personal responsibility and absolute self-sovereignty. Their core mantra was: *"Don't trust, verify. You are responsible for your own security."*
When things go right, they take credit for selling "uncompromising security." But when their own firmware silently degrades hardware randomness down to a 40-bit predictable loop, that same philosophy is weaponized against the user:
>
# 6. The Zero-Insurance Reality for Victims
* **No Fund or Treasury to Pay Back Users:** Coinkite is a small, privately owned hardware company out of Toronto. They do not have $38M+ sitting in a corporate vault to compensate users out-of-pocket, nor do their Terms of Service cover software bugs.
* **The "Update & Move On" Response:** Their advisory relies entirely on asking affected users to generate a brand-new seed phrase and transfer their remaining funds to a new wallet.
Holding hardware vendors accountable isn't "FUD" - it's basic common sense. Stop giving pass marks to arrogance wrapped in cheap plastic.

.dark-mode .jXgZ6B{ color: white; background-color: #333333; border: 2px solid white; }.light-mode .jXgZ6B{ color: #333333; background-color: white; border: 2px solid #333333; }BOMBomi Italia S.p.A.stock NYSE

BOM
Bomi Italia S.p.A.
stock NYSE