Coldcard Rewrote Its Seed Code to Escape the GPL. Users Paid the Price.

Coldcard’s entropy catastrophe was a software failure. It was also a failure of ownership culture.

The immediate bug was in seed generation. For years, affected Coldcards could create wallets with far less entropy than users had been promised. An attacker could search the reduced space and recover the private keys needed to steal bitcoin. Coinkite’s security advisory now directs affected owners to install fixed firmware and migrate to a newly generated seed because an update leaves an old seed unchanged.

That is the technical failure. The reason Coldcard rewrote this part of its firmware begins with competition and licensing.

Coldcard originally built on free software from Trezor. That was exactly what free software was for. One company published useful security code under the GPL. Another studied and modified it, then sold a different device. Users gained another option, and knowledge moved freely between companies.

Then a new competitor exercised the same freedom.

In July 2020, Foundation announced Passport, a hardware wallet based partly on Coldcard’s GPLv3-licensed firmware. Coldcard responded by moving its firmware to licenses intended to stop competitors from doing what Coldcard itself had done with Trezor’s work, abandoning the rules from which it had benefited.

Coldcard added the Commons Clause to code it could relicense, prohibiting others from selling substantially derived products, a change Foundation documented at the time. Its January 2021 release notes announced the license change. Then, in March, a large commit replaced the remaining Trezor-derived GPL cryptography and BIP39 code with a new library. Coldcard’s 4.0.0 release notes celebrated that “all crypto and BIP-39 related code” had been replaced and that the “remaining GPL code” was gone.

The same commit rewired random.bytes to ngu.random.bytes and changed seed generation to use that path. Coinkite’s technical account and Block’s independent analysis trace the entropy failure through that integration. The repository establishes the sequence. Any claim that licensing alone caused the defect, or that another manufacturer would certainly have caught it, exceeds the available evidence.

A free-software license still permits bugs, as the histories of Trezor and Linux readily demonstrate. Every substantial body of software has them.

A public repository falls short of an audit, and a license serves a different function from a security review. A license determines who can use the code, who can improve it, who may ship the result, and who has a financial reason to understand it.

“Source available” allows strangers to look at code. Free software allows them to run it, modify it, distribute it, maintain it, and build a business around making it better. Those are different security models.

Looking through somebody else’s code is usually a spare-time activity. Depending on that code in a shipping product creates an enduring reason to test it, understand it, review changes, report defects, and carry fixes downstream.

Coldcard preserved visibility while restricting productive reuse. Its firmware remained readable, but the community of developers with an incentive to work on it became smaller. A competing hardware company could no longer safely make Coldcard’s implementation part of its own product. Fewer independent engineers had a commercial reason to understand its vendor-specific library deeply.

Coldcard gained more control over who could compete with it. Its users lost some of the scrutiny that competition could have supplied.

The lost scrutiny is why putting source code on GitHub is insufficient.

Source availability helps users inspect behavior and verify builds. Those are useful properties. They are not software freedom. If a license withholds the freedom to reuse and improve a program for real purposes, including commercial ones, the vendor has provided a window into its code without creating a commons around it.

The distinction is especially important in hardware security.

A signing device asks its owner to trust firmware with secrets that cannot be recalled after a failure. Claims about air gaps, secure elements, reproducible builds, and tamper-resistant packaging all depend on the code that creates and handles the keys.

That code should be shared infrastructure. Multiple independent teams should have both the right and the incentive to test it in production.

Coldcard’s attempt to restrict competition coincided with divergence in one of the least forgiving parts of the system. The replacement did not change a decorative feature or a menu. It touched cryptography and seed generation.

Users carried the risk of that business decision.

Hardware manufacturers should go beyond publishing code that others may only inspect. Their firmware should be free software. Users and competitors should have the legal freedom to run it, study it, modify it, redistribute it, and sell products based on it. Licenses should protect those freedoms downstream; commercial restrictions belong under an honest label.

Manufacturers should publish hardware designs as free hardware wherever their component agreements permit it. They should make reproducible builds routine, accept upstream contributions, fund independent reviews, and allow owners to install firmware they build themselves. Security-critical libraries should remain shared foundations improved across products, leaving proprietary islands behind.

Competition does not improve when every manufacturer rewrites the dangerous parts. Companies can compete on hardware design, usability, support, manufacturing, and the quality of their reviews while maintaining common foundations together.

Users should demand more than visible source code. Ask whether anyone may build it, modify it, ship it, and maintain a competing implementation; then examine whether fixes move between products and how many independent organizations depend on the critical libraries. The device should also accept owner-built firmware.

For meaningful amounts of bitcoin, use multi-vendor multisig so that one manufacturer’s implementation failure cannot become a total loss.

Coldcard benefited from Trezor’s commitment to software freedom. When Foundation exercised the same freedom, Coldcard moved to restrict commercial reuse. That licensing project included replacing shared GPL code in a security-critical path. The replacement contained a catastrophic defect that remained undetected for years.

Coldcard tried to protect its product from competition.

It should have protected its users from Coldcard.