Foundation's Zach Herbert Ties Coldcard's Entropy Bug to a 2021 Licensing Fight With Coinkite
As the Coldcard entropy bug dominated the weekend, a rival hardware wallet maker offered a theory for how a five year old flaw slipped through unnoticed: it may trace back to a licensing dispute Coinkite had with a competitor.
THE TIMELINE
Zach Herbert, the CEO of Foundation Devices, which makes the Passport hardware wallet, laid out a sequence of events on social media. Foundation announced Passport in July 2020 using Coldcard's then-GPL firmware, after which Coinkite moved to a source-available license and launched a major code overhaul. Coinkite's founder did not hide his frustration at the time. On July 30, 2020, NVK publicly said he regretted choosing GPL because Coldcard now had a "clone" and that they would change things in future updates.
The license change followed in stages. On November 18, 2020, Coldcard added its MIT plus Commons Clause license, prohibiting commercial products substantially derived from the software. On January 8, 2021, Coldcard firmware 3.2.1 formally announced a license change from GPL to MIT with Commons Clause on files where GPL did not apply.
WHERE THE BUG ENTERED THE CODE
Herbert says the Coldcard entropy bug appears to have been introduced during a sweeping March 2021 firmware rewrite that replaced the wallet's remaining GPL code with new cryptographic libraries. He is careful not to overstate the connection. Herbert says there is no evidence licensing alone caused the bug, but notes the vulnerability was introduced in the same 120-file commit that removed the remaining GPL code dependencies. He also credits the rewrite with real technical upside. The rewrite also pursued technical improvements, including adopting Bitcoin Core's libsecp256k1, faster cryptographic implementations, and reproducible builds.
WHY IT MATTERS
The theory does not prove the license change caused the bug. What it does establish is a timeline: the same commit that stripped out the last of Coldcard's open source dependencies is the commit where the random number generator quietly stopped being called correctly. For a device whose entire security model rests on outside eyes being able to audit the code, that is a hard coincidence to shrug off. Herbert has a stake in the argument, since Foundation competes directly with Coinkite on fully open source hardware wallets, but the underlying commit history is public record and not in dispute.
This story comes from the Simply Bitcoin Live show. Watch the full episode.
