You bought a Coldcard because “not your keys, not your coins.” But what if the keys themselves were the problem?
The Coldcard entropy bug is the biggest hardware wallet disaster of 2026 — and the timeline just revealed WHY it happened.
Follow the timeline. Follow the money.
- July 28, 2020: Foundation announces its Passport wallet, built on Coldcard’s firmware — which was GPLv3 open source at the time.
- July 30, 2020: NVK publicly REGRETS the GPL license because Coldcard now had a “clone.”
- November 18, 2020: Coldcard switches to MIT + Commons Clause — explicitly prohibiting commercial products derived from the software.
- March 1, 2021: A 120-file commit removes the GPL crypto libraries, replaces them with “libNgU” (licensed “Bitcoin Only”), and changes the SEED GENERATION CODE.
- March 17, 2021: Version 4.0.0 removes the “last remaining GPL code.”
The Entropy Bug Lives In That Commit
Foundation’s analysis — and they should know, they were the catalyst — says the entropy bug was collateral damage from this licensing overhaul.
The same 120-file commit that ripped out the old GPL crypto code is the commit that broke seed generation.
Let that sink in.
Coldcard Chose License Paranoia Over Your Keys
NVK saw a competitor using his code and got butthurt. So instead of keeping the battle-tested GPL crypto libraries that millions of users trusted, he tore them out.
The explicit goal was removing GPL code. The side effect was breaking entropy — the thing that determines whether your seed phrase is unique, or collides with someone else’s.
Your hardware wallet’s ENTIRE JOB is generating good randomness. And Coldcard broke that while rearranging the code to keep out “clones.”
The Irony Is Unbearable
They changed the license to stop a competitor from building on their work. Instead, they shipped a bug that may have compromised users’ keys.
Competition wasn’t the threat. The threat was their own code rewrite, driven by licensing paranoia.
“Not your keys, not your coins” — unless Coldcard’s entropy bug means your keys were also someone else’s keys.
The Lesson
Hardware wallets are trust machines. When a company changes licensing for business reasons and rewrites core crypto code at the same time, you’re the beta tester.
Check your Coldcard. Check your seed. Check your balances. And if you’ve been holding on a Coldcard since before v4.0.0, assume nothing.
This is why the mantra is not “buy the most popular wallet.” It’s “verify, verify, verify.”
Your keys were never your keys — they were a licensing dispute.
COLDCARD'S ENTROPY BUG WAS LICENSE PARANOIA — THEY BROKE YOUR KEYS TO KEEP OUT 'CLONES'
