Unbelievable that redditors were recommending Cold Card!

Coinkite (the company behind Cold Card) has 2-10 employees according to their LinkedIn Page. Their venture capital funding (tracked by PitchBook) is listed as $122K, while Tracxn logs it as $115K. This is a boutique shop, essentially a mom and pop establishment. The typical errors and omissions insurance carried by a business this size is $1 to $2 million. A likely outcome is that they are going to be in bankruptcy and customers are not going to be made whole because this is a boutique operation with no significant cash reserve, balance sheet, insurance, etc.

By comparison Ledger has 500-1000 employees, $613 million in venture capital, revenue in triple digit millions, and a 2026 estimated valuation of $4 billion. Lets talk nuts an bolts. Coinkite disabled the hardware TRNG (true random number generator) in the code. This was probably done during debugging by the developer and then not re-enabled when they shipped the firmware. As a result, the 24 word passphrase is generated using the serial number and internal clock with an XOR operation. The entire output space is 4.2 billion combinations. A desktop computer can crack this in about 20 minutes.

By comparison Ledger uses a TRNG which has undergone extensive independent, third party audits and achieved major certifications such as AIS-31 and EAL5+. The ring oscillators inside the Secure Element chip extract raw physical chaos from thermal fluctuations. The chip filters and concentrates this physical noise into a string of 256 ones and zeros (binary bits). Because the certified hardware guarantees that every bit has an exact 50% chance of being a 1 or a 0 (called "full entropy"), the mathematical possibility space is precisely:2²⁵⁶ combinations. In standard numbering, this is 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936. Using brute force it would take longer than the remaining lifespan of the universe to crack this number. Ledger also runs active hardware health self-testing to determine if an attacker tries to freeze the chip, spike the voltage, or fire a laser to make the output predictable. Ledger will refuse to generate a private key if the chip is damaged in any way.

What can we take away from all this? First I am not trying to advertise for Ledger and I have no vested interest in the company. I just wanted to compare Coinkite to a major player in the hardware wallet space so we can see the differences. You could just as easily compare to Trezor or any other number of hardware wallets, but I chose Ledger for this example. Some users may think moving to an exchange is the answer, but let's revisit some history. Here is a short list of some of the exchanges that have been hacked or collapsed: Bybit (lost $1.5 billion), FTX ($8 billion), Celcius (1.2 billion) and we could go on and on. $38 million stolen is tiny compared to the loss customers experienced when exchanges collapsed or were hacked. That is not to minimize what happened to people affected by the Cold Card firmware bug, some lost their life savings! I can't imagine the blow this would be to have saved for years and tried to do everything right to secure their hard earned money. My question is why did redditors not do any DD and religiously recommended a company with between 2-10 employees to safeguard their life savings?

EDIT: The new technical deep dive into the entropy issue from cold card https://blog.coinkite.com/entropy-technical-backgrounder/ shows it all came down to this code: MICROPY_HW_ENABLE_RNG was set to 0 disabling the hardware TRNG and causing failback to an insecure method of key generation. The compiler error checking only checked to see that MICROPY_HW_ENABLE_RNG was defined instead of evaluating the Boolean value (it should have been 1 for enabled). Coinkite's small team size is a likely a major factor behind why this complex integration bug slipped through the cracks. Because of the small operational footprint (less than 10 employees), they lack dedicated, multi-layered SecDevOps, automated regression, and independent QA departments that larger competitors use to stress-test software updates. In a large company the engineer writing code is entirely separate from the SecDevOps team, but in a boutique frim, the core developers have to wear multiple hats - writing the code, configuring the build files, checking their own work, all of this increases the risk of poor coding such as this.