#Coinkite's claim that Odell's self custody guide protects against the USB REPL bug is nonsense. An attacker with physical access to an unlocked #Coldcard could simply plug it in and use the REPL, regardless of the user's setup method.
Look at their disclosure: "After a successful login enabled the normal VCP+HID USB stack, a connected test host could send Control-C, interrupt the user interface, and enter the MicroPython REPL. That provided firmware-level Python access and could expose secrets available to the running firmware."
They want you to believe NVK privately briefed Odell on a bug that never reached customers, warned that revealing details could enable remote theft of every affected wallet (impossible for a USB-only physical-access bug), and claimed Odell’s microSD air-gapped instructions would protect users—when those instructions do nothing once an attacker already holds an unlocked device and simply plugs it in.
None of that tracks with the USB REPL issue. Every detail matches the entropy vulnerability that was already in the firmware being distributed.
https://coinkite.com/historical-disclosures
Laser
npub1vj…kd33q
2026-08-09 02:26:05 UTC
Author Public Key
npub1vjk0gp2l4qnte2uy2l3ya78m5ays4wc7wmd6k64gw5498g8tf49qtkd33qSeen on
wss://nostr.momPublished at
2026-08-09 02:26:05 UTCEvent JSON
{
"id": "00002d0d30df2069107002530fcb8f6fea497b74df1bc32e449c1e3c473af385",
"pubkey": "64acf4055fa826bcab8457e24ef8fba7490abb1e76dbab6aa8752a53a0eb4d4a",
"created_at": 1786242365,
"kind": 1,
"tags": [
[
"t",
"coinkite"
],
[
"t",
"coldcard"
],
[
"client",
"Dark Wisp"
],
[
"nonce",
"170617",
"18"
]
],
"content": "#Coinkite's claim that Odell's self custody guide protects against the USB REPL bug is nonsense. An attacker with physical access to an unlocked #Coldcard could simply plug it in and use the REPL, regardless of the user's setup method.\n\nLook at their disclosure: \"After a successful login enabled the normal VCP+HID USB stack, a connected test host could send Control-C, interrupt the user interface, and enter the MicroPython REPL. That provided firmware-level Python access and could expose secrets available to the running firmware.\"\n\nThey want you to believe NVK privately briefed Odell on a bug that never reached customers, warned that revealing details could enable remote theft of every affected wallet (impossible for a USB-only physical-access bug), and claimed Odell’s microSD air-gapped instructions would protect users—when those instructions do nothing once an attacker already holds an unlocked device and simply plugs it in.\n\nNone of that tracks with the USB REPL issue. Every detail matches the entropy vulnerability that was already in the firmware being distributed.\n\nhttps://coinkite.com/historical-disclosures",
"sig": "6515c0119dae7ba13e6e7586b6ebb6f54a7f3e2299fd9c274819514964f1f977d30612baa91f679e1350ef70ea8f96d97bc6ef2bde96bb6958dfceb612f70120"
}