I see people making the argument that the Coldcard bug was a result of the fact that the license prevented others from using their code in products, so there wasn't enough incentive to audit it.
I strongly doubt it. I bet a *lot* of people did examine it, but didn't spot the error. And unlike every other piece of functionality --- apart from entropy generation --- just looking at the output, even looking at hundreds of outputs, wouldn't have revealed the bug.
waxwing
npub1va…knuu7
2026-08-11 03:28:00 UTC
Author Public Key
npub1vadcfln4ugt2h9ruwsuwu5vu5am4xaka7pw6m7axy79aqyhp6u5q9knuu7Seen on
wss://relay.damus.ioPublished at
2026-08-11 03:28:00 UTCEvent JSON
{
"id": "cc8a3bf265d0f99b2adf0c2720c0a2d14399b8d383380947a0dd293bfe5b7649",
"pubkey": "675b84fe75e216ab947c7438ee519ca7775376ddf05dadfba6278bd012e1d728",
"created_at": 1786418880,
"kind": 1,
"tags": [
[
"alt",
"A short note: I see people making the argument that the Coldcard..."
],
[
"client",
"Amethyst"
]
],
"content": "I see people making the argument that the Coldcard bug was a result of the fact that the license prevented others from using their code in products, so there wasn't enough incentive to audit it.\n\nI strongly doubt it. I bet a *lot* of people did examine it, but didn't spot the error. And unlike every other piece of functionality --- apart from entropy generation --- just looking at the output, even looking at hundreds of outputs, wouldn't have revealed the bug.",
"sig": "7cd7c4691301a7b084c6aa65f396bf38afe465e9b88c1987476323237daf11811c261ed90fd43a8b2902789f59656ee4ad83e9aa18923dc7a3791b9b32bbba81"
}