Foundation Devices CEO says Coldcard entropy vulnerability may have originated from 2021 firmware rewrite

According to Odaily, Bitcoin News posted on X stating that Foundation Devices CEO Zach Herbert said the Coldcard entropy vulnerability appears to have been introduced during a major firmware rewrite in March 2021, which replaced the wallet's remaining GPL code with a new cryptographic library. Herbert outlined the timeline, noting that Foundation announced the launch of Passport in July 2020, which at the time used Coldcard’s GPL firmware. Subsequently, Coinkite shifted to a source-available license and initiated a significant code refactor. He emphasized that the rewrite also aimed for technical improvements, including the adoption of Bitcoin Core’s libsecp256k1, faster cryptographic implementations, and reproducible builds. Herbert stated that there is no evidence the vulnerability was caused solely by licensing factors, but that it was introduced in the same commit that removed the remaining GPL code dependency, involving 120 files.