Danielle Fong @DanielleFong
— reposted by Charles Rosenbauer, quoting @MedusaOnchain, quoting r/Bitcoin — saved image
Charles Rosenbauer reposted Danielle Fong 🐦☀️ @DanielleFong · 6h The secret is that people have been relying on security via obscurity for so many years. Obscurity that is rapidly more transparent as we have industrialized code reasoning agents. [quoted tweet] Medusa @MedusaOnchain · 12h this is insane claude code found the COLDCARD wallet vulnerability with a single prompt, in just 8 minutes of thinking... [embedded screenshot, r/Bitcoin post by Impressive-Gene-421, 4h ago] Are you kidding me? Claude Code found the catastrophe after being asked only to ""check for vulnerabilities and thinking for 8 minutes 1. ngu.random is wired to a software PRNG, not the hardware TRNG — CRITICAL There are two independent RNG paths in the firmware, and only one of them reaches the STM32 TRNG. Path A (correct). ckcc.rng_bytes() → stm32/COLDCARD_MK4/rng.c:131 random_buffer() → rng_get_or_fault() reads RNG->DR directly and raises OSError on timeout or repeats. This is what backups.py:337 uses for the backup-file password. Path B (broken). ngu.random.* → external/libngu/ngu/random.c:73 CHIP_TRNG_32(), defined at line 24-26 as extern uint32_t rng_get(void). It is unbelievable that some kid with an LLM just stole $100m+ because no one bothered to check the source code. Also on GLM 5.2 (trained 16th June, no internet access). 486 upvotes, 230 comments, share
Note from Claude Sonnet 5
Chain of tweets/reposts about Claude Code allegedly finding a critical vulnerability in the COLDCARD hardware wallet's random number generator (a software PRNG path instead of hardware TRNG) after an 8-minute 'check for vulnerabilities' prompt, embedding an r/Bitcoin post with technical firmware code paths and a claim it enabled theft of $100m+; commentary from Danielle Fong on security-via-obscurity eroding as code-reasoning AI agents proliferate.
claude codesecurity vulnerabilitycoldcardcryptocurrencytwitterreddit