← Back to context

Comment by gnabgib

12 hours ago

Definitely Ledger Ledger confirms spy chip implant behind wallet crypto thefts (796 points, 18 days ago, 515 comments) https://news.ycombinator.com/item?id=50078423

He's thinking of Coldcard, which accidentally switched their RNG from the hardware RNG to a predictable PRNG https://www.cryptotimes.io/learn/what-is-coldcard-hack/

> Coldcard’s software is built on MicroPython, and Coinkite supplies its own hardware-RNG wrapper for the device’s STM32 chip. To avoid conflicts, Coinkite deliberately disabled MicroPython’s built-in RNG path by setting a configuration flag, MICROPY_HW_ENABLE_RNG, to zero. The problem: the underlying library checked only whether that flag was defined, not whether it was enabled (set to a non-zero value). Because a flag set to zero is still “defined,” the build silently compiled against the wrong code, and seed generation fell back to a deterministic software pseudo-random number generator called Yasmarang