August 1, 2026
Bad luck, worse commit
When random.bytes() runs but doesn't work
A five-letter note, missing randomness, and commenters screaming cover-up
TLDR: A Coldcard code change tied to its random number system was reportedly introduced in a huge update labeled only “runs,” and that’s now fueling serious alarm over how a security device was handled. In the comments, people are split between calling it gross incompetence, suspecting sabotage, and arguing the article itself got key details wrong.
The actual bug story is ugly enough: a guest investigation into Coldcard’s firmware history says a change tied to its random number system was introduced in a massive code update labeled simply “runs”. For a device meant to protect Bitcoin fortunes, commenters were absolutely not in a forgiving mood. The big outrage wasn’t just that the code failed — it was that such sensitive changes appeared to come with almost no explanation, leading many readers to ask how something this important got waved through with a shrug and a five-letter commit message.
And then the comments went full tabloid. One camp called it staggering negligence, with one user predicting losses could top $100 million and demanding jail time. Another crowd went even darker, openly wondering whether a “broken random number generator” is the kind of bug that looks a little too convenient, tossing around suspicions of bribery and “three-letter agencies.” Yes, the conspiracy meter hit red. But not everyone agreed with the article itself: one technical commenter barged in to say the writeup misunderstood the flaw, arguing the situation was more complicated than “someone flipped one bad switch.” So now we’ve got the full internet package: panic, blame, conspiracy, and a fact-check fight in the replies.
There was even a side serving of programmer snark, with one commenter basically saying tools like MicroPython make people think embedded development is easy — until it absolutely, spectacularly isn’t. The meme underneath all of this? Imagine random.bytes() running… but the randomness forgot to show up.
Key Points
- •The article analyzes Coldcard firmware commit history to explain how a low-entropy bug was introduced.
- •A Coldcard firmware commit titled "runs" is identified as changing 1,534 lines with a five-character commit message.
- •A second commit in the libngu repository titled "x" is described as changing about 1,000 lines with a one-character message.
- •The article says the line `#define MICROPY_HW_ENABLE_RNG (0)` disabled the hardware RNG in Micropython on STM32-based Coldcard devices.
- •The post points to custom `rng.h` and `rng.c` code as an attempted override of STM32 RNG functionality that ran into definition conflicts.