Coldcard flaw exposes hardware wallet testing gap

Coldcard's five-year seed-generation flaw routed wallet creation to a weaker MicroPython generator instead of its intended TRNG, escaping detection because audits verified the generator existed but not that it was called. Over 4,500 addresses were impacted, draining nearly $90 million in Bitcoin.