Since the entropy was so low you wouldn't need to know about the vulnerability specifically, just a naive collider script would get lucky once in awhile.

Knowing the vulnerability just ups the success rate. You can mine weak seeds just as you mine blocks.

Attackers in 2022 may not even know they were Coldcard seeds, just generally weak seeds.

You'd still have to tell users to regen their seeds, even if you could obfuscate the code change in a larger refactor you'd still have to highlight the issue at a high level.

Core bugs dealt with that way are more run time, afaik they've never had an entropy or RNG bug.

I still think that's possible and hope for users sake it is, but other evidence points to this being a naive attacker given they used a paid API for address indexes and didn't immediately sweep all plausible derivation paths.

These are some of the most toxic coins ever now, if they're really a whitehat they should send them to a coinjoin too just so people also realize how stupid those are after they get tracked through.

If Coinkite were to have done it'd I think the way to go would have been coordinated well with communications, a thorough sweep a handful of few blocks before announcement with instructions on preserving your device for fingerprint proof of ownership.

That's the catch-22, their support has surely dealt with user error constantly for years.

All those PEBKAC reports make legitimate reports harder to identify.

However, since randomness is literally the devices one and only job, you'd think at some point it was inspected at the library level. That's ultimately what happened, so many drains at once it could no longer be ignored.